---
title: "Create or rotate tenant CMK"
method: POST
path: "/v3/tenant-encryption/{companyId}/key"
tags: ["Tenant Encryption"]
---

# Create or rotate tenant CMK

`POST /v3/tenant-encryption/{companyId}/key`

## Request

- Base URL: `https://api-ext-sboxmeta.partners.spotnana.com`
- URL: `https://api-ext-sboxmeta.partners.spotnana.com/v3/tenant-encryption/{companyId}/key`
- Auth: HTTP bearer

First call provisions a Spotnana-managed CMK and DEK.
Subsequent calls rotate the CMK and re-wrap the existing DEK.
Returns 429 if called within the one-hour cooldown window.
Requires the COMPANY_MANAGEMENT WRITE permission on the company.

## Response `200`

Key provisioned or rotated

- ProvisionOrRotateTenantKeyResponse
  - `configId` string, uuid
  - `created` boolean: True on first provision; false on CMK rotation.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Key rotation cooldown not elapsed

---

[API](https://skmtc.dev/spotnana/apis/company-api.md) - [All operations](https://skmtc.dev/spotnana/apis/company-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spotnana/apis/company-api/revisions/184a1b415751?raw)