chap.participant.rotate_key
chap.participant.rotate_keyReplace a participant's signing key with a new one, retiring the old key but keeping it valid for verifying previously signed envelopes.
Instructions
Retire a participant's signing key and register its replacement. The old key stays in the key history with a valid_until timestamp, so envelopes it signed still verify.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| from | Yes | Participant URI, e.g. 'human:alice@example.org' or 'agent:bot@local'. | |
| new_jwk | Yes | The replacement public key as a JWK. It must carry a 'kid'. Whether the request itself has to be signed with the old key is decided at dispatch, and only where the coordinator is configured to require signatures. | |
| old_kid | Yes | Key id being retired. It is given a valid_until timestamp and stays in the member's key history, so signatures made before the rotation still verify. A key id that is unknown is refused with -32071, and one already revoked with -32072. | |
| workspace | Yes | Workspace identifier, e.g. 'wsp_techcorp_support'. |