v10

latestOpenAPI 3.0.4raw.githubusercontent.com2026-07-0750111126.8 KB

Rotations

Schedule KMS key rotation

Schedules a future rotation for a key, with optional recurrence and optional target KMS provider. Scheduled cross-provider rotation uses the same migration semantics as immediate rotation.

put/{tenantId}/kms/providers/{providerId}/keys/{keyAlias}/rotations/schedule

Request body

rotateAtstring date-time required

rotationIntervalstring nullable

ISO-8601 duration used for recurring rotation.

targetProviderIdstring nullable

Target provider for scheduled cross-KMS rotation.

Example request

{
  "rotateAt": "2026-09-18T10:15:30Z",
  "rotationInterval": "P3M",
  "targetProviderId": "azure-key-vault"
}

Response

Updated key lifecycle metadata.

tenantIdstring required

providerIdstring required

keyAliasstring required

classification'PLATFORM' | 'TENANT' | 'APPLICATION' | 'SERVICE'

Operational ownership scope for tenant-managed infrastructure resources.

status'ACTIVE' | 'ROTATING' | 'ROTATED' | 'REVOKED' | 'DEPRECATED' required

Lifecycle status for a KMS key or rotation record.

revokeAtstring date-time nullable

rotateAtstring date-time nullable

rotationIntervalstring nullable

ISO-8601 duration used for recurring rotation.

rotatedFromstring nullable

Source key alias when this key was created by rotation.

rotatedTostring nullable

Replacement key alias after rotation.

targetProviderIdstring nullable

Target provider id for scheduled cross-KMS rotation.

updatedAtstring date-time nullable

Example response

{
  "tenantId": "tenant-001",
  "providerId": "software",
  "keyAlias": "as-signing",
  "revokeAt": "2026-12-18T10:15:30Z",
  "rotateAt": "2026-09-18T10:15:30Z",
  "rotationInterval": "P3M",
  "rotatedFrom": "as-signing-20260618101530",
  "rotatedTo": "as-signing-20260918101530",
  "targetProviderId": "azure-key-vault",
  "updatedAt": "2026-06-18T10:15:30Z"
}