<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Encryption Key Rotation — API Reference

## Audit Key Rotation Compliance

```bash
node scripts/agent.js --action audit --input /tmp/key_inventory.json --max-age-days 365
```

## Check Certificate Expiration

```bash
node scripts/agent.js --action check-certs --input /etc/ssl/certs/ --warn-days 30
```

## Generate Rotation Schedule

```bash
node scripts/agent.js --action schedule --input /tmp/key_inventory.json
```

## Key Inventory Input Format

```json
{
  "keys": [
    {"key_id": "alias/data-key", "type": "symmetric", "last_rotated": "2025-01-15T00:00:00Z", "auto_rotation": true},
    {"key_id": "rsa-signing-key", "type": "asymmetric", "last_rotated": "2024-06-01T00:00:00Z", "auto_rotation": false}
  ]
}
```

## Audit Output Format

```json
{
  "key_id": "alias/data-key",
  "type": "symmetric",
  "age_days": 420,
  "last_rotated": "2024-01-15T00:00:00Z",
  "reason": "age 420d exceeds 365d policy"
}
```

## Rotation Policy Guidelines

| Key Type | Rotation Period | Standard |
|----------|----------------|----------|
| Symmetric (AES) | 90-365 days | NIST SP 800-57 |
| Asymmetric (RSA) | 1-2 years | PCI DSS 3.6 |
| TLS Certificate | 90-397 days | CA/Browser Forum |
| Application Secret | 90 days | CIS Controls |
| API Key | 90 days | OWASP |
