Rotate Key

POSThttps://sandbox-api.truthlocks.com/v1/issuers/keys/{kid}/rotateAuth required

Rotates a signing key by creating a new key and marking the previous key as rotated. Existing attestations signed with the old key remain valid, but new attestations will use the new key.

Path Parameters

kidstringrequired

The key identifier of the key to rotate

Defaults to ed-key-1

Body Parameters

new_kidstringrequired

The key identifier for the new replacement key

Defaults to ed-key-2

new_public_key_b64urlstringrequired

The base64url-encoded public key for the new key

Defaults to MCowBQYDK2VwAyEA...

algstringrequired

Cryptographic algorithm (must match original key)

Defaults to Ed25519

Responses

{
  "old_key": {
    "kid": "ed-key-1",
    "status": "rotated",
    "rotated_at": "2026-02-18T19:00:00Z"
  },
  "new_key": {
    "kid": "ed-key-2",
    "status": "active",
    "alg": "Ed25519",
    "created_at": "2026-02-18T19:00:00Z"
  }
}

POST/v1/issuers/keys/{kid}/rotate

Language

CredentialsHEADER

Authorization

cURL Request

Examples ▾

curl --request POST \
  --url https://sandbox-api.truthlocks.com/v1/issuers/keys/ed-key-1/rotate \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --data '{
  "new_kid": "ed-key-2",
  "new_public_key_b64url": "MCowBQYDK2VwAyEA...",
  "alg": "Ed25519"
}'

Response

Click Try It! to send a real request, or view sample responses: