---
title: "Rotate serving keys"
method: POST
path: "/query/serve/keys/rotate"
tags: ["query"]
---

# Rotate serving keys

`POST /query/serve/keys/rotate`

## Request

- The document declares no server URL.
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in header `Authorization`

Starts a new generation of the CA and query signing keys that secure serving plugins. A graceful rotation publishes the new keys, uses them after the overlap and then retires the old ones, without interrupting serving plugins. An immediate rotation is for a suspected compromise: it switches at once and serving plugins must be restarted.

## Request body

- ServeRotateKeysRequest
  - `ca_key_uri` string: CAKeyURI and SigningKeyURI name new KMS keys. Leave both empty to have Marmot generate keys it stores encrypted, which is refused when the current keys are in a KMS.
  - `immediate` boolean: Immediate switches to the new keys at once and stops trusting the old ones, for a suspected compromise; serving plugins must then be restarted.
  - `signing_key_uri` string

## Response `200`

OK

- ServeKeyGeneration[]
  - `activates_at` string
  - `active` boolean
  - `id` string
  - `retires_at` string
  - `storage` string

## Other responses

- `400`: Bad Request

## Changes

> 65 revisions in range; 1 not diffed.

- **2026-10-22** `b5eb291dd2fe`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/marmotdata/apis/marmot-api/changes/query/serve/keys/rotate/post.md)

---

[API](https://skmtc.dev/marmotdata/apis/marmot-api.md) - [All operations](https://skmtc.dev/marmotdata/apis/marmot-api/llms.txt) - [OpenAPI document](https://skmtc.dev/marmotdata/apis/marmot-api/revisions/18c57b576cb6?raw)