v8

latestOpenAPI 3.1.0raw.githubusercontent.com2026-07-05730512.7 KB

Issuer Keys

Rotate the issuer signing key

Rotate your issuer signing key. You can send overlap_days to choose how long credentials signed by the previous key keep verifying. New credentials use the new active key immediately.

post/v1/keys/rotate

Request body

overlap_daysinteger

Number of days the previous key remains valid after rotation. Use this to control the overlap window for credentials already signed by that key.

Example request

{
  "overlap_days": 7
}

Response

The rotation result, including the new key, the rotated key, the requested overlap window, and the impact summary.

overlap_daysinteger

Number of days the rotated key remains valid for credentials signed before rotation.

Example response

{
  "new_key": {
    "id": "44bb118a-e72f-4253-9310-c9bc95532939",
    "kid": "qE8_bhAhCpu2jelDn-5shSVfqK2mFbIekiU5TOMSmyY",
    "alg": "ES256",
    "status": "active",
    "is_active": true,
    "created_at": "2026-07-02T23:33:35.126426+00:00"
  },
  "rotated_key": {
    "id": "35933909-a210-48c8-8d7d-100835f6ae2a",
    "kid": "GTb08xmXDpoEobZao92elfENa0t2xHnlwMR3_DtxfBQ",
    "alg": "ES256",
    "status": "rotated",
    "valid_until": "2026-07-09T23:33:35.125939+00:00",
    "created_at": "2026-07-02T23:33:35.032732+00:00"
  },
  "overlap_days": 7,
  "impact": {
    "credentials_under_previous_key": 24,
    "note": "Existing credentials keep verifying under the rotated key for 7 days (overlapping validity); new credentials sign with the new key immediately."
  }
}