query

Rotate serving keys

Changed on

Starts a new generation of the CA and query signing keys that secure serving plugins. A graceful rotation publishes the new keys, uses them after the overlap and then retires the old ones, without interrupting serving plugins. An immediate rotation is for a suspected compromise: it switches at once and serving plugins must be restarted.

post/query/serve/keys/rotate

Request

  • The document declares no server URL.
  • Auth
    • API key in header X-API-Key
    • or API key in header Authorization

Request body

ca_key_uristring

CAKeyURI and SigningKeyURI name new KMS keys. Leave both empty to have Marmot generate keys it stores encrypted, which is refused when the current keys are in a KMS.

immediateboolean

Immediate switches to the new keys at once and stops trusting the old ones, for a suspected compromise; serving plugins must then be restarted.

signing_key_uristring

Response

OK

activates_atstring
activeboolean
idstring
retires_atstring
storagestring

Changes