Rotate an institution's connector-credentials KEK

Rotates the key that wraps this institution’s stored connector credentials — a DIFFERENT key from kek:rotate, which rotates the institution-data KEK governing PII. The Transit key advances and the stored credentials envelope is rebound to the new version; no credential is decrypted and no credential VALUE changes, so a leaked client_secret is NOT invalidated by this call (rotate the material itself with PATCH /v1/institutions/, and revoke it upstream). rewrapStatus reports whether the stored envelope was rebound or the row carried no sealed subtree to rebind. An institution that has never stored a connector credential has no credentials KEK and maps to 404, not to a rotation. A contended same-institution rotation maps to 409, and so does a concurrent change to this institution’s connector configuration (the KEK version has already advanced; retry to rebind the envelope). An unknown institution maps to 404. A committed-but-unaudited rotation maps to 500 (non-retryable; escalate).

POST /institutions/{institutionId}/security/credential-kek:rotate

Rotate an institution's connector-credentials KEK

cURL

curl --request POST \
  --url https://sisbajud.sandbox.lerian.net/institutions/{institutionId}/security/credential-kek:rotate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "reason": "scheduled_annual_rotation"
}
'

200

{
  "institutionId": "44444444-4444-4444-4444-444444444444",
  "newKekVersion": "v3",
  "previousKekVersion": "v2",
  "rewrapStatus": "IN_PROGRESS",
  "rotatedAt": "2026-06-08T12:00:00Z"
}

Autorizaciones

Authorization · string · header · requerido

JWT bearer token issued by the identity provider.

Parámetros de ruta

institutionId · string · requerido

The institution's unique identifier (UUID) whose connector-credentials KEK is rotated.

Ejemplo:

"44444444-4444-4444-4444-444444444444"

Cuerpo

application/json

reason · string

Optional operator-supplied free-text reason for the rotation (sealed verbatim into the audit payload).

Ejemplo:

"scheduled_annual_rotation"

Respuesta

200

application/json

OK

institutionId · string · requerido

The institution the rotation targeted.

Ejemplo:

"44444444-4444-4444-4444-444444444444"

newKekVersion · string · requerido

The newly active KEK version.

Ejemplo:

"v3"

previousKekVersion · string · requerido

The KEK version that was active before the rotation.

Ejemplo:

"v2"

rewrapStatus · string · requerido

The rewrap progress status (e.g. IN_PROGRESS).

Ejemplo:

"IN_PROGRESS"

rotatedAt · string · requerido

The RFC3339 timestamp the rotation committed.

Ejemplo:

"2026-06-08T12:00:00Z"