---
title: "Rotate a project's signing key"
method: POST
path: "/api/projects/{id}/signing-key/rotate"
tags: ["Projects"]
---

# Rotate a project's signing key

`POST /api/projects/{id}/signing-key/rotate`

Rotates the project's signing key and returns the project with the new `signing_key`.

The previous key may take about 1–2 minutes to stop working. As with create, the
`signing_key` is only returned on this response and cannot be retrieved afterward.

#### Permissions

The API token used to authenticate must have the following scope(s) enabled to make a successful request: _Management_.

[Learn more about API scopes](/docs/platform/your-signalwire-api-space).

## Path parameters

- `id` string, uuid, required — Universal Unique Identifier.

## Response `200`

The request has succeeded.

- ProjectsProjectWithSigningKey — A project, including its `signing_key`. The `signing_key` is only returned when creating a subproject or rotating a project's signing key. It is not retrievable afterward, so capture it from the response.
  - `id` string, uuid, required — Universal Unique Identifier.
  - `name` string, required — The name of the project.
  - `parent_project_id` string, uuid, required — Universal Unique Identifier.
  - `subproject` boolean, required — `true` when this project is a subproject.
  - `region_preference` string, required — The effective region preference for the project. Returned in all responses; it is not currently settable through this API.
  - `protect_recordings` boolean, required — When enabled, recordings created within the project require authentication to access.
  - `protect_message_media` boolean, required — When enabled, message media created within the project requires authentication to access.
  - `protect_fax_media` boolean, required — When enabled, fax media created within the project requires authentication to access.
  - `force_https_requests` boolean, required — When enabled, requests made to the project's webhooks and callbacks must use HTTPS.
  - `created_at` string, date-time, required — The date and time when the project was created.
  - `updated_at` string, date-time, required — The date and time when the project was last updated.
  - `signing_key` string, required — The project's signing key. Only returned on create and signing-key rotation responses; it cannot be retrieved through the API afterward.

## Other responses

- `401` — Access is unauthorized.
- `404` — The server cannot find the requested resource.
- `500` — An internal server error occurred.

---

[API](https://skmtc.net/signalwire/apis/signalwire-rest-api.md) · [All operations](https://skmtc.net/signalwire/apis/signalwire-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/signalwire/signalwire-rest-api/versions/05c5164b85c7/schema)