# Rotate an OpCert before expiry (edge-self) (/docs/api-reference/edges/EdgesController_rotate)

`POST /api/edge/rotate`

Base URL: https://api.xentr.ai

Authentication: bearer token (`Authorization: Bearer <token>`).

Called by the edge agent ~7 days before OpCert expiry. Must present current cert fingerprint + a fresh CSR.

## Request body

Required.

Content type: `application/json`

```json
{
  "type": "object",
  "properties": {
    "csr": {
      "type": "string",
      "description": "Fresh PEM-encoded CSR. Signed by the DIC or current OpCert to prove possession."
    },
    "currentFingerprint": {
      "type": "string",
      "description": "SHA-256 hex fingerprint of the current (not-yet-revoked) OpCert. We verify this before issuing a new cert.",
      "example": "a3f2e9d1..."
    }
  },
  "required": [
    "csr",
    "currentFingerprint"
  ]
}
```

## Responses

### 200: New OpCert issued

### 400: Malformed CSR

### 401: Current cert unrecognized or revoked