Updated on 2026-08-25 GMT+08:00

On-demand Key Rotation

Function

This API is used to import key materials for external keys. You need to import the key materials before performing rotation.

Calling Method

For details, see Calling APIs.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.

If you are using identity policy-based authorization, the following identity policy-based permissions are required.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
kms:cmk:rotateOnDemand	Write	KeyId *	kms:KeySpec g:EnterpriseProjectId g:ResourceTag/<tag-key>	-	-

URI

POST /v1.0/{project_id}/kms/rotate-on-demand

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID. For details, see Obtaining a Project ID. Constraints N/A Range The value returned by the IAM API is used, which contains 32 characters. Default Value N/A

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. It can be obtained by calling the IAM API. The value of X-Subject-Token in the response header is the user token. Constraints N/A Range Obtain the value by calling the IAM API for obtaining the user token. Default Value N/A

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
key_id	Yes	String	Definition Key ID Constraints The value must be a 36-byte ID. The value must match the regular expression ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$. Range N/A Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
key_id	String	Definition Key ID Range N/A

Example Requests

https://kms.cn-north-4.myhuaweicloud.com/v1.0/d4e559b49b3b403da5279723299ed4a6/kms/rotate-on-demand

{
  "key_id" : "66c1e2d4-f480-4ff9-ad80-2cf6a76c278e"
}

Example Responses

None

Status Codes

Status Code	Description
200	Request succeeded.

Error Codes

See Error Codes.

Parent Topic: Key Import Management