From f4e0a2e8a5888c14301645a6177eb4e0bf249129 Mon Sep 17 00:00:00 2001 From: Alex Shchyhol Date: Thu, 12 Nov 2026 22:09:03 +0100 Subject: [PATCH] Document the 403 on an API token reset Resetting a different token now needs Admin access to everything that token can access. Anything less gets a 403. A token can still reset itself. --- specs/account-management.openapi.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/specs/account-management.openapi.yml b/specs/account-management.openapi.yml index e0083b7..f42f965 100644 --- a/specs/account-management.openapi.yml +++ b/specs/account-management.openapi.yml @@ -1504,6 +1504,9 @@ paths: `expires_at` must be in the future and no more than 5 years ahead; past or unparseable values are rejected with a 422 error. Tokens that have already expired cannot be reset (returns a 422 error). + To reset a different token, the calling token must have Admin access to + everything that token can access; otherwise the request is rejected with + a 403 error. tags: - API Tokens x-codeSamples: