---
title: "List KMS key rotation records"
method: GET
path: "/{tenantId}/kms/rotations"
tags: ["Rotations"]
---

# List KMS key rotation records

`GET /{tenantId}/kms/rotations`

Lists key rotation records, including same-provider rotations and cross-provider migration rotations.

## Query parameters

- `providerId` string
- `keyAlias` string
- `status` 'ACTIVE' | 'ROTATING' | 'ROTATED' | 'REVOKED' | 'DEPRECATED' — Lifecycle status for a KMS key or rotation record.

## Response `200`

Matching rotation records.

- ListKmsKeyRotationsResult
  - `rotations` KmsKeyRotationRecord[], required
    - `rotationId` string, required
    - `tenantId` string, required
    - `oldKey` KmsKeyRef, required — Reference to a managed KMS key.
      - `providerId` string, required
      - `keyAlias` string, required
    - `newKey` KmsKeyRef, required — Reference to a managed KMS key.
      - `providerId` string, required
      - `keyAlias` string, required
    - `targetProviderId` string, required
    - `rotatedAssignments` string[]
    - `createdAssignments` string[]
    - `rotationInterval` string, nullable — ISO-8601 duration used for recurring rotation.
    - `rotateAt` string, date-time, nullable
    - `status` 'ACTIVE' | 'ROTATING' | 'ROTATED' | 'REVOKED' | 'DEPRECATED', required — Lifecycle status for a KMS key or rotation record.
    - `createdAt` string, date-time, nullable
    - `updatedAt` string, date-time, nullable

## Other responses

- `400` — Bad request due to invalid input parameters or request body.
- `500` — An unexpected error occurred on the server.

---

[API](https://skmtc.net/sphereon-opensource/apis/kms-rest-server-api.md) · [All operations](https://skmtc.net/sphereon-opensource/apis/kms-rest-server-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sphereon-opensource/kms-rest-server-api/versions/e9136cbde1c1/schema)