---
title: Managing Ephemeral Accounts (leaseRenew and revoke)
slug: kronpam-reference-guide-3-9-0/managing-ephemeral-accounts-leaserenew-and-revoke
docTags: 
createdAt: 2026-10-09T08:48:58.731Z
---

In addition to the standard parameters described in the table above, the AAPM password request endpoint accepts two more parameters when the target account is an ephemeral account: **leaseRenew** and **revoke**.

:::hint{type="warning"}
**Prerequisite:** To use lease renewal and revocation, create the AAPM token at the vault group level of the ephemeral base account, not for individual ephemeral accounts. This way, every ephemeral account generated from that group automatically falls within the token's scope, so you don't need to create a separate token for each new ephemeral account.
:::

| **Parameter Name** | **Parameter Value** | **Description**                                                                                                         |
| ------------------ | ------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| **leaseRenew**     | *true*              | Extends the lifetime of an existing ephemeral account so it continues to be used without being deleted.                 |
| **revoke**         | *true*              | Revokes the ephemeral account on demand before its time to live (TTL) expires, and deletes the account from the target. |

*Example — Lease Renewal Request*

GET https\://\<HOST>/aioc-rest-web/rest/aapm/request/password?

passwordExpirationInMinute=30\&comment=test\&token=508f0536-357c-4856-90ea-cff0843ef051&

sapmAccountPath=/LinuxBase\&sapmAccountName=sshbase\_vja1vk\&responseType=json&

tenantId=host\&leaseRenew=true

The system returns the following response: "Lease renewed successfully."



*Example — Revocation Request*

GET https\://\<HOST>/aioc-rest-web/rest/aapm/request/password?

token=508f0536-357c-4856-90ea-cff0843ef051\&sapmAccountPath=/LinuxBase&

sapmAccountName=sshbase\_vja1vk\&responseType=json\&tenantId=host\&revoke=true

The system returns the following response: "Account revoked successfully."

:::hint{type="warning"}
**Note:** Do not use **passwordChangeRequired** together with **leaseRenew** or **revoke** in the same request.

**Error:** passwordChangeRequired cannot be used with leaseRenew or revoke.
:::