kms

Activate a signing key

Changed on

Activate a pending signing key so the issuer starts signing with it.

post/v1/kms/issuers/{issuerId}/keys/{keyId}/activate

Request

  • Base URL: https://api.vercel.com
  • URL: https://api.vercel.com/v1/kms/issuers/{issuerId}/keys/{keyId}/activate
  • Auth: HTTP bearer

Path parameters

issuerIdstring required

The ID of the issuer.

keyIdstring required

The ID of the pending signing key to activate.

Query parameters

teamIdstring
Example:team_1a2b3c4d5e6f7g8h9i0j1k2l

The Team identifier to perform the request on behalf of.

slugstring
Example:my-team-url-slug

The Team slug to perform the request on behalf of.

Request body

revokePreviousAfterHoursnumber

How many hours after activation the previously-active key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.

Response

activateAtstring
activatedAtstring

When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).

algorithmstring required
certificatePemstring

The stored X.509 certificate (from publicKey.x5c[0]) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.

createdAtstring required
importKeyIdstring

The caller-supplied key id (imported keys only), used as the JWT/JWKS kid. Not unique across an issuer's keys; omitted for generated keys.

issuerIdstring required
keyIdstring required

The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.

publicKeyFingerprintstring required
publicKeyPemstring

The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from publicKey; the embedded certificate members (x5c/x5t#S256) do not affect it.

revokeAtstring
status'active' | 'pending' | 'revoking' required
updatedAtstring required

Changes