PHphilterd
Signing

Rotate the output signing key.

Changed on

Generates a new ES256 keypair and makes it the active signing key. The superseded key is retained and stays retrievable through GET /api/signing-key/{keyId}, so signatures and ledger entries made with it remain verifiable; consumers should resolve each signature's key id rather than caching one key. Rotation is the response to a suspected key compromise, so it requires an administrator as well as the signing:write scope, and is recorded as a signing_key_regenerated audit event. Requires the signing:write scope.

post/api/signing-key/regenerate

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /api/signing-key/regenerate
  • Auth
    HTTP bearer

Headers

Authorizationstring required

Response

The key that is now active.

keyIdstring

Changes

  • c4f85daa9208Revision changes
    • info

      added the non-success response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

  • 4082c17721d8Revision changes
    • breaking

      removed the media type */* for the response with the status

    • breaking

      removed the media type */* for the response with the status

    • breaking

      removed the media type */* for the response with the status

    • breaking

      removed the media type */* for the response with the status

    • breaking

      removed the media type */* for the response with the status

    • breaking

      removed the media type */* for the response with the status

    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status