Sign in

v10

latestOpenAPI 3.0.4raw.githubusercontent.com2026-07-0750111126.8 KB
Rotations

Rotate a KMS key immediately

Performs an immediate key rotation. If targetProviderId is omitted the replacement key is created in the current provider. If targetProviderId is supplied, rotation is also the cross-KMS migration mechanism: the replacement key is generated in the target provider and active assignments are transferred without exporting private key material.

post/{tenantId}/kms/providers/{providerId}/keys/{keyAlias}/rotations

Request body

targetProviderIdstring nullable

Target provider for cross-KMS rotation. If omitted, the current provider is used.

baseAliasstring nullable

Base alias used when the server generates a timestamped replacement alias.

newAliasstring nullable

Explicit alias for the replacement key.

rotationIntervalstring nullable

ISO-8601 duration to carry forward for recurring rotation.

Example request

{
  "targetProviderId": "azure-key-vault",
  "baseAlias": "as-signing",
  "newAlias": "as-signing-20260918101530",
  "rotationInterval": "P3M"
}

Response

Rotation record and transferred assignments.

Example response

{
  "rotation": {
    "rotationId": "rotation-001",
    "tenantId": "tenant-001",
    "oldKey": {
      "providerId": "software",
      "keyAlias": "as-signing"
    },
    "newKey": {
      "providerId": "software",
      "keyAlias": "as-signing"
    },
    "targetProviderId": "azure-key-vault",
    "rotatedAssignments": [
      "assignment-001"
    ],
    "createdAssignments": [
      "assignment-002"
    ],
    "rotationInterval": "P3M",
    "rotateAt": "2026-09-18T10:15:30Z",
    "createdAt": "2026-06-18T10:15:30Z",
    "updatedAt": "2026-06-18T10:15:30Z"
  },
  "oldAssignments": [
    {
      "assignmentId": "assignment-001",
      "tenantId": "tenant-001",
      "providerId": "software",
      "keyAlias": "as-signing",
      "serviceType": "oauth2-as",
      "serviceInstance": "as-main",
      "partyId": "party-issuer-001",
      "relationshipType": "SOFTWARE_SERVICE",
      "purpose": "as-signing",
      "validFrom": "2026-06-18T10:15:30Z",
      "validUntil": "2026-12-18T10:15:30Z",
      "targetProviderId": "azure-key-vault",
      "createdAt": "2026-06-18T10:15:30Z",
      "updatedAt": "2026-06-18T10:15:30Z"
    }
  ],
  "newAssignments": [
    {
      "assignmentId": "assignment-001",
      "tenantId": "tenant-001",
      "providerId": "software",
      "keyAlias": "as-signing",
      "serviceType": "oauth2-as",
      "serviceInstance": "as-main",
      "partyId": "party-issuer-001",
      "relationshipType": "SOFTWARE_SERVICE",
      "purpose": "as-signing",
      "validFrom": "2026-06-18T10:15:30Z",
      "validUntil": "2026-12-18T10:15:30Z",
      "targetProviderId": "azure-key-vault",
      "createdAt": "2026-06-18T10:15:30Z",
      "updatedAt": "2026-06-18T10:15:30Z"
    }
  ]
}