Your Ops Manager installation generates an identity key: a key pair that the installation uses to prove its identity when it connects to MongoDB. If someone outside your organization obtains the private key, the key is compromised, and they could impersonate your installation.
Use this endpoint to rotate the identity key. Rotating replaces the key with a new key pair. If the rotation fails, Ops Manager applies no change and the current key stays active. The response always contains the outcome of the rotation.
Important
Your Ops Manager installation must be able to connect to MongoDB to rotate the key. If it can't, the endpoint returns the HTTP status 502 with the outcome UNREACHABLE or EA_UNAVAILABLE.
Required Roles
To access this resource, your API key must have the Global Owner role. The Global Owner role is the highest role in Ops Manager. Only users with this role can view and manage license keys.
Request
Send a POST request to start the rotation.
Base URL: https://{OPSMANAGER-HOST}:{PORT}/api/public/v1.0
POST /admin/artifacts/identity/rotateRequest Path Parameters
This endpoint doesn't use HTTP request path parameters.
Request Query Parameters
This endpoint accepts the following query parameters:
Name | Type | Necessity | Description | Default |
|---|---|---|---|---|
pretty | boolean | Optional | Flag indicating whether the response body is in a prettyprint format. |
|
envelope | boolean | Optional | Flag that indicates whether to wrap the response in an envelope. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. For endpoints that return one result, the response body includes:
|
|
Request Body Parameters
This endpoint doesn't use HTTP request body parameters.
Response
The response contains the following fields:
Field | Type | Description |
|---|---|---|
| string | Result of the rotation. Ops Manager returns one of the values in the following table. |
| string | Sentence that describes why Ops Manager didn't apply the rotation. This field is |
The following table lists each outcome with its HTTP status and message:
Outcome | HTTP Status | Message |
|---|---|---|
| 200 | Ops Manager returns no message. |
| 502 | MongoDB could not be reached to complete the rotation. No change was applied — the current key stays active. Try again shortly. |
| 502 | The MongoDB Enterprise Advanced service is unavailable. No change was applied — the current key stays active. Try again shortly. |
| 409 | There is no enrollment identity to rotate yet — one is created on the first install. |
| 409 | MongoDB rejected the rotation's proof of possession. The current key stays active. Contact your MongoDB account team. |
| 409 | The enrollment identity changed concurrently. No change was applied — retry shortly. |
| 409 | MongoDB rejected the rotation request. The current key stays active. |
Example Request
Use curl to send a POST request to the /admin/artifacts/identity/rotate endpoint:
curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \ --header "Accept: application/json" \ --include \ --request POST \ "https://<OpsManagerHost>:<Port>/api/public/v1.0/admin/artifacts/identity/rotate?pretty=true"Example Response
The following examples show the response headers and the response body of a successful request.
Response Header
The following headers show an unauthorized response and a successful response:
HTTP/1.1 401 UnauthorizedContent-Type: application/json;charset=ISO-8859-1Date: {dateInUnixFormat}WWW-Authenticate: Digest realm="MMS Public API", domain="", nonce="{nonce}", algorithm=MD5, op="auth", stale=falseContent-Length: {requestLengthInBytes}Connection: keep-aliveHTTP/1.1 200 OKVary: Accept-EncodingContent-Type: application/jsonStrict-Transport-Security: max-age=300Date: {dateInUnixFormat}Connection: keep-aliveContent-Length: {requestLengthInBytes}X-MongoDB-Service-Version: gitHash={gitHash}; versionString={ApplicationVersion}Response Body
The following example shows the response body:
{ "outcome": "ROTATED", "message": null}