reveal_rotation_successor
One-shot retrieval of the plaintext for a successor minted by the auto-rotation scheduler (not by rotate_api_key — that returns its own plaintext directly). Decrypts the at-rest ciphertext, returns it once, then destroys it; a second call errors. Only available while the predecessor still has an unrevealed successor.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"keyId": "<keyId>"
},
"name": "reveal_rotation_successor"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| keyId | Yes | UUID of the predecessor key whose successor to reveal. |