> ## Documentation Index > Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt > Use this file to discover all available pages before exploring further. # Rotate signing key > Generates a new signing key for a subscription. The previous key keeps signing deliveries alongside it for `gracePeriod`: 24 hours when omitted, or `"0s"` to retire every earlier key at once. Send a new `requestId` (a UUID) for each rotation. To recover a lost answer, repeat the request with the same `requestId` and the same `gracePeriod` (omitted counts as 24 hours). For 24 hours after the rotation succeeded, that returns the same key and `previousKeyExpireAt` instead of generating another, unless a later rotation has replaced that key. Every account can use event subscriptions. In an account whose Macs your organization manages, they need the events capability. Service accounts can call it with the `compute:RotateEventSubscriptionKey` permission. ## OpenAPI ````yaml /api-reference/openapi/compute.json post /compute/v2/eventsubscriptions/{name}/key openapi: 3.0.3 info: title: Mount Thor Compute API version: 02a4a30e3ecb description: >- Create, list, inspect and delete virtual machines and bare-metal Macs, read the image and machine-class catalogs, see your reserved capacity and your account's compute profile, report machine problems to Mount Thor, and subscribe to machine events. Service-account credentials can list, create and delete machines, read the catalogs and the compute profile, and use event subscriptions. In an account whose Macs your organization manages, they can also read a Mac and use problem reports, and every one of these only as far as the account's capabilities allow. The other compute operations are for people using the `mthr` CLI or the portal. In an account whose Macs your organization manages, an operation outside its capabilities (see Get compute profile) answers 400 `tenant_compute_customer_managed`. Mount Thor names each machine. To change a machine's class or image, delete it and create a new one. Lists return one page at a time: pass `nextPageToken` back as `pageToken` until it comes back empty. servers: - url: https://customer-api.mountthor.com security: - bearerAuth: [] paths: /compute/v2/eventsubscriptions/{name}/key: post: summary: Rotate signing key description: >- Generates a new signing key for a subscription. The previous key keeps signing deliveries alongside it for `gracePeriod`: 24 hours when omitted, or `"0s"` to retire every earlier key at once. Send a new `requestId` (a UUID) for each rotation. To recover a lost answer, repeat the request with the same `requestId` and the same `gracePeriod` (omitted counts as 24 hours). For 24 hours after the rotation succeeded, that returns the same key and `previousKeyExpireAt` instead of generating another, unless a later rotation has replaced that key. Every account can use event subscriptions. In an account whose Macs your organization manages, they need the events capability. Service accounts can call it with the `compute:RotateEventSubscriptionKey` permission. operationId: ComputeService_RotateEventSubscriptionKey parameters: - name: name in: path description: The subscription's `name`. required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/RotateEventSubscriptionKeyRequest' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/RotateEventSubscriptionKeyResponse' '400': description: >- No key was generated. `error.reason` is `invalid_argument` when `requestId` is not a UUID, `gracePeriod` is negative or over 24 hours, or a reused `requestId` came with a different `gracePeriod`. It is `failed_precondition` when a previous key is still retiring and `gracePeriod` is not `"0s"`, or when the `requestId` succeeded more than 24 hours ago or a later rotation superseded it; for those, send a new `requestId`. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: The credential is missing, invalid or expired. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- The credential does not allow this operation. `error.reason` is `machine_credential_not_supported` when the operation refuses service accounts. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No event subscription with this name exists in your account. content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Too many requests for now. Event subscription operations are limited per account; retry after the number of seconds in `Retry-After`. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: >- With `error.reason` `unknown` (`error.status` `Unknown`), the rotation may have been applied. Repeat the request with the same `requestId` and `gracePeriod` to recover its key. Getting the subscription cannot. content: application/json: schema: $ref: '#/components/schemas/Error' '501': description: >- Event subscriptions are not available yet (`unimplemented`); retry later. content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: Compute is temporarily unable to complete the request; retry later. content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: RotateEventSubscriptionKeyRequest: required: - requestId type: object properties: requestId: type: string description: >- A UUID you generate for this rotation. Use it again only to retry the same rotation. gracePeriod: pattern: ^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$ type: string description: >- Optional. How long the previous key keeps signing beside the new one, as a duration such as `"3600s"`. 24 hours when omitted, and at most 24 hours. `"0s"` retires every earlier key at once. description: The rotation to make. RotateEventSubscriptionKeyResponse: type: object properties: hmacKey: type: string description: The new signing key, base64-encoded. Treat it as a secret. format: bytes previousKeyExpireAt: type: string description: >- When the previous key stops signing deliveries. Until then each delivery carries a signature from both keys. It is the rotation time when `gracePeriod` was `"0s"`. Stop trusting the previous key after it. format: date-time description: The new signing key. Error: type: object properties: error: type: object properties: code: type: integer description: The HTTP status code. status: type: string description: >- A short category name, for example `NotFound`, `InvalidArgument` or `FailedPrecondition`. reason: type: string description: >- A stable, machine-readable reason when one applies, for example `insufficient_funds` when a launch is refused for billing. Branch on this, not on `message`. message: type: string description: A human-readable explanation. Its wording can change. securitySchemes: bearerAuth: type: http scheme: bearer description: >- Send `Authorization: Bearer ` to https://customer-api.mountthor.com. People use the session that `mthr login` stores (a token starting `mt_session_`, valid for up to 12 hours). Automation uses a service-account credential (starting `mt_sa_v1_`, valid for 90 days) from Create credential. Each operation names the permission it needs. Service accounts hold permissions through custom roles, and some operations refuse them; those operations say so. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.