Rotate a Fleet message signing key pair

Server: https://{kibana_url}

POST /api/fleet/message_signing_service/rotate_key_pair

Rotate the key pair used by Fleet to sign messages sent to Elastic Agents. This operation is irreversible and requires all agents in the Fleet to be re-enrolled after rotation. You must explicitly acknowledge the risk by passing acknowledge=true as a query parameter.

[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.

Query Parameters

acknowledge boolean · default: false: Set to true to confirm you understand the risks of rotating the key pair

Responses

Key pair rotated successfully

application/json

Bad Request

application/json

Internal Server Error

application/json

Examples

The key pair was rotated. All agents must be re-enrolled to receive the new signing key.

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/fleet/message_signing_service/rotate_key_pair

curl Shell

curl -X POST "https://{kibana_url}/api/fleet/message_signing_service/rotate_key_pair" \
  -H "kbn-xsrf: true"

Response

{
  "message": "Key pair rotated successfully."
}

{
  "error": "Bad Request",
  "message": "Warning: this API will cause a key pair to rotate and should not be necessary in normal operation.  If you proceed, you may need to reinstall Agents in your network. You must acknowledge the risks of rotating the key pair with acknowledge=true in the request parameters.  For more information, reach out to your administrator.",
  "statusCode": 400
}

{
  "error": "Internal Server Error",
  "message": "Failed to rotate key pair. Message signing service is unavailable!",
  "statusCode": 500
}