---
title: "Rotate dbt commit signing key"
method: POST
path: "/api/v1/connections/{connectionId}/dbt/rotate-signing-key"
tags: ["Connections"]
---

# Rotate dbt commit signing key

`POST /api/v1/connections/{connectionId}/dbt/rotate-signing-key`

## Request

- Base URL: `https://omniapp.co` (the document declares no server; this is the origin it was published from)
- URL: `https://omniapp.co/api/v1/connections/{connectionId}/dbt/rotate-signing-key`
- Auth: HTTP bearer

Rotate the commit signing keypair for a GitHub App dbt connection and return the dbt configuration with the new commitSigningPublicKey to register on the committer’s GitHub user. Omni mints a fresh Ed25519 keypair unless signingPrivateKey supplies your own (with signingKeyPassphrase when encrypted), enabling zero-downtime rotation: register the matching public key on GitHub first, then set it here. The committer identity can be changed in the same call, so signing can be moved to a different GitHub user in one step. Commits already signed with the old key stay Verified only while the old public key remains registered on GitHub. Only valid for github_app auth.

## Path parameters

- `connectionId` string, uuid, required: Connection ID

## Request body

- ConnectionsDbtRotateSigningKeyBody
  - `commitSigningCommitterEmail` string, email, nullable: Verified email of the GitHub user that owns the registered signing key, written into signed commits (github_app auth only). Send a string to set it, null to clear it (disabling signing), or omit it to leave the stored value unchanged. Must be set, cleared, or omitted together with commitSigningCommitterName.
  - `commitSigningCommitterName` string, nullable: Display name written into signed commits (github_app auth only). Send a string to set it, null to clear it (disabling signing), or omit it to leave the stored value unchanged. Must be set, cleared, or omitted together with commitSigningCommitterEmail.
  - `signingKeyPassphrase` string: Passphrase for signingPrivateKey when it is encrypted. Omni uses it once to decrypt the key, then stores the key under its own encryption at rest; the passphrase itself is not retained.
  - `signingPrivateKey` string: Bring-your-own ED25519 signing private key in PEM format (as produced by `ssh-keygen -t ed25519`), used instead of an Omni-generated keypair. Enables zero-downtime rotation: register the matching public key on the GitHub user first, then set it here. RSA keys are rejected — commit signing is SSHSIG over ED25519. Must be non-blank when provided; omit it to have Omni mint a fresh keypair.

## Response `200`

Signing key rotated; response includes the new public key

- ConnectionsDbtRotateSigningKeyResponse: dbt repository configuration response
  - `authMethod` 'ssh' | 'https_token' | 'github_app', required: Authentication method for the git repository. "ssh" for deploy key, "https_token" for deploy token/PAT, "github_app" for a GitHub App installation.
  - `autogenRelationships` boolean, required: Whether relationships are auto-generated from dbt
  - `branch` string, required: Git branch name
  - `commitSigningCommitterEmail` string, nullable, required: Verified email of the GitHub user that owns the registered signing key. Null unless a commit signer is configured (github_app auth only).
  - `commitSigningCommitterName` string, nullable, required: Display name written into signed commits. Null unless a commit signer is configured (github_app auth only).
  - `commitSigningPublicKey` string, nullable, required: SSH public key to register as a signing key on the GitHub user that owns commitSigningCommitterEmail, so commits show as Verified. Null for non-github_app auth.
  - `dbtVersion` string, required: dbt version being used
  - `enableSemanticLayer` boolean, required: Whether the dbt semantic layer integration is enabled
  - `enableVirtualSchemas` boolean, required: Whether virtual schemas are enabled
  - `githubAppInstallationId` string, nullable, required: GitHub App installation ID. Null for non-github_app auth.
  - `projectRootPath` string, nullable, required: Path to dbt project root
  - `publicKey` string, nullable, required: SSH public key to register as a deploy key on the git repository. Reflects the new key after a PUT with rotateKeys: true. Null for non-ssh auth.
  - `sshUrl` string, required: Clone URL for the git repository — SSH (git@...) for ssh auth, https:// for https_token or github_app auth
  - `supportsDbt` true, required: Indicates dbt is supported and configured

## Other responses

- `400`: Invalid signing key, passphrase, or committer fields
- `401`: Authentication required
- `403`: Permission denied - connection admin role required
- `404`: Connection not found or dbt not configured
- `422`: Connection is not a GitHub App dbt repository

## Changes

- **2026-09-15** `934e72bd3040`: 1 info
  - added the required property `publicKey` to the response with the `200` status
- **2026-08-05** `5bf89d043887`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/omniapp/apis/omni-api/changes/api/v1/connections/:connectionId/dbt/rotate-signing-key/post.md)

---

[API](https://skmtc.dev/omniapp/apis/omni-api.md) - [All operations](https://skmtc.dev/omniapp/apis/omni-api/llms.txt) - [OpenAPI document](https://skmtc.dev/omniapp/apis/omni-api/revisions/76b40ebc2292?raw)