KeyLifecycleStatus Enum

The lifecycle state of a service key as it moves through generation, activation, retirement and deletion. The transitions themselves are driven by the rotation engine; this contract only names the states so a persistent store and the read seam agree on their meaning.

public enum KeyLifecycleStatus

Fields

Pending 0

Generated and published for verification, but not yet used for signing. Publishing a key before it signs (publish-before-sign) gives relying parties time to fetch it, so the first token it signs already verifies against a key they hold.

Active 1

The current signing key: within its not_before / not_after window.

Retiring 2

Past not_after, so it no longer signs, but still published so tokens it already signed keep verifying until they expire.

Retired 3

Past delete_after: no live token can reference it, so it is removed from publication.