---
title: "Activate a JSON Web Key"
method: POST
path: "/v2/jwkSets/{jwkSetId}/jsonWebKeys/{jsonWebKeyId}:activate"
tags: ["jwkSets"]
---

# Activate a JSON Web Key

`POST /v2/jwkSets/{jwkSetId}/jsonWebKeys/{jsonWebKeyId}:activate`

## Request

- Base URL: `https://api.sigmacomputing.com`
- URL: `https://api.sigmacomputing.com/v2/jwkSets/{jwkSetId}/jsonWebKeys/{jsonWebKeyId}:activate`
- Auth: HTTP bearer

Make the given JSON Web Key the active key for its set, deactivating whichever key previously held that role. Does not delete the previously active key. Remove it separately once its rotation overlap window has passed. Returns the now-active key.

### Usage notes
- To perform this operation, you must use API credentials owned by a user assigned the Admin account type.
- `jsonWebKeyId` must belong to the `jwkSetId` in the path.

### Usage scenarios
- **Key rotation:** Switch signing over to a newly created key once it has propagated.

## Path parameters

- `jwkSetId` string, required
- `jsonWebKeyId` string, required

## Request body

- object

## Response `200`

The response body.

- JwkSetsActivateJsonWebKeyResponse200
  - `jsonWebKeyId` string, required: Unique identifier of the JSON Web Key.
  - `jwkSetId` string, required: Unique identifier of the JWK set this key belongs to.
  - `algorithm` 'RS256' | 'ES256', required: Signing algorithm this key was generated for.
  - `publicKey` string, required: PEM-encoded X.509 certificate wrapping the public key. Never includes private key material.
  - `expiresAt` string, date-time, required: Expiration timestamp of the underlying certificate.
  - `status` 'active' | 'inactive', required: `active` if this is the key currently used to sign JWT bearer tokens for the set, otherwise `inactive`.

---

[API](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api.md) - [All operations](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/revisions/fb6036208c49?raw)