Rotate a Fleet message signing key pair

Base URL: https://{kibana_url}

POST /api/fleet/message_signing_service/rotate_key_pair
POST /s/{space_id}/api/fleet/message_signing_service/rotate_key_pair

Refer to Spaces for more information.

Rotate the key pair used by Fleet to sign messages sent to Elastic Agents. This operation is irreversible and requires all agents in the Fleet to be re-enrolled after rotation. You must explicitly acknowledge the risk by passing acknowledge=true as a query parameter.

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Header parameters

Responses

Key pair rotated successfully

application/json

Bad Request

application/json

Internal Server Error

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/fleet/message_signing_service/rotate_key_pair

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/fleet/message_signing_service/rotate_key_pair" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

The key pair was rotated. All agents must be re-enrolled to receive the new signing key.

{
  "message": "Key pair rotated successfully."
}

{
  "error": "Bad Request",
  "message": "Warning: this API will cause a key pair to rotate and should not be necessary in normal operation.  If you proceed, you may need to reinstall Agents in your network. You must acknowledge the risks of rotating the key pair with acknowledge=true in the request parameters.  For more information, reach out to your administrator.",
  "statusCode": 400
}

{
  "error": "Internal Server Error",
  "message": "Failed to rotate key pair. Message signing service is unavailable!",
  "statusCode": 500
}