Sign in

v2

latestOpenAPI 3.1.12026-07-2613060964.2 KB

Roll Workspace Signing Key

Roll a signing key. Generates a new signing key that replaces the existing active key. The previous key is marked rolled.

The new private_key_pem and private_key_base64 are returned only once in this response - store them securely.

post/v1/{workspace}/ws_signing_key/{signing_key_uid}/roll/

Path parameters

workspacestring required

Workspace slug (e.g. staging, production).

signing_key_uidstring required

Signing key uid to roll (e.g. signing_key_...).

Response

Signing key rolled. A new signing key is created and its private key material is returned once.

idstring

Unique identifier of the signing key.

uidstring

Signing key uid used in path parameters for roll/delete.

status'active' | 'rolled'

Status of the signing key.

allowed_domainsstring[] nullable

Domains allowed to use this signing key.

expiry_atstring date-time nullable

Timestamp when the signing key expires.

created_atstring date-time

Timestamp when the signing key was created.

rolled_atstring date-time nullable

Timestamp when the signing key was rolled.

deleted_atstring date-time nullable

Timestamp when the signing key was deleted.

private_key_pemstring

PEM-encoded private key. Returned only at creation and on roll - store it securely and never commit to source control.

private_key_base64string

Base64-encoded private key. Returned only at creation and on roll.

Example response

{
  "id": "ws_signk_exampleId01",
  "uid": "signing_key_exampleUid01",
  "created_by": {
    "name": "System User",
    "email": "user@example.com"
  },
  "rolled_by": {
    "name": "System User",
    "email": "user@example.com"
  },
  "deleted_by": {
    "name": "System User",
    "email": "user@example.com"
  },
  "private_key_pem": "-----BEGIN PRIVATE KEY-----\n...redacted...\n-----END PRIVATE KEY-----\n",
  "private_key_base64": "LS0tLS1CRUdJTi...redacted..."
}