Skip to content
SupaCloud Docs
Select themeSelect language

post_api_runners_id_rotate_token

POST
/api/runners/{id}/rotate-token
curl --request POST \
  --url https://example.com/api/runners/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/rotate-token \
  --header 'Content-Type: application/json' \
  --data '{ "token_ttl_secs": 1 }'

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Runner ID

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

POST /api/runners/{id}/rotate-token — rotate a runner’s bearer token (ADR 0021, R7). System-admin auth, like GET /api/runners. Mints a fresh scrn_ token, stores its hash in place of the old one and returns the runner plus the new plaintext token, shown exactly once — the same one-time treatment as registration. The previous token is invalidated immediately: the next authenticate_runner with it fails. An unknown id maps to NotFound. Body of a token rotation. The optional TTL is ADR 0046 Phase 5: rotation is the static-token renewal path, so an operator can (re)set the new token’s expiry. Absent ⇒ the rotated token never expires (byte-identical default).

object
token_ttl_secs

ADR 0046 Phase 5 — optional static-token TTL (seconds) for the new token.

integer | null format: int64
Examplegenerated
{
  "token_ttl_secs": 1
}

Responses

Section titled “Responses”

200

Section titled “200”

Rotated; new plaintext token returned once

Media typeapplication/json

The result of registering a runner: the runner row plus the plaintext bearer token, which is returned once and never retrievable again.

object
capabilities
required

Free-form advertised capabilities (images/labels/max_parallel/weight/…). Typed as an open string-keyed map in the spec (not Object, which strips every key) so the FE binds the advertised capability map it reads (#541).

object
key
additional properties
created_at
required
string format: date-time
drain_state
required

ADR 0046 RUNG 2 — graceful drain: active | cordoned | draining. cordoned/draining runners receive no new work but keep heartbeating and finish in-flight assignments. Always populated from the row (this type is serialize-only), so no serde default is needed.

string
id
required
string format: uuid
last_heartbeat_at
string | null format: date-time
name
required
string
registered_at
required
string format: date-time
status
required
string
token
required
string
Examplegenerated
{
  "capabilities": {
    "additionalProperty": "example"
  },
  "created_at": "2026-04-15T12:00:00Z",
  "drain_state": "example",
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "last_heartbeat_at": "2026-04-15T12:00:00Z",
  "name": "example",
  "registered_at": "2026-04-15T12:00:00Z",
  "status": "example",
  "token": "example"
}

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

404

Section titled “404”

Unknown runner

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}