Rotate an institution's tokenization keyset
Triggers a manual tokenization-keyset rotation (adds a fresh primary PRF key) for the addressed institution. A contended same-institution rotation or a stale-version optimistic-concurrency conflict maps to 409; an institution with no active keyset maps to 422; a committed-but-unaudited rotation maps to 500 (non-retryable; escalate).
Authorizations
JWT bearer token issued by the identity provider.
Path Parameters
The institution's unique identifier (UUID) the keyset rotation targets.
"44444444-4444-4444-4444-444444444444"
Body
Optional operator-supplied free-text reason for the rotation (sealed verbatim into the audit payload).
"quarterly_keyset_rotation"
Response
OK
The institution the rotation targeted.
"44444444-4444-4444-4444-444444444444"
The newly active tokenization-keyset version.
3
The tokenization-keyset version that was active before the rotation.
2
The RFC3339 timestamp the rotation committed.
"2026-06-08T12:00:00Z"

