Rotate the device key

POST

/security/klock/sessions/{id}/rotate

Signed by the old key; proof is a JWS by the new key over
{sessionId, from, to} (the two thumbprints). A new session carries on
with the same kind, device, team and expiry, and a new device
certificate; the old one lives five more minutes, then is gone. A
session rotates once. Only the session itself may rotate.

Request

Authorization

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢201

application/json

Rotated

Bodyapplication/json

🟠400

🟠403

🟠404

🟠409

🟠401KlockUnauthorized

🟠423SessionFrozen

🔴503KlockUnavailable

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/klock/sessions//rotate' \
--header 'Content-Type: application/json' \
--data '{
    "devicePub": "string",
    "proof": "string",
    "sealPub": "string",
    "sealBinding": "string"
}'

Response Example

201 - Example 1

{
    "sessionId": "string",
    "rotatedFrom": "string",
    "grant": "string",
    "grantSeq": 0,
    "deviceCert": "string",
    "checkInBy": 0,
    "exp": 0,
    "oldSessionEndsAt": "2019-08-24T14:15:22.123Z"
}

Modified at 2026-10-05 04:04:32

Step up the session asking

Freeze a session