Rotate and audit a Quandela Cloud Job Token

Rotate and audit a Quandela Cloud Job Token

Replace a Cloud Job Token, capturing its consumption before destroying it.

1. Read the full Token object — valid, is_revoked, is_explorer_token, is_apikey, priority, user_priority, expiration_date, last_used_time, count — before changing anything.
2. Capture the outgoing token's consumption ledger BEFORE deletion — per-platform nb_jobs, duration_seconds, credits and free_credits. Once the token is deleted this history is no longer addressable by token_id.
3. Mint the replacement first, so the account is never without a working job credential.
4. Confirm the new token is present and active. This is the API's only paginated collection — limit/offset, no cursor.
5. Suspend the outgoing token. Reversible via post_api_tokens_reopen if the cutover needs rolling back.
6. Permanently delete the retired token. Fails with 400 "Tokens not found | Can't delete the current active token" if it is the credential in use, and 403 if it belongs to another user. Run only after the replacement is confirmed working.

What you'll need to have ready

• account_token: Account access token from account.quandela.com (Bearer).
• outgoing_token_id: token_id of the credential being retired.
• outgoing_token: The outgoing token value, required by the revoke body.
• new_token_label: Must be unique per account (400 "Label already exists").
• new_token_priority: Cannot exceed the caller's own user priority (400 "Can't assign priority higher than user priority").
• audit_start_time
• audit_end_time

For your developer

Arazzo workflow quandela:rotate-and-audit-job-token, 6 operations: $sourceDescriptions.apiPercevalJobTokenApi.get_api_tokens_by_token_id → $sourceDescriptions.apiPercevalJobTokenApi.get_api_tokens_usage_report → $sourceDescriptions.apiPercevalJobTokenApi.post_api_tokens → $sourceDescriptions.apiPercevalJobTokenApi.get_api_tokens → $sourceDescriptions.apiPercevalJobTokenApi.post_api_tokens_revoke → $sourceDescriptions.apiPercevalJobTokenApi.post_api_tokens_delete_by_ids. Specs on APIs.io.