Boomi API Control Plane REST API - RotationPolicy

Updated 13 November 2026

Toggle Pane

• Rotation Policy
  • getGet ORG rotation policy
  • putCreate or replace ORG rotation policy
  • getGet GLOBAL rotation policy
  • putCreate or replace GLOBAL rotation policy
  • getGet PRODUCT rotation policy
  • putCreate or replace PRODUCT rotation policy
  • getGet effective ORG rotation policy
  • getGet effective PRODUCT rotation policy

API docs by Redocly

Download OpenAPI Specification: Download

For more information about Postman collections, forking, and making your first API call, refer to the Working with Boomi APIs on Postman page.

Rotation Policy

API key rotation policy, settable at GLOBAL, ORG, or PRODUCT scope. Each scope is a singleton sub-resource: it either has a policy row or it doesn't, with no fallback to another scope in this API.

Get ORG rotation policy

Get the rotation policy set for an organization, if any.

Authorizations:

bearerAuth

path Parameters

orgId required

string <uuid> This should be the uuid for the entity in question - but for backwards compatibility, this will also accept the old integer id.

Responses

Response Schema: application/json

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification. Empty means no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid.
scope required	string Enum: "GLOBAL" "ORG" "PRODUCT" Scope this policy applies to.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: this row doesn't govern - same as no row, falls through to the parent scope (values are kept so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this row governs, but rotation is off - its other values don't matter. ENABLED: this row governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated.
orgId	string <uuid> Organization id. Set only when scope is ORG.
productId	string <uuid> API Product id. Set only when scope is PRODUCT.

NA Production

https://{subdomain}.backend.na.controlplane.boomi.com/organizations/{orgId}/rotationPolicy

GB Production

https://{subdomain}.backend.gb.controlplane.boomi.com/organizations/{orgId}/rotationPolicy

Response samples

• 200
• default

Content type

application/json

{

• "scope": "GLOBAL",
• "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",
• "productId": "dcd53ddb-8104-4e48-8cc0-5df1088c6113",
• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Create or replace ORG rotation policy

Create the rotation policy for an organization, or fully replace it if one already exists.

Authorizations:

bearerAuth

path Parameters

orgId required

string <uuid> This should be the uuid for the entity in question - but for backwards compatibility, this will also accept the old integer id.

Request Body schema: application/json

required

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification, e.g. [14, 7, 3, 1]. Every value must be one of 1, 3, 7, 14. Empty for no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid. Must be greater than 1 day and less than validityDurationDays.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: no policy at this scope, falls through to the parent (values are still saved, so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this scope's policy governs, but rotation is off. ENABLED: this scope's policy governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated. Must be between 30 and 365 days.

Responses

Response Schema: application/json

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification. Empty means no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid.
scope required	string Enum: "GLOBAL" "ORG" "PRODUCT" Scope this policy applies to.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: this row doesn't govern - same as no row, falls through to the parent scope (values are kept so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this row governs, but rotation is off - its other values don't matter. ENABLED: this row governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated.
orgId	string <uuid> Organization id. Set only when scope is ORG.
productId	string <uuid> API Product id. Set only when scope is PRODUCT.

NA Production

https://{subdomain}.backend.na.controlplane.boomi.com/organizations/{orgId}/rotationPolicy

GB Production

https://{subdomain}.backend.gb.controlplane.boomi.com/organizations/{orgId}/rotationPolicy

Request samples

• Payload

Content type

application/json

{

• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Response samples

• 200
• default

Content type

application/json

{

• "scope": "GLOBAL",
• "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",
• "productId": "dcd53ddb-8104-4e48-8cc0-5df1088c6113",
• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Get GLOBAL rotation policy

Get the rotation policy set at GLOBAL scope, if any.

Authorizations:

bearerAuth

Responses

Response Schema: application/json

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification. Empty means no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid.
scope required	string Enum: "GLOBAL" "ORG" "PRODUCT" Scope this policy applies to.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: this row doesn't govern - same as no row, falls through to the parent scope (values are kept so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this row governs, but rotation is off - its other values don't matter. ENABLED: this row governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated.
orgId	string <uuid> Organization id. Set only when scope is ORG.
productId	string <uuid> API Product id. Set only when scope is PRODUCT.

