---
title: "Rotate the output signing key."
method: POST
path: "/api/signing-key/regenerate"
tags: ["Signing"]
---

# Rotate the output signing key.

`POST /api/signing-key/regenerate`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/signing-key/regenerate`
- Auth: HTTP bearer

Generates a new ES256 keypair and makes it the active signing key. The superseded key is retained and stays retrievable through GET /api/signing-key/{keyId}, so signatures and ledger entries made with it remain verifiable; consumers should resolve each signature's key id rather than caching one key. Rotation is the response to a suspected key compromise, so it requires an administrator as well as the signing:write scope, and is recorded as a signing_key_regenerated audit event. Requires the `signing:write` scope.

## Headers

- `Authorization` string, required

## Response `200`

The key that is now active.

- object
  - `keyId` string

## Other responses

- `400`: Bad Request
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold signing:write, or the caller is not an administrator.
- `404`: Not Found
- `406`: No representation matches Accept.
- `409`: The signing key is managed by PHILTER_SIGNING_KEY_PATH and cannot be rotated through the API.
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-10** `c4f85daa9208`: 13 info
  - added the non-success response with the status `404`
  - added the optional property `field` to the response with the `400` status
  - added the optional property `field` to the response with the `401` status
  - added the optional property `field` to the response with the `413` status
  - …9 more
- **2026-10-05** `4082c17721d8`: 6 breaking, 6 info
  - removed the media type `*/*` for the response with the status `400`
  - removed the media type `*/*` for the response with the status `401`
  - removed the media type `*/*` for the response with the status `413`
  - removed the media type `*/*` for the response with the status `415`
  - …8 more
- **2026-09-12** `82223aa1f5c0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/signing-key/regenerate/post.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)