Skip to main content
POST
Rotate an institution's tokenization keyset

Authorizations

Authorization
string
header
required

JWT bearer token issued by the identity provider.

Path Parameters

institutionId
string
required

The institution's unique identifier (UUID) the keyset rotation targets.

Example:

"44444444-4444-4444-4444-444444444444"

Body

application/json
reason
string

Optional operator-supplied free-text reason for the rotation (sealed verbatim into the audit payload).

Example:

"quarterly_keyset_rotation"

Response

OK

institutionId
string
required

The institution the rotation targeted.

Example:

"44444444-4444-4444-4444-444444444444"

newKeysetVersion
integer<int64>
required

The newly active tokenization-keyset version.

Example:

3

previousKeysetVersion
integer<int64>
required

The tokenization-keyset version that was active before the rotation.

Example:

2

rotatedAt
string
required

The RFC3339 timestamp the rotation committed.

Example:

"2026-06-08T12:00:00Z"