Package co.ankatech.ankasecure.keymanagement

Class RotationOperations

java.lang.Object
co.ankatech.ankasecure.keymanagement.RotationOperations
public final class RotationOperations extends Object
The rotation of a key: an immediate rotation, whether a rotation is admissible now, the key's automatic-rotation schedule and the history of its scheduled executions. Obtained from AuthenticatedKeyManagementSdk.rotation(). 

 RotationAdmissibilityResponse verdict = sdk.rotation().admissibility("payments-signing-key");
 KeySummaryResponse rotated = sdk.rotation().rotate("payments-signing-key",
         new RotationRequest().newMaterial(newMaterial), "6f1c2a9e-3b4d-4e5f-8a7b-9c0d1e2f3a4b");

  • Method Details

    • rotate

      public KeySummaryResponse rotate(String kid, RotationRequest request)
      Rotates a key now (POST /tenants/{t}/keys/{kid}/rotations), without an idempotency key: every call is a new rotation.
      Parameters:
      kid - the key identifier; must not be null
      request - the new material; must not be null
      Returns:
      the rotated key
      Throws:
      QuorumApprovalPendingException - when the tenant's quorum policy gates rotation
      KeyManagementSdkException - when the call is refused

    • rotate

      public KeySummaryResponse rotate(String kid, RotationRequest request, String idempotencyKey)
      Rotates a key now (POST /tenants/{t}/keys/{kid}/rotations) under an Idempotency-Key: a resend with the same key and request never rotates twice, and the same key with another request is refused 422 idempotency-key-reused.
      Parameters:
      kid - the key identifier; must not be null
      request - the new material; must not be null
      idempotencyKey - 1 to 255 visible ASCII characters naming this rotation, or null for none
      Returns:
      the rotated key
      Throws:
      QuorumApprovalPendingException - when the tenant's quorum policy gates rotation
      KeyManagementSdkException - when the call is refused

    • admissibility

      public RotationAdmissibilityResponse admissibility(String kid)
      Reads whether the key may be rotated now and why not when it may not (GET /tenants/{t}/keys/{kid}/rotation-admissibility).
      Parameters:
      kid - the key identifier; must not be null
      Returns:
      the verdict
      Throws:
      KeyManagementSdkException - when the call is refused

    • schedule

      public KeyRotationScheduleView schedule(String kid)
      Reads the key's automatic-rotation schedule (GET /tenants/{t}/keys/{kid}/rotation-schedule).
      Parameters:
      kid - the key identifier; must not be null
      Returns:
      the schedule
      Throws:
      KeyManagementSdkException - when the call is refused

    • replaceSchedule

      public KeyRotationScheduleView replaceSchedule(String kid, KeyRotationScheduleRequest request)
      Replaces the key's automatic-rotation schedule (PUT /tenants/{t}/keys/{kid}/rotation-schedule).
      Parameters:
      kid - the key identifier; must not be null
      request - the schedule; must not be null
      Returns:
      the stored schedule
      Throws:
      KeyManagementSdkException - when the call is refused (a stale version is 409)

    • listExecutions

      public KeyRotationExecutionsResponse listExecutions(String kid, RotationExecutionListQuery query)
      Reads the key's rotation schedule and one page of its executions, latest due first (GET /tenants/{t}/keys/{kid}/rotation-executions).
      Parameters:
      kid - the key identifier; must not be null
      query - the page; must not be null
      Returns:
      the schedule and the page of executions
      Throws:
      KeyManagementSdkException - when the call is refused