Skip to main content
POST
Rotate an institution's KEK

Authorizations

Authorization
string
header
required

JWT bearer token issued by the identity provider.

Path Parameters

institutionId
string
required

The institution's unique identifier (UUID) the KEK rotation targets.

Example:

"44444444-4444-4444-4444-444444444444"

Body

application/json
reason
string

Optional operator-supplied free-text reason for the rotation (sealed verbatim into the audit payload).

Example:

"scheduled_annual_rotation"

Response

OK

institutionId
string
required

The institution the rotation targeted.

Example:

"44444444-4444-4444-4444-444444444444"

newKekVersion
string
required

The newly active KEK version.

Example:

"v3"

previousKekVersion
string
required

The KEK version that was active before the rotation.

Example:

"v2"

rewrapStatus
string
required

The rewrap progress status (e.g. IN_PROGRESS).

Example:

"IN_PROGRESS"

rotatedAt
string
required

The RFC3339 timestamp the rotation committed.

Example:

"2026-06-08T12:00:00Z"