Settings

Replace a compromised cluster CA and invalidate outstanding enrollment tokens. Existing workers fail closed until they are re-enrolled.

post/settings/cluster-ca/rotate

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/settings/cluster-ca/rotate
  • Auth: HTTP bearer

Request body

confirmationstring required

Destructive-action guard. Must be exactly ROTATE CLUSTER CA.

expected_fingerprintstring required

Fingerprint observed through a trusted operator channel immediately before rotation. The request fails if the active root changed.

Response

Cluster CA rotated

messagestring required
new_fingerprintstring required
previous_fingerprintstring required
revoked_enrollment_tokensinteger required

Changes

No recorded changes to this operation across all 54 revisions of this API.