Signing Keys

Rotate a signing key for a chain

Human users only. Generates a new server-held key for the chain and retires the old one. A self-custody (client_tss) agent key cannot be rotated: anyone other than its owner gets 403, and its owner gets 409 (rotating would replace it with a server key; deactivate it as its owner and create the replacement you want). Gated by control-plane consensus as signing_key.rotate (202 with pending_approval_id; call again with ?approval_id=). The approval is spent only after the new key is stored and escrowed.

post/v1/agents/{agent_id}/signing-keys/{chain}/rotate

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/agents/{agent_id}/signing-keys/{chain}/rotate
  • Auth: HTTP bearer

Path parameters

agent_idstring uuid required
chainstring required

Query parameters

approval_idstring uuid

An approved signing_key.rotate consensus approval (from an earlier 202).

Response

Rotated signing key

idstring uuid
agent_idstring uuid
chainstring
curvestring
public_keystring
addressstring nullable
key_versioninteger
is_activeboolean
created_atstring date-time
rotated_atstring date-time nullable
custody'server' | 'client_tss'

server — 1claw holds the whole private key and can sign alone. client_tss — 2-of-3 threshold key; its human owner holds shares 2 and 3.

owner_user_idstring uuid

client_tss only: the human who can back up, provision and restore the key.

backupobject

client_tss only (list): the key's backup state, as on treasury wallets.

Changes

No recorded changes to this operation across all 2 revisions of this API.