Skip to main content

Bulk update personal access tokens

PATCH 
/personal-access-tokens/v1/bulk-update

This applies a single JSON Patch document to multiple personal access tokens (PATs) in the current tenant in one request. The same patch is applied to every token referenced in ids. Up to 25 tokens can be updated per request. This is an administrative operation intended for org admins managing PATs across their tenant. The caller must have the idn:all-personal-access-tokens:update right. API OAuth client credentials are not permitted to call this endpoint. Note: This operation is also accessible via POST to the same path; both methods behave identically. Unlike the single-token patch endpoint, the request body uses Content-Type: application/json (not application/json-patch+json). Allowed patch paths Only expiration-related paths may be modified in bulk:

  • /expirationDate - Set or clear the token's expiration date. Any other path (for example /name or /scope) results in a 400 response.
  • /userAwareTokenNeverExpires - Explicit acknowledgment that the token will never expire. expirationDate and userAwareTokenNeverExpires Relationship: When clearing expirationDate (either by removing it or replacing it with null), userAwareTokenNeverExpires must also be set to true in the same patch. This serves as an explicit acknowledgment that the caller is aware of the security implications of creating a token that will never expire. When expirationDate is set to a valid future date-time, userAwareTokenNeverExpires can be omitted. Note: userAwareTokenNeverExpires is stored internally and is not returned in the response.

Request​

Responses​

The bulk update succeeded. Returns the updated representation of each personal access token, sorted by id.