Rotate an institution's KEK
Triggers a manual key-encryption-key rotation for the addressed institution. The KEK advances, the registry mirror syncs, and per-record DEKs are rewrapped. A contended same-institution rotation maps to 409; a committed-but-unaudited rotation maps to 500 (non-retryable; escalate).
Authorizations
JWT bearer token issued by the identity provider.
Path Parameters
The institution's unique identifier (UUID) the KEK rotation targets.
"44444444-4444-4444-4444-444444444444"
Body
Optional operator-supplied free-text reason for the rotation (sealed verbatim into the audit payload).
"scheduled_annual_rotation"
Response
OK
The institution the rotation targeted.
"44444444-4444-4444-4444-444444444444"
The newly active KEK version.
"v3"
The KEK version that was active before the rotation.
"v2"
The rewrap progress status (e.g. IN_PROGRESS).
"IN_PROGRESS"
The RFC3339 timestamp the rotation committed.
"2026-06-08T12:00:00Z"

