Sign in
latestOpenAPI 3.0.32026-08-19400919.9 MB

6b6e0450635c

kms

Activate a signing key

Activate a pending signing key so the issuer starts signing with it.

post/v1/kms/issuers/{issuerId}/keys/{keyId}/activate

Path parameters

issuerIdstring required

The ID of the issuer.

The ID of the issuer.

keyIdstring required

The ID of the pending signing key to activate.

The ID of the pending signing key to activate.

Query parameters

teamIdstring
Example:team_1a2b3c4d5e6f7g8h9i0j1k2l

The Team identifier to perform the request on behalf of.

slugstring
Example:my-team-url-slug

The Team slug to perform the request on behalf of.

Request body

revokePreviousAfterHoursnumber

How many hours after activation the previously-active key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.

Response

keyIdstring required

The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.

importKeyIdstring

The caller-supplied key id (imported keys only), used as the JWT/JWKS kid. Not unique across an issuer's keys; omitted for generated keys.

issuerIdstring required
algorithmstring required
status'active' | 'pending' | 'revoking' required
publicKeyFingerprintstring
publicKeyPemstring

The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from publicKey; the embedded certificate members (x5c/x5t#S256) do not affect it.

certificatePemstring

The stored X.509 certificate (from publicKey.x5c[0]) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.

createdAtstring required
updatedAtstring required
revokeAtstring
activateAtstring
activatedAtstring

When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).