# Personal-Access-Token API can only change your own tokens

**URL:** <https://developer.sailpoint.com/discuss/t/personal-access-token-api-can-only-change-your-own-tokens/79219>\
**Category:** SHF Discussion and Questions\
**Tags:** apis, identity-security-cloud\
**Created:** [September 3, 2024, 11:30pm UTC](https://developer.sailpoint.com/discuss/t/personal-access-token-api-can-only-change-your-own-tokens/79219 "2024-09-03T23:30:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bthompson555](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@bthompson555](https://developer.sailpoint.com/discuss/u/bthompson555)\
**Post date:** [September 3, 2024, 11:30pm UTC](https://developer.sailpoint.com/discuss/t/personal-access-token-api-can-only-change-your-own-tokens/79219/1 "2024-09-03T23:30:46Z")

</div>

Good afternoon,  
I opened a support ticket because we get an error 500 when trying to change PATs that we did not generate. After looking at it for a couple months, they were able to confirm that the PATCH personal-access-tokens restricts full admins to only changing their own PATs.

From both a security (over-permissioned) and a tech support perspective (under or improperly permissioned), it would make sense for admins to be able to manage other users’ tokens, at a bare minimum to be able to alter the “scopes” array.

Can we confirm this is intentional and not a bug? (REF: case CS0298425, idea GOV-I-3838)

---

<div class="post-metadata">

**Author:** ![jrossicare](https://avatars.discourse-cdn.com/v4/letter/j/a698b9/32.png) [@jrossicare](https://developer.sailpoint.com/discuss/u/jrossicare)\
**Post date:** [September 4, 2024, 5:06am UTC](https://developer.sailpoint.com/discuss/t/personal-access-token-api-can-only-change-your-own-tokens/79219/2 "2024-09-04T05:06:54Z")

</div>

You can’t PATCH other users PATs, but you _can_ DELETE other users PATs.

🤔

---

<div class="post-metadata">

**Author:** ![GOKUL\_ANANTH\_M](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gokul_ananth_m/32/14416_2.png) [@GOKUL\_ANANTH\_M](https://developer.sailpoint.com/discuss/u/GOKUL_ANANTH_M)\
**Post date:** [September 4, 2024, 6:39am UTC](https://developer.sailpoint.com/discuss/t/personal-access-token-api-can-only-change-your-own-tokens/79219/3 "2024-09-04T06:39:40Z")

</div>

Yeah @jrossicare , I think we have discussed about it here - [Update PAT (Access Token) Scope via API](https://developer.sailpoint.com/discuss/t/update-pat-access-token-scope-via-api/78114)

You can’t `Patch` other user’s PAT, only `Delete` is supported.

---

<div class="post-metadata">

**Author:** ![bthompson555](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@bthompson555](https://developer.sailpoint.com/discuss/u/bthompson555)\
**Post date:** [September 4, 2024, 6:23pm UTC](https://developer.sailpoint.com/discuss/t/personal-access-token-api-can-only-change-your-own-tokens/79219/4 "2024-09-04T18:23:20Z")

</div>

Thanks for the redirect - this other topic didn’t come up when I initially searched.

This seems like a shortcoming if it’s intentional. I don’t understand the logic - if it’s a “don’t touch another user’s existing PATs even though you’re the top admin” thing, I’d think deleting a PAT would be MUCH worse than altering it… that’s guaranteed breakage and a lost key vs controlled burn in-place.

guess I’ll try and pursue on the idea page instead

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [November 3, 2024, 6:24pm UTC](https://developer.sailpoint.com/discuss/t/personal-access-token-api-can-only-change-your-own-tokens/79219/5 "2024-11-03T18:24:19Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.