- [HTTP request](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#body.HTTP_TEMPLATE)
- [Path parameters](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#body.PATH_PARAMETERS)
- [Request body](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#body.request_body)
  - [JSON representation](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#body.request_body.SCHEMA_REPRESENTATION)
- [Response body](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#body.response_body)
  - [JSON representation](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#body.RotateAppSigningKeyResponse.SCHEMA_REPRESENTATION)
- [Authorization scopes](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#body.aspect)
- [KeyRotationReason](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#KeyRotationReason)
- [RotatedCloudKmsKey](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#RotatedCloudKmsKey)
  - [JSON representation](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#RotatedCloudKmsKey.SCHEMA_REPRESENTATION)
- [Try it!](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#try-it)

Rotates an app's signing key to a new self-hosted Google Cloud KMS key.

Warning: This method only applies to apps enrolled with self-hosted Cloud KMS keys. For apps using standard Google-managed Play App Signing, key rotation requests must be initiated through the Google Play Console UI.

See Help Center: <https://support.google.com/googleplay/android-developer/answer/9842756>

### HTTP request

`POST https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{name}/appSigning:rotateAppSigningKey`

The URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.

### Path parameters

| Parameters ||
|---|---|
| `name` | `string` Required. Either package name or app ID of the app rotating the signing key. |

### Request body

The request body contains data with the following structure:

| JSON representation |
|---|
| ``` { "rotatedCloudKmsKey": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#RotatedCloudKmsKey`) }, "keyRotationReason": enum (`https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#KeyRotationReason`) } ``` |

| Fields ||
|---|---|
| `rotatedCloudKmsKey` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#RotatedCloudKmsKey`)`` Required. Self-hosted Cloud KMS key. |
| `keyRotationReason` | ``enum (`https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/rotateAppSigningKey#KeyRotationReason`)`` Required. Reason for rotating the app key. |

### Response body

Response to rotate an app's signing key.

If successful, the response body contains data with the following structure:

| JSON representation |
|---|
| ``` { "rotatedKeyCertificate": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CertificateHashes`) } } ``` |

| Fields ||
|---|---|
| `rotatedKeyCertificate` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CertificateHashes`)`` The rotated key certificate hashes for the app. Always set. |

### Authorization scopes

Requires the following OAuth scope:

- `https://www.googleapis.com/auth/androidpublisher`

## KeyRotationReason

Key rotation reasons.

| Enums ||
|---|---|
| `KEY_ROTATION_REASON_UNSPECIFIED` | Unspecified key rotation reason. Cannot be used. |
| `COMPROMISED_KEY` | Key is compromised. |
| `USE_STRONGER_KEY` | Stronger key is required. |
| `USE_SAME_KEY_FOR_MULTIPLE_APPS` | Same key is used for multiple apps. |
| `ROUTINE_KEY_UPGRADE` | Routine key upgrade. |
| `OTHER` | Other reason. |

## RotatedCloudKmsKey

Message representing rotated Cloud KMS key. Consists of the Cloud KMS key and its associated proof of rotation.

| JSON representation |
|---|
| ``` { "cloudKmsKeyAndCert": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CloudKmsKeyAndCert`) }, "signingCertificateLineage": string } ``` |

| Fields ||
|---|---|
| `cloudKmsKeyAndCert` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CloudKmsKeyAndCert`)`` Required. Cloud KMS key and the certificate associated with the key. |
| `signingCertificateLineage` | `string (https://developers.google.com/discovery/v1/type-format format)` Required. Proof-of-rotation. See [creating signing certificate lineages](https://developer.android.com/studio/command-line/apksigner#rotate_signing_keys_2). A base64-encoded string. |