---
title: "Activate the staged DKIM key"
method: POST
path: "/domains/{id}/dkim/rotate/activate"
tags: ["Domains"]
---

# Activate the staged DKIM key

`POST /domains/{id}/dkim/rotate/activate`

## Request

- Base URL: `https://api.poststack.dev`
- URL: `https://api.poststack.dev/domains/{id}/dkim/rotate/activate`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Authorization code: `https://poststack.dev/oauth/authorize`
    - Token URL: `https://poststack.dev/oauth/token`
- TypeScript: <https://skmtc.dev/poststack/apis/poststack-api/docs/domains/:id/dkim/rotate/activate/post.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `id` string, required

## Query parameters

- `force` 'true' | 'false'

## Response `200`

Cut over.

- object
  - `rotation` DkimRotation, required
    - `domainId` integer, required
    - `state` 'idle' | 'pending_dns' | 'ready' | 'retiring', required
    - `activeSelector` string, nullable
    - `pendingSelector` string, nullable
    - `pendingPublicKey` string, nullable
    - `pendingRecordName` string, nullable: TXT record name to publish.
    - `pendingRecordValue` string, nullable: TXT record value to publish.
    - `startedAt` string, date-time, nullable
    - `publishedAt` string, date-time, nullable
    - `activatesAfter` string, date-time, nullable: Earliest moment an un-forced activation succeeds.
    - `retiredSelector` string, nullable
    - `retireAfter` string, date-time, nullable

## Other responses

- `400`: Validation failed — `error` names each offending field (`field: message`).
- `401`: Missing, malformed or unknown credentials (`WWW-Authenticate: Bearer …` is set).
- `403`: The credential lacks the `domains:manage` scope (body `{ error: "insufficient_scope", required, missing }`), or the team is suspended.
- `404`: No such resource on this team.
- `409`: No rotation in progress, the new record is missing/mismatched, or the propagation window has not elapsed.
- `429`: Rate limited (20 per 15 min). `Retry-After` gives the seconds to wait; `X-RateLimit-*` headers are sent on every response.
- `503`: DNS could not be read; nothing changed.

## Changes

- **2026-09-30** `4dc1e20989c8`: 21 warning
  - added the new `daily_limit_exceeded` enum value to the `anyOf[#/components/schemas/Error]/code` response property for the response status `403`
  - added the new `daily_limit_exceeded` enum value to the `code` response property for the response status `400`
  - added the new `daily_limit_exceeded` enum value to the `code` response property for the response status `401`
  - added the new `daily_limit_exceeded` enum value to the `code` response property for the response status `404`
  - …17 more
- **2026-09-29** `ef5b22b98333`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/poststack/apis/poststack-api/changes/domains/:id/dkim/rotate/activate/post.md)

---

[API](https://skmtc.dev/poststack/apis/poststack-api.md) - [All operations](https://skmtc.dev/poststack/apis/poststack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/poststack/apis/poststack-api/revisions/0d3971e3a670?raw)