> ## Documentation Index > Fetch the complete documentation index at: https://docs.nekt.com/llms.txt > Use this file to discover all available pages before exploring further. # Update MCP Token > Rename a token or change what it reaches. Editing is how you **widen** a scoped token: its selection does not grow when its creator gains access, so adding a table or a tool is an explicit edit. Narrowing happens on its own — access the creator loses is dropped from the token on its next call. ```bash theme={null} curl --request PATCH \ --url "https://api.nekt.ai/api/v1/mcp/tokens/TOKEN_ID/" \ --header "x-api-key: YOUR_API_KEY" \ --header "Content-Type: application/json" \ --data '{"tool_scope": ["list_tables", "execute_sql", "get_semantic_context"]}' ``` The expiration cannot be changed here — it is set when the token is created. Each edit is recorded in the workspace activity, naming **both** the person behind the key and the key itself, so an unattended change is not attributed to someone who was asleep. ## OpenAPI ````yaml PATCH /api/v1/mcp/tokens/{id}/ openapi: 3.0.3 info: title: Nekt API version: v1 description: Nekt API Documentation contact: email: support@nekt.ai servers: - url: https://api.nekt.ai security: [] paths: /api/v1/mcp/tokens/{id}/: patch: tags: - v1 summary: Update an MCP token description: >- Edits the description and the scope axes. The expiration cannot be changed here — rotate to renew it. operationId: v1_mcp_tokens_partial_update parameters: - in: path name: id schema: type: string required: true requestBody: content: application/json: schema: $ref: '#/components/schemas/PatchedMCPToken' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/PatchedMCPToken' multipart/form-data: schema: $ref: '#/components/schemas/PatchedMCPToken' responses: '200': content: application/json: schema: $ref: '#/components/schemas/MCPToken' description: '' security: - ApiKeyAuth: [] components: schemas: PatchedMCPToken: type: object properties: id: type: string format: uuid readOnly: true description: type: string maxLength: 80 bearer_token: type: string readOnly: true expires_at: type: string format: date-time description: >- When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag. last_used_at: type: string format: date-time readOnly: true nullable: true use_created_by_permissions: type: boolean tool_scope: nullable: true description: >- Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface. created_at: type: string format: date-time readOnly: true updated_at: type: string format: date-time readOnly: true live_connection_scopes: type: array items: $ref: '#/components/schemas/MCPTokenLiveConnectionScope' writeOnly: true secret_scopes: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none. semantic_layer_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's. table_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only. volume_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables. all_tables: type: boolean all_volumes: type: boolean all_secrets: type: boolean all_semantic_layer: type: boolean all_live_connections: type: boolean mcp_config: type: string readOnly: true description: MCP Configuration (Field only visible on expanded view. Expandable) created_by: type: integer readOnly: true description: Created by (Expandable) tables: type: array items: type: string description: Tables (Expandable) MCPToken: type: object properties: id: type: string format: uuid readOnly: true description: type: string maxLength: 80 bearer_token: type: string readOnly: true expires_at: type: string format: date-time description: >- When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag. last_used_at: type: string format: date-time readOnly: true nullable: true use_created_by_permissions: type: boolean tool_scope: nullable: true description: >- Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface. created_at: type: string format: date-time readOnly: true updated_at: type: string format: date-time readOnly: true live_connection_scopes: type: array items: $ref: '#/components/schemas/MCPTokenLiveConnectionScope' writeOnly: true secret_scopes: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none. semantic_layer_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's. table_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only. volume_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables. all_tables: type: boolean all_volumes: type: boolean all_secrets: type: boolean all_semantic_layer: type: boolean all_live_connections: type: boolean mcp_config: type: string readOnly: true description: MCP Configuration (Field only visible on expanded view. Expandable) created_by: type: integer readOnly: true description: Created by (Expandable) tables: type: array items: type: string description: Tables (Expandable) required: - bearer_token - created_at - created_by - description - id - last_used_at - mcp_config - updated_at MCPTokenLiveConnectionScope: type: object properties: live_connection: type: string format: uuid tools: type: array items: type: string nullable: true required: - live_connection securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: 'API Key authentication. Format: ''x-api-key: api_key''' ````