> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Rotate an institution's connector-credentials KEK > Rotates the key that wraps this institution's stored connector credentials — a DIFFERENT key from the institution-data KEK governing PII, whose rotation is owned by the Lerian SISBAJUD Mensageria. The Transit key advances and the stored credentials envelope is rebound to the new version; no credential is decrypted and no credential VALUE changes, so a leaked client_secret is NOT invalidated by this call (rotate the material itself with PUT /v1/institutions/{institutionId}/connector-credentials, and revoke it upstream). rewrapStatus reports whether the stored envelope was rebound or the row carried no sealed subtree to rebind. An institution that has never stored a connector credential has no credentials KEK and maps to 404, not to a rotation. A contended same-institution rotation maps to 409, and so does a concurrent change to this institution's connector configuration (the KEK version has already advanced; retry to rebind the envelope). An unknown institution maps to 404. A committed-but-unaudited rotation maps to 500 (non-retryable; escalate). ## OpenAPI ````yaml /pt/openapi/v3-current/sisbajud-executor.yaml post /v1/institutions/{institutionId}/security/credential-kek:rotate openapi: 3.1.0 info: description: >- API for the Lerian SISBAJUD executor, which runs judicial orders on Midaz. It covers institution and Midaz connector configuration, orders that need attention, ledger-routing checks, credential key rotation and audit verification. title: Lerian SISBAJUD Executor API version: 1.0.0 servers: - url: https://api.example.com description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Institution configuration lifecycle: create (with key provisioning), read, and partial update of a connector configuration addressed by institution id. name: Institution - description: >- Rotation of the key that wraps an institution's stored connector credentials, addressed by institution id. name: Security - description: 'Admin API: audit-trail integrity verification.' name: Admin paths: /v1/institutions/{institutionId}/security/credential-kek:rotate: post: tags: - Security summary: Rotate an institution's connector-credentials KEK description: >- Rotates the key that wraps this institution's stored connector credentials — a DIFFERENT key from the institution-data KEK governing PII, whose rotation is owned by the Lerian SISBAJUD Mensageria. The Transit key advances and the stored credentials envelope is rebound to the new version; no credential is decrypted and no credential VALUE changes, so a leaked client_secret is NOT invalidated by this call (rotate the material itself with PUT /v1/institutions/{institutionId}/connector-credentials, and revoke it upstream). rewrapStatus reports whether the stored envelope was rebound or the row carried no sealed subtree to rebind. An institution that has never stored a connector credential has no credentials KEK and maps to 404, not to a rotation. A contended same-institution rotation maps to 409, and so does a concurrent change to this institution's connector configuration (the KEK version has already advanced; retry to rebind the envelope). An unknown institution maps to 404. A committed-but-unaudited rotation maps to 500 (non-retryable; escalate). operationId: rotate-institution-credentials-kek parameters: - description: >- The institution's unique identifier (UUID) whose connector-credentials KEK is rotated. in: path name: institutionId required: true schema: description: >- The institution's unique identifier (UUID) whose connector-credentials KEK is rotated. examples: - 44444444-4444-4444-4444-444444444444 type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/RotateKEKRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RotateInstitutionKekResponse' description: OK '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error components: schemas: RotateKEKRequest: additionalProperties: false properties: reason: description: >- Optional operator-supplied free-text reason for the rotation (sealed verbatim into the audit payload). examples: - scheduled_annual_rotation type: string type: object RotateInstitutionKekResponse: additionalProperties: false properties: institutionId: description: The institution the rotation targeted. examples: - 44444444-4444-4444-4444-444444444444 type: string newKekVersion: description: The newly active KEK version. examples: - v3 type: string previousKekVersion: description: The KEK version that was active before the rotation. examples: - v2 type: string rewrapStatus: description: The rewrap progress status (e.g. IN_PROGRESS). examples: - IN_PROGRESS type: string rotatedAt: description: The RFC3339 timestamp the rotation committed. examples: - '2026-06-08T12:00:00Z' type: string required: - institutionId - newKekVersion - previousKekVersion - rotatedAt - rewrapStatus type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.