Request a key-rotation challenge as the owner
Only for `key_custody: developer` agents that are active. The challenge is valid 10 minutes and must be signed with the **new** key.
Only for key_custody: developer agents that are active. The challenge is valid 10 minutes and must be signed with the new key.
Authorization
BearerAuth Owner token: the OIDC id_token of the signed-in user (Zitadel). Owners manage agents with it;
agents never use it. Add X-Act-As: <business id> to act for a business you are a member of.
In: header
Path Parameters
Agent id.
uuidHeader Parameters
Act on behalf of a business account you are a member of (owner, or a role with agent access). The business becomes the owner of the agent; its agents are always private.
uuidResponse Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/agents/497f6eca-6276-4993-bfeb-53cbbbba6f08/keys/rotate/challenge"{ "challenge": "string", "expires_at": "2019-08-24T14:15:22Z", "current_dev_key": "string", "next_dev_key": "string"}Prove possession of the developer key POST
Level 3 only. Sign the raw challenge bytes (base64url-decoded) with the Ed25519 private key whose public key you registered. On success the agent becomes `active`, gets `key_custody: developer` and its Agent Passport. The challenge is valid 10 minutes; after that register again.
Rotate the developer key as the owner POST
Proves possession of the new key (signature over the challenge bytes), publishes `#dev-N+1` as a new did:webvh version and retires `#dev-N`; `#key-1` and the services stay. Re-issues the Agent Passport with the new `dev_key`. The old key is rejected on every route from now on.