v10

latestOpenAPI 3.0.4raw.githubusercontent.com2026-07-0750111126.8 KB

Rotations

Preview KMS key rotation

Computes the replacement key alias, target provider, transferred assignments, and service configuration mutations for a rotation without creating key material or mutating assignment, lifecycle, or service configuration state. Use this endpoint for interactive migration planning before calling the immediate rotation endpoint.

post/{tenantId}/kms/providers/{providerId}/keys/{keyAlias}/rotations/preview

Request body

targetProviderIdstring nullable

Target provider for cross-KMS rotation. If omitted, the current provider is used.

baseAliasstring nullable

Base alias used when the server generates a timestamped replacement alias.

newAliasstring nullable

Explicit alias for the replacement key.

rotationIntervalstring nullable

ISO-8601 duration to carry forward for recurring rotation.

Example request

{
  "targetProviderId": "azure-key-vault",
  "baseAlias": "as-signing",
  "newAlias": "as-signing-20260918101530",
  "rotationInterval": "P3M"
}

Response

Planned rotation effects without mutation.

tenantIdstring required

targetProviderIdstring required

Provider where the replacement key would be created.

rotationIntervalstring nullable

ISO-8601 duration that would be carried forward for recurring rotation.

Example response

{
  "tenantId": "tenant-001",
  "oldKey": {
    "providerId": "software",
    "keyAlias": "as-signing"
  },
  "plannedNewKey": {
    "providerId": "software",
    "keyAlias": "as-signing"
  },
  "targetProviderId": "azure-key-vault",
  "rotationInterval": "P3M",
  "oldAssignments": [
    {
      "assignmentId": "assignment-001",
      "tenantId": "tenant-001",
      "providerId": "software",
      "keyAlias": "as-signing",
      "serviceType": "oauth2-as",
      "serviceInstance": "as-main",
      "partyId": "party-issuer-001",
      "relationshipType": "SOFTWARE_SERVICE",
      "purpose": "as-signing",
      "validFrom": "2026-06-18T10:15:30Z",
      "validUntil": "2026-12-18T10:15:30Z",
      "targetProviderId": "azure-key-vault",
      "createdAt": "2026-06-18T10:15:30Z",
      "updatedAt": "2026-06-18T10:15:30Z"
    }
  ],
  "newAssignments": [
    {
      "assignmentId": "assignment-001",
      "tenantId": "tenant-001",
      "providerId": "software",
      "keyAlias": "as-signing",
      "serviceType": "oauth2-as",
      "serviceInstance": "as-main",
      "partyId": "party-issuer-001",
      "relationshipType": "SOFTWARE_SERVICE",
      "purpose": "as-signing",
      "validFrom": "2026-06-18T10:15:30Z",
      "validUntil": "2026-12-18T10:15:30Z",
      "targetProviderId": "azure-key-vault",
      "createdAt": "2026-06-18T10:15:30Z",
      "updatedAt": "2026-06-18T10:15:30Z"
    }
  ],
  "serviceConfigMutations": [
    {
      "key": "oauth2.servers.default.signing-key.kid",
      "value": "as-signing-20260918101530",
      "clearOnlyIfCurrentValue": "as-signing",
      "removeListValue": "issuer-signing",
      "replaceListCurrentValue": "issuer-signing",
      "replaceListReplacementValue": "issuer-signing-20260918101530"
    }
  ]
}