Rotate a Fleet message signing key pair

Base URL: https://{kibana_url}

POST /api/fleet/message_signing_service/rotate_key_pair
POST /s/{space_id}/api/fleet/message_signing_service/rotate_key_pair

Auth

Rotate the key pair used by Fleet to sign messages sent to Elastic Agents. This operation is irreversible and requires all agents in the Fleet to be re-enrolled after rotation. You must explicitly acknowledge the risk by passing acknowledge=true as a query parameter.

Required privileges

Privileges fleet-agents-all and fleet-agent-policies-all and fleet-settings-all

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

acknowledge boolean · default: false: Set to true to confirm you understand the risks of rotating the key pair

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Responses

Key pair rotated successfully

application/json

message string required

Bad Request

application/json

Internal Server Error

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/fleet/message_signing_service/rotate_key_pair

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/fleet/message_signing_service/rotate_key_pair" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

The key pair was rotated. All agents must be re-enrolled to receive the new signing key.

{
  "message": "Key pair rotated successfully."
}

{
  "error": "Bad Request",
  "message": "Warning: this API will cause a key pair to rotate and should not be necessary in normal operation.  If you proceed, you may need to reinstall Agents in your network. You must acknowledge the risks of rotating the key pair with acknowledge=true in the request parameters.  For more information, reach out to your administrator.",
  "statusCode": 400
}

{
  "error": "Internal Server Error",
  "message": "Failed to rotate key pair. Message signing service is unavailable!",
  "statusCode": 500
}