---
type: api
title: Rotate a Fleet message signing key pair
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-post-fleet-message-signing-service-rotate-key-pair
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-post-fleet-message-signing-service-rotate-key-pair
products:
  - Kibana
---

# Rotate a Fleet message signing key pair

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/fleet/message_signing_service/rotate_key_pair`
- `POST` `/s/{space_id}/api/fleet/message_signing_service/rotate_key_pair`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Rotate the key pair used by Fleet to sign messages sent to Elastic Agents. This operation is irreversible and requires all agents in the Fleet to be re-enrolled after rotation. You must explicitly acknowledge the risk by passing `acknowledge=true` as a query parameter.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.

## Query String Parameters

- `acknowledge` (boolean · default: false)
  Set to true to confirm you understand the risks of rotating the key pair

## Responses

#### `200`

Key pair rotated successfully

`application/json`

- `message` (string)
#### `400`

Bad Request

`application/json`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
#### `500`

Internal Server Error

`application/json`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
## Code Examples

#### Console

```console
POST /api/fleet/message_signing_service/rotate_key_pair
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/fleet/message_signing_service/rotate_key_pair" \
  -H "kbn-xsrf: true"
```

## Response Examples

#### Rotate key pair success

The key pair was rotated. All agents must be re-enrolled to receive the new signing key.

```json
{
  "message": "Key pair rotated successfully."
}
```

#### Acknowledge required

Request was rejected because the acknowledge query parameter was not set to true

```json
{
  "error": "Bad Request",
  "message": "Warning: this API will cause a key pair to rotate and should not be necessary in normal operation.  If you proceed, you may need to reinstall Agents in your network. You must acknowledge the risks of rotating the key pair with acknowledge=true in the request parameters.  For more information, reach out to your administrator.",
  "statusCode": 400
}
```

#### Service unavailable

The message signing service is not available

```json
{
  "error": "Internal Server Error",
  "message": "Failed to rotate key pair. Message signing service is unavailable!",
  "statusCode": 500
}
```