---
title: "Updates the rotation policy for a key."
method: PUT
path: "/keys/{key-name}/rotationpolicy"
---

# Updates the rotation policy for a key.

`PUT /keys/{key-name}/rotationpolicy`

Set specified members in the key policy. Leave others as undefined. This operation requires the keys/update permission.

## Path parameters

- `key-name` string, required

## Query parameters

- `api-version` string, required

## Request body

- KeyRotationPolicy — Management policy for a key.
  - `id` string — The key policy id.
  - `lifetimeActions` LifetimeActions[] — Actions that will be performed by Key Vault over the lifetime of a key. For preview, lifetimeActions can only have two items at maximum: one for rotate, one for notify. Notification time would be default to 30 days before expiry and it is not configurable.
    - `trigger` LifetimeActionsTrigger — A condition to be satisfied for an action to be executed.
      - `timeAfterCreate` string — Time after creation to attempt to rotate. It only applies to rotate. It will be in ISO 8601 duration format. Example: 90 days : "P90D"
      - `timeBeforeExpiry` string — Time before expiry to attempt to rotate or notify. It will be in ISO 8601 duration format. Example: 90 days : "P90D"
    - `action` LifetimeActionsType — The action that will be executed.
      - `type` 'Rotate' | 'Notify' — The type of the action. The value should be compared case-insensitively.
  - `attributes` KeyRotationPolicyAttributes — The key rotation policy attributes.
    - `expiryTime` string — The expiryTime will be applied on the new key version. It should be at least 28 days. It will be in ISO 8601 Format. Examples: 90 days: P90D, 3 months: P3M, 48 hours: PT48H, 1 year and 10 days: P1Y10D
    - `created` integer — The key rotation policy created time in UTC.
    - `updated` integer — The key rotation policy's last updated time in UTC.

## Response `200`

The request has succeeded.

- KeyRotationPolicy — Management policy for a key.
  - `id` string — The key policy id.
  - `lifetimeActions` LifetimeActions[] — Actions that will be performed by Key Vault over the lifetime of a key. For preview, lifetimeActions can only have two items at maximum: one for rotate, one for notify. Notification time would be default to 30 days before expiry and it is not configurable.
    - `trigger` LifetimeActionsTrigger — A condition to be satisfied for an action to be executed.
      - `timeAfterCreate` string — Time after creation to attempt to rotate. It only applies to rotate. It will be in ISO 8601 duration format. Example: 90 days : "P90D"
      - `timeBeforeExpiry` string — Time before expiry to attempt to rotate or notify. It will be in ISO 8601 duration format. Example: 90 days : "P90D"
    - `action` LifetimeActionsType — The action that will be executed.
      - `type` 'Rotate' | 'Notify' — The type of the action. The value should be compared case-insensitively.
  - `attributes` KeyRotationPolicyAttributes — The key rotation policy attributes.
    - `expiryTime` string — The expiryTime will be applied on the new key version. It should be at least 28 days. It will be in ISO 8601 Format. Examples: 90 days: P90D, 3 months: P3M, 48 hours: PT48H, 1 year and 10 days: P1Y10D
    - `created` integer — The key rotation policy created time in UTC.
    - `updated` integer — The key rotation policy's last updated time in UTC.

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/azure/apis/keyvault-keys.md) · [All operations](https://skmtc.net/azure/apis/keyvault-keys/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvault-keys/versions/7bedded21050/schema)