---
title: "Enable Key Rotation"
method: POST
path: "/kms-key/{id}/enable-key-rotation"
tags: ["kms-key"]
---

# Enable Key Rotation

`POST /kms-key/{id}/enable-key-rotation`

## Request

- Base URL: `https://api-ch-gva-2.exoscale.com/v2`
- URL: `https://api-ch-gva-2.exoscale.com/v2/kms-key/{id}/enable-key-rotation`
- Auth: none declared
- TypeScript: <https://skmtc.dev/exoscale/apis/exoscale-api/docs/kms-key/:id/enable-key-rotation/post.ts> (a function with typed inputs; its response is checked against the schema)

Enable the periodic rotation of a KMS Key.

## Path parameters

- `id` string, uuid, required

## Request body

- EnableKmsKeyRotationRequest
  - `rotation-period` integer: The number of days between each automatic key rotation.

## Response `200`

Periodic key rotation enabled

- EnableKmsKeyRotationResponse
  - `rotation` KeyRotationConfig, required
    - `manual-count` integer, required: Total running tally of manual key rotation tasks executed by users over this key resource's lifecycle.
    - `automatic` boolean, required: When set to true, dictates that the system automatically rotates material periodically.
    - `rotation-period` integer, required: The set frequency period (measured in days) for triggers monitoring auto-rotation loops.
    - `next-at` string, date-time, required: Scheduled deadline calculation pinpointing the next automated rotational iteration target date.

## Other responses

- `400`: ### Errors Invalid Origin: The request was rejected because automatic key rotation can only be enabled on a KMS key with origin "exoscale-kms". Key Not Found: The request was rejected because the specified KMS Key could not be found. Not on Default: The request was rejected because the operation is not allowed on the default key. Not on Replica: The request was rejectde because the operation is not allowed on a replica. Key is Pending Deletion: The request was rejected because it was performed on a key that is pending deletion. Key is Disabled: The request was rejected because the specified KMS key is disabled. Invalid Usage: The request was rejected because the operation is only allowed on symmetric keys with usage "encrypt-decrypt". Conflict: The request was rejected because the automatic rotation is already enabled for this KMS Key. Bad Request: The request was rejected because of an invalid request body or path parameter.

## Changes

- **2026-11-06** `63da6f74c845`: 3 warning
  - removed the request property `id`
  - removed the optional property `errors` from the response with the `400` status
  - removed the optional property `instance` from the response with the `400` status
- **2026-03-16** `e05707a7b346`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/exoscale/apis/exoscale-api/changes/kms-key/:id/enable-key-rotation/post.md)

---

[API](https://skmtc.dev/exoscale/apis/exoscale-api.md) - [All operations](https://skmtc.dev/exoscale/apis/exoscale-api/llms.txt) - [OpenAPI document](https://skmtc.dev/exoscale/apis/exoscale-api/revisions/63da6f74c845?raw)