NA Production

https://{subdomain}.backend.na.controlplane.boomi.com/configuration/rotationPolicy

GB Production

https://{subdomain}.backend.gb.controlplane.boomi.com/configuration/rotationPolicy

Response samples

• 200
• default

Content type

application/json

{

• "scope": "GLOBAL",
• "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",
• "productId": "dcd53ddb-8104-4e48-8cc0-5df1088c6113",
• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Create or replace GLOBAL rotation policy

Create the rotation policy at GLOBAL scope, or fully replace it if one already exists.

Authorizations:

bearerAuth

Request Body schema: application/json

required

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification, e.g. [14, 7, 3, 1]. Every value must be one of 1, 3, 7, 14. Empty for no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid. Must be greater than 1 day and less than validityDurationDays.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: no policy at this scope, falls through to the parent (values are still saved, so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this scope's policy governs, but rotation is off. ENABLED: this scope's policy governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated. Must be between 30 and 365 days.

Responses

Response Schema: application/json

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification. Empty means no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid.
scope required	string Enum: "GLOBAL" "ORG" "PRODUCT" Scope this policy applies to.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: this row doesn't govern - same as no row, falls through to the parent scope (values are kept so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this row governs, but rotation is off - its other values don't matter. ENABLED: this row governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated.
orgId	string <uuid> Organization id. Set only when scope is ORG.
productId	string <uuid> API Product id. Set only when scope is PRODUCT.

NA Production

https://{subdomain}.backend.na.controlplane.boomi.com/configuration/rotationPolicy

GB Production

https://{subdomain}.backend.gb.controlplane.boomi.com/configuration/rotationPolicy

Request samples

• Payload

Content type

application/json

{

• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Response samples

• 200
• default

Content type

application/json

{

• "scope": "GLOBAL",
• "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",
• "productId": "dcd53ddb-8104-4e48-8cc0-5df1088c6113",
• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Get PRODUCT rotation policy

Get the rotation policy set for an API Product, if any.

Authorizations:

bearerAuth

path Parameters

productId required

string <uuid> This should be the uuid for the entity in question - but for backwards compatibility, this will also accept the old integer id.

Responses

Response Schema: application/json

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification. Empty means no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid.
scope required	string Enum: "GLOBAL" "ORG" "PRODUCT" Scope this policy applies to.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: this row doesn't govern - same as no row, falls through to the parent scope (values are kept so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this row governs, but rotation is off - its other values don't matter. ENABLED: this row governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated.
orgId	string <uuid> Organization id. Set only when scope is ORG.
productId	string <uuid> API Product id. Set only when scope is PRODUCT.

NA Production

https://{subdomain}.backend.na.controlplane.boomi.com/apiProducts/{productId}/rotationPolicy

GB Production

https://{subdomain}.backend.gb.controlplane.boomi.com/apiProducts/{productId}/rotationPolicy

Response samples

• 200
• default

Content type

application/json

{

• "scope": "GLOBAL",
• "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",
• "productId": "dcd53ddb-8104-4e48-8cc0-5df1088c6113",
• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Create or replace PRODUCT rotation policy

Create the rotation policy for an API Product, or fully replace it if one already exists.

Authorizations:

bearerAuth

path Parameters

productId required

string <uuid> This should be the uuid for the entity in question - but for backwards compatibility, this will also accept the old integer id.

Request Body schema: application/json

required

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification, e.g. [14, 7, 3, 1]. Every value must be one of 1, 3, 7, 14. Empty for no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid. Must be greater than 1 day and less than validityDurationDays.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: no policy at this scope, falls through to the parent (values are still saved, so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this scope's policy governs, but rotation is off. ENABLED: this scope's policy governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated. Must be between 30 and 365 days.

