Rotation executed — the key metadata at its advanced material version is returned (same kid).

Invalid rotation request: missing required fields, unknown JSON property, Jackson strict-mode rejection, or @Pattern violation on verificationPolicy.

Unauthenticated — missing or invalid JWT.

Forbidden — missing scope admin.keys.rotate or tenant boundary violation.

Key not found in the specified tenant's keystore.

Conflict: a concurrent rotation of this key is in progress (retry to advance from the current material version), or the key's lifecycle state does not permit rotation (e.g., revoked). The upstream