---
title: "Create or rotate tenant CMK"
method: POST
path: "/v3/tenant-encryption/{companyId}/key"
tags: ["Tenant Encryption"]
---

# Create or rotate tenant CMK

`POST /v3/tenant-encryption/{companyId}/key`

First call provisions a Spotnana-managed CMK and DEK.
Subsequent calls rotate the CMK and re-wrap the existing DEK.
Returns 429 if called within the one-hour cooldown window.
Requires the COMPANY_MANAGEMENT WRITE permission on the company.

## Response `200`

Key provisioned or rotated

- ProvisionOrRotateTenantKeyResponse
  - `configId` string, uuid
  - `created` boolean — True on first provision; false on CMK rotation.

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Key rotation cooldown not elapsed

---

[API](https://skmtc.net/spotnana/apis/company-api.md) · [All operations](https://skmtc.net/spotnana/apis/company-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/spotnana/company-api/revisions/fc09f0cd1f4d/schema)