---
title: "Rotate Key"
method: PUT
path: "/v4/organizations/{organizationId}/cmek/{cmekId}"
tags: ["CMEK"]
---

# Rotate Key

`PUT /v4/organizations/{organizationId}/cmek/{cmekId}`

Initiates the process to rotate a customer-managed encryption key and update its associated metadata within the system.

In order to access this endpoint, the provided API key must have at least one of the following roles:
- Organization Owner

To learn more, see [Organization, Project, and Database Access Overview](https://docs.couchbase.com/cloud/organizations/organization-projects-overview.html).

## Request body

- RotateCMEKKey
  - `config` union, required
    - AWSConfig
      - `arn` string, required — The Amazon Resource Name (ARN) that uniquely identifies the AWS KMS key.
    - GCPConfig
      - `resourceName` string, required — The unique identifier for a GCP resource, specifying the project, location, key ring, and the key within Cloud KMS.
    - AzureConfig
      - `keyLocation` string, required — The URL of the Azure key.
      - `region` string, required — The region of the Azure key.

## Response `204`

Successfully submitted request to rotate the encryption key.

## Other responses

- `403` — The client does not have the necessary permissions to access this resource.
- `404` — The requested resource was not found.
- `412` — Returned when there is a mismatch with the Etag version.
- `422` — Request validation error.
- `429` — Returned when the client exceeds the rate limit for the given APIKey.
- `500` — An unexpected error occurred in the server while processing this request.

---

[API](https://skmtc.net/couchbase/apis/couchbase-capella-management-api.md) · [All operations](https://skmtc.net/couchbase/apis/couchbase-capella-management-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/couchbase/couchbase-capella-management-api/revisions/e67df5d1f74e/schema)