> ## Documentation Index > Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rotate the runtime gateway token for one protection ## OpenAPI ````yaml /api-reference/openapi.json post /oauth/protections/{protectionId}/rotate-runtime-token openapi: 3.0.0 info: title: AIRCTRL API description: >- Programmatic access to AIRCTRL. Record values are encrypted by the client, so the API stores ciphertext and encrypted keys instead of plaintext record values. version: '1' contact: {} servers: - url: https://api.airctrl.dev/v1 description: Production - url: https://api.staging.airctrl.dev/v1 description: QA security: [] tags: - name: Context description: Find the accounts available to the caller. - name: Projects description: Create and manage projects. - name: Records description: Store and use client-encrypted records. - name: Audit description: Read record activity and access history. - name: Providers description: Discover supported AI providers. - name: Provider Credentials description: Manage encrypted provider credentials. - name: Gateways description: Create and operate AI gateways. - name: Usage description: Read gateway usage and spend data. - name: Service Accounts description: Read Service Account metadata and grant records. paths: /oauth/protections/{protectionId}/rotate-runtime-token: post: tags: - OAuth summary: Rotate the runtime gateway token for one protection parameters: - in: path name: protectionId required: true description: AIRCTRL protection ID returned for one external resource. schema: type: string format: uuid - in: header name: Idempotency-Key required: true description: >- Stable operation key used to replay the same one-time token plaintext safely. schema: type: string minLength: 16 maxLength: 200 responses: '200': description: >- Protection metadata bound to one external resource. Provider secrets are never returned; creation, runtime-token rotation and reactivation include the new runtime token plaintext once. content: application/json: schema: type: object required: - ok - data properties: ok: type: boolean enum: - true data: type: object required: - protectionId - externalResourceId - project - serviceAccount - providerCredential - gateway - gatewayToken - state - accessRevokedAt - connectionSuspendedAt - createdAt properties: protectionId: type: string format: uuid externalResourceId: type: string project: type: object required: - id - name properties: id: type: string format: uuid name: type: string serviceAccount: type: object required: - id - name - active properties: id: type: string format: uuid name: type: string active: type: boolean providerCredential: type: object required: - id - providerId - providerSlug - label properties: id: type: string format: uuid providerId: type: string format: uuid providerSlug: type: string label: type: string gateway: type: object required: - id - slug - name - models - settings properties: id: type: string format: uuid slug: type: string name: type: string models: type: array items: type: string settings: type: object properties: spendLimit: type: number minimum: 0 multipleOf: 0.01 nullable: true spendWindow: type: string enum: - daily - weekly - monthly rateLimitPerMin: type: integer minimum: 1 nullable: true loggingEnabled: type: boolean logBodies: type: boolean guardrailMode: type: string enum: - 'off' - flag - redact - block additionalProperties: false required: - spendLimit - spendWindow - rateLimitPerMin - loggingEnabled - logBodies - guardrailMode gatewayToken: type: object required: - id - prefix properties: id: type: string format: uuid prefix: type: string plaintext: type: string writeOnly: true description: >- Returned once on creation, rotation or reactivation. state: type: string enum: - active - connection_suspended - revoked description: >- connection_suspended means the parent OAuth connection was disconnected; revoked means this protection was explicitly revoked. accessRevokedAt: type: string format: date-time nullable: true connectionSuspendedAt: type: string format: date-time nullable: true createdAt: type: string format: date-time replayed: type: boolean '400': description: Invalid body or idempotency key. content: application/json: schema: type: object properties: error: oneOf: - type: string - type: object properties: code: type: string message: type: string required: - code - message code: type: string message: type: string error_description: type: string requestId: type: string additionalProperties: true '403': description: Scope, OAuth connection or protection lifecycle denial. content: application/json: schema: type: object properties: error: oneOf: - type: string - type: object properties: code: type: string message: type: string required: - code - message code: type: string message: type: string error_description: type: string requestId: type: string additionalProperties: true '404': description: Protection is not bound to this OAuth connection. content: application/json: schema: type: object properties: error: oneOf: - type: string - type: object properties: code: type: string message: type: string required: - code - message code: type: string message: type: string error_description: type: string requestId: type: string additionalProperties: true '409': description: >- Protection is revoked, changed concurrently or the idempotent operation was superseded. content: application/json: schema: type: object properties: error: oneOf: - type: string - type: object properties: code: type: string message: type: string required: - code - message code: type: string message: type: string error_description: type: string requestId: type: string additionalProperties: true '502': description: Provider validation unavailable. content: application/json: schema: type: object properties: error: oneOf: - type: string - type: object properties: code: type: string message: type: string required: - code - message code: type: string message: type: string error_description: type: string requestId: type: string additionalProperties: true security: - oauth2: - protections:manage components: securitySchemes: oauth2: type: oauth2 flows: authorizationCode: authorizationUrl: https://app.airctrl.dev/oauth/authorize tokenUrl: https://api.airctrl.dev/v1/oauth/token refreshUrl: https://api.airctrl.dev/v1/oauth/token scopes: protections:provision: >- Atomically create the disclosed AIRCTRL resources for a protected external key. protections:read: Read only resources created by this OAuth connection. protections:update: >- Update allowlisted settings only on gateways created by this OAuth connection. protections:manage: >- Revoke, reactivate or rotate secrets only for protections created by this OAuth connection. protections:read-logs: >- Read request metadata only for protections created by this OAuth connection. protections:read-spend: >- Read token usage and spend only for protections created by this OAuth connection. offline_access: Receive rotating refresh tokens. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.