---
title: "Rotate the subject signing key (signed by the current key; carries the new key's proof-of-possession)"
method: POST
path: "/agent/recorders/{publicId}/rotate-key"
---

# Rotate the subject signing key (signed by the current key; carries the new key's proof-of-possession)

`POST /agent/recorders/{publicId}/rotate-key`

## Request

- Base URL: `https://touchstone.cv`
- URL: `https://touchstone.cv/agent/recorders/{publicId}/rotate-key`
- Auth: HTTP bearer

## Path parameters

- `publicId` string, required

## Request body

- object
  - `new_signing_pubkey` string, required
  - `new_key_pop` string, required: new key signs touchstone-rotate:v1:<recorder>:<new_pubkey>
  - `rotation_sig` string, required: current key signs the key_rotation entry's canonical content

## Response `201`

rotation_seq + effective_from_seq

## Other responses

- `422`: signature did not verify

---

[API](https://skmtc.dev/touchstone/apis/touchstone-api.md) · [All operations](https://skmtc.dev/touchstone/apis/touchstone-api/llms.txt) · [OpenAPI document](https://skmtc.dev/touchstone/apis/touchstone-api/revisions/11ffeafa6a85?raw)