---
title: "Rotate dbt commit signing key"
method: POST
path: "/api/v1/connections/{connectionId}/dbt/rotate-signing-key"
tags: ["Connections"]
---

# Rotate dbt commit signing key

`POST /api/v1/connections/{connectionId}/dbt/rotate-signing-key`

Rotate the commit signing keypair for a GitHub App dbt connection and return the dbt configuration with the new commitSigningPublicKey to register on the committer’s GitHub user. Omni mints a fresh Ed25519 keypair unless signingPrivateKey supplies your own (with signingKeyPassphrase when encrypted), enabling zero-downtime rotation: register the matching public key on GitHub first, then set it here. The committer identity can be changed in the same call, so signing can be moved to a different GitHub user in one step. Commits already signed with the old key stay Verified only while the old public key remains registered on GitHub. Only valid for github_app auth.

## Path parameters

- `connectionId` string, uuid, required — Connection ID

## Request body

- ConnectionsDbtRotateSigningKeyBody
  - `commitSigningCommitterEmail` string, email, nullable — Verified email of the GitHub user that owns the registered signing key, written into signed commits (github_app auth only). Send a string to set it, null to clear it (disabling signing), or omit it to leave the stored value unchanged. Must be set, cleared, or omitted together with commitSigningCommitterName.
  - `commitSigningCommitterName` string, nullable — Display name written into signed commits (github_app auth only). Send a string to set it, null to clear it (disabling signing), or omit it to leave the stored value unchanged. Must be set, cleared, or omitted together with commitSigningCommitterEmail.
  - `signingKeyPassphrase` string — Passphrase for signingPrivateKey when it is encrypted. Omni uses it once to decrypt the key, then stores the key under its own encryption at rest; the passphrase itself is not retained.
  - `signingPrivateKey` string — Bring-your-own ED25519 signing private key in PEM format (as produced by `ssh-keygen -t ed25519`), used instead of an Omni-generated keypair. Enables zero-downtime rotation: register the matching public key on the GitHub user first, then set it here. RSA keys are rejected — commit signing is SSHSIG over ED25519. Must be non-blank when provided; omit it to have Omni mint a fresh keypair.

## Response `200`

Signing key rotated; response includes the new public key

- ConnectionsDbtRotateSigningKeyResponse — dbt repository configuration response
  - `authMethod` 'ssh' | 'https_token' | 'github_app', required — Authentication method for the git repository. "ssh" for deploy key, "https_token" for deploy token/PAT, "github_app" for a GitHub App installation.
  - `autogenRelationships` boolean, required — Whether relationships are auto-generated from dbt
  - `branch` string, required — Git branch name
  - `commitSigningCommitterEmail` string, nullable, required — Verified email of the GitHub user that owns the registered signing key. Null unless a commit signer is configured (github_app auth only).
  - `commitSigningCommitterName` string, nullable, required — Display name written into signed commits. Null unless a commit signer is configured (github_app auth only).
  - `commitSigningPublicKey` string, nullable, required — SSH public key to register as a signing key on the GitHub user that owns commitSigningCommitterEmail, so commits show as Verified. Null for non-github_app auth.
  - `dbtVersion` string, required — dbt version being used
  - `enableSemanticLayer` boolean, required — Whether the dbt semantic layer integration is enabled
  - `enableVirtualSchemas` boolean, required — Whether virtual schemas are enabled
  - `githubAppInstallationId` string, nullable, required — GitHub App installation ID. Null for non-github_app auth.
  - `projectRootPath` string, nullable, required — Path to dbt project root
  - `sshUrl` string, required — Clone URL for the git repository — SSH (git@...) for ssh auth, https:// for https_token or github_app auth
  - `supportsDbt` true, required — Indicates dbt is supported and configured

## Other responses

- `400` — Invalid signing key, passphrase, or committer fields
- `401` — Authentication required
- `403` — Permission denied - connection admin role required
- `404` — Connection not found or dbt not configured
- `422` — Connection is not a GitHub App dbt repository

---

[API](https://skmtc.net/omniapp/apis/omni-api.md) · [All operations](https://skmtc.net/omniapp/apis/omni-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/omniapp/omni-api/revisions/9c8eaecccb5a/schema)