---
title: "Rotate Heartbeat Token"
description: "Generates a new heartbeat token; the old one stops working immediately."
---

`POST /api/websites/:websitePublicId/heartbeat-token/rotate`

Generates a new heartbeat token for a heartbeat monitor. The old token stops working **immediately**: pings to the old ping URL are answered with `404` `heartbeatTokenNotFound`. There is no grace period, because a token is usually rotated after it leaked. Update your cron job or script with the new ping URL right away; the monitor itself, its history and its heartbeat state stay unchanged.

## Authentication

Requires a valid session with write access to the monitor (organization editor or higher; customer-scoped logins only for their own self-service monitors).

- Header: `Authorization: Bearer <token>`

## Parameters

- `websitePublicId` (Path, required): public UUID (or numeric id) of the heartbeat monitor.

No request body.

## Example (cURL)

```bash
BASE_URL="https://uptimeify.io"
TOKEN="<your-api-token>"

curl -X POST \
  "$BASE_URL/api/websites/6bfec6f6-245a-47ce-843b-157d97d56f88/heartbeat-token/rotate" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"
```

## Example Response

```json
{
  "id": 123,
  "publicId": "6bfec6f6-245a-47ce-843b-157d97d56f88",
  "heartbeatToken": "0f8e1c2a-6b4d-4e8a-9f3b-2d7c5a1e9b40"
}
```

The new ping URL is `https://uptimeify.io/ping/<heartbeatToken>` (or your custom domain). The audit log records the rotation without the token value.

## Common Errors

- `400` `heartbeatMonitorRequired` if the monitor is not a heartbeat monitor
- `401 Unauthorized` if you are not authenticated
- `403 Forbidden` if you do not have write access to the monitor
- `404` `websiteNotFound` if the monitor does not exist or belongs to another organization