---
updatedAt: 2026-11-02T02:02:09.000Z
agentTools:
  projectIndex: https://docs.logmeal.com/llms.txt
---

# ⚫🔴🔵 Rotate all existing API/WEB credentials for a user

Requires the caller's API bearer and a recent password proof from /v2/users/tokens/reauth (the web portal can also use its WEB session). The caller must own the target or have administrator/tenant authority. All credentials already present for that user are replaced atomically; no new token types are issued. Old tokens stop working immediately. Replacement WEB session secrets are returned only when rotating your own account. An account without any existing credentials cannot use this operation.

# OpenAPI definition

```json
{
  "openapi": "3.0.3",
  "info": {
    "version": "2.1.0",
    "title": "Food AI Engine API Documentation",
    "description": "Please, refer to [https://docs.logmeal.com](https://docs.logmeal.com) to find the most up-to-date version of the Food AI Engine API documentation.",
    "contact": {
      "email": "support@logmeal.com"
    }
  },
  "servers": [
    {
      "url": "https://api.logmeal.com",
      "description": "Production"
    }
  ],
  "tags": [
    {
      "name": "Credential management",
      "description": "WEB-authenticated token rotation and revocation."
    }
  ],
  "paths": {
    "/v2/users/tokens/rotate": {
      "post": {
        "tags": [
          "Credential management"
        ],
        "summary": "⚫🔴🔵 Rotate all existing API/WEB credentials for a user",
        "description": "Requires the caller's API bearer and a recent password proof from /v2/users/tokens/reauth (the web portal can also use its WEB session). The caller must own the target or have administrator/tenant authority. All credentials already present for that user are replaced atomically; no new token types are issued. Old tokens stop working immediately. Replacement WEB session secrets are returned only when rotating your own account. An account without any existing credentials cannot use this operation.",
        "security": [
          {
            "Bearer": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "reauth_token"
                ],
                "properties": {
                  "user_id": {
                    "type": "integer",
                    "description": "Omit for self-management"
                  },
                  "reauth_token": {
                    "type": "string"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Returns user_id and a tokens object keyed by existing types (api/web). Each contains created_at and, where permitted, the new token value."
          },
          "403": {
            "description": "Missing recent reauthentication or insufficient authority"
          },
          "409": {
            "description": "No credentials to rotate or replicated Admin API credential"
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "Bearer": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT"
      }
    }
  },
  "x-build": {
    "time": "2026-11-04T14:34:34.240869Z"
  }
}
```