Responses

Response Schema: application/json

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification. Empty means no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid.
scope required	string Enum: "GLOBAL" "ORG" "PRODUCT" Scope this policy applies to.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: this row doesn't govern - same as no row, falls through to the parent scope (values are kept so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this row governs, but rotation is off - its other values don't matter. ENABLED: this row governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated.
orgId	string <uuid> Organization id. Set only when scope is ORG.
productId	string <uuid> API Product id. Set only when scope is PRODUCT.

NA Production

https://{subdomain}.backend.na.controlplane.boomi.com/apiProducts/{productId}/rotationPolicy

GB Production

https://{subdomain}.backend.gb.controlplane.boomi.com/apiProducts/{productId}/rotationPolicy

Request samples

• Payload

Content type

application/json

{

• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Response samples

• 200
• default

Content type

application/json

{

• "scope": "GLOBAL",
• "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",
• "productId": "dcd53ddb-8104-4e48-8cc0-5df1088c6113",
• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Get effective ORG rotation policy

Resolve the rotation policy that actually governs this organization right now: its own policy if ENABLED or DISABLED, otherwise the GLOBAL policy. Never returns an INHERITED row - that status only ever means "keep resolving upward".

Authorizations:

bearerAuth

path Parameters

orgId required

string <uuid> This should be the uuid for the entity in question - but for backwards compatibility, this will also accept the old integer id.

Responses

Response Schema: application/json

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification. Empty means no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid.
scope required	string Enum: "GLOBAL" "ORG" "PRODUCT" Scope this policy applies to.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: this row doesn't govern - same as no row, falls through to the parent scope (values are kept so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this row governs, but rotation is off - its other values don't matter. ENABLED: this row governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated.
orgId	string <uuid> Organization id. Set only when scope is ORG.
productId	string <uuid> API Product id. Set only when scope is PRODUCT.

NA Production

https://{subdomain}.backend.na.controlplane.boomi.com/organizations/{orgId}/rotationPolicy/effective

GB Production

https://{subdomain}.backend.gb.controlplane.boomi.com/organizations/{orgId}/rotationPolicy/effective

Response samples

• 200
• default

Content type

application/json

{

• "scope": "GLOBAL",
• "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",
• "productId": "dcd53ddb-8104-4e48-8cc0-5df1088c6113",
• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}

Get effective PRODUCT rotation policy

Resolve the rotation policy that actually governs this API Product right now: its own policy if ENABLED or DISABLED, otherwise its owning organization's, otherwise GLOBAL's.

Authorizations:

bearerAuth

path Parameters

productId required

string <uuid> This should be the uuid for the entity in question - but for backwards compatibility, this will also accept the old integer id.

Responses

Response Schema: application/json

notificationLeadDays required	Array of integers <int32> [ items <int32 > ] Days before expiry to send a warning notification. Empty means no notifications.
renewalWindowDays required	integer <int32> Number of days before expiry during which both the old and new key are valid.
scope required	string Enum: "GLOBAL" "ORG" "PRODUCT" Scope this policy applies to.
status required	string Enum: "INHERITED" "ENABLED" "DISABLED" INHERITED: this row doesn't govern - same as no row, falls through to the parent scope (values are kept so the UI can prefill them if this scope re-enables a custom policy later). DISABLED: this row governs, but rotation is off - its other values don't matter. ENABLED: this row governs, rotate using its values.
validityDurationDays required	integer <int32> Number of days an API key remains valid before it must be rotated.
orgId	string <uuid> Organization id. Set only when scope is ORG.
productId	string <uuid> API Product id. Set only when scope is PRODUCT.

NA Production

https://{subdomain}.backend.na.controlplane.boomi.com/apiProducts/{productId}/rotationPolicy/effective

GB Production

https://{subdomain}.backend.gb.controlplane.boomi.com/apiProducts/{productId}/rotationPolicy/effective

Response samples

• 200
• default

Content type

application/json

{

• "scope": "GLOBAL",
• "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",
• "productId": "dcd53ddb-8104-4e48-8cc0-5df1088c6113",
• "validityDurationDays": 0,
• "renewalWindowDays": 0,
• "notificationLeadDays": [

  • 0

  ],
• "status": "INHERITED"

}