identity.api-token.rotate

Rotate an API token by replacement (new UUID, old UUID revoked)

Rotate an API token by replacement: issue a new row, then revoke the old row.

Inputs:

• token_uuid: public uuid of the token to rotate (required)
• actor: Cognito sub or user UUID (required)
• ttl_seconds: Optional replacement lifetime, 60 seconds..365 days
• expires_at: Optional explicit replacement expiry; mutually exclusive with ttl_seconds

Outputs (terminal state_data):

• old_token_uuid
• token_uuid: public uuid of the new row
• name: preserved from the old token
• token: plaintext — returned ONCE, never retrievable again
• rotated_at
• expires_at: preserved or replaced expiry metadata, when set

Overview

Property	Value
Workflow type	Atomic
Library	App-identity
Version	1.0

Input Schema

Field	Type	Required	Default	Description
token_uuid	string	Yes	—	—
actor	string	Yes	—	—
organization_uuid	uuid	No	—	—
ttl_seconds	integer	No	—	—
expires_at	datetime	No	—	—

Output Schema

Field	Type	Required	Default	Description
token_uuid	string	Yes	—	—
old_token_uuid	string	Yes	—	—
name	string	Yes	—	—
token	string	Yes	—	—
temporary_view_token	string	Yes	—	—
rotated_at	datetime	Yes	—	—
expires_at	datetime	No	—	—
actor	string	No	—	—
organization_uuid	uuid	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "identity.api-token.rotate",
  "initial_data": {
    "token_uuid": "value",
    "actor": "value"
  }
}