# Update a token (/api/auths/update-auth)

`POST https://api.comecero.com/api/v1/auths/{auth_id}`

Changes a secret token's label, expiry, roles or permissions. Only the fields you send change. Sending `roles` or `permissions` replaces that whole list. Trusted and limited tokens cannot be changed (`400`). The token you call with must hold every permission the updated token will have (`403` otherwise), and only a live token may change a live token. Secret and trusted tokens may call this with the `auths` update permission. This is true for `me` too: a token may not widen its own permissions.

## Parameters

- `timezone` (query): An IANA time zone name, such as `America/New_York` or `UTC`. It sets how `date_start` and `date_end` are read and the time zone of every date in the response. The default is the account's time zone (Settings, Technical), or UTC when it has none. A name that is not known is a `400`.

Request body: the `auth_secret_request` schema.

Responses: 200, 400, 401, 403, 404, 500.

Full schemas: operation `update_auth` in /openapi.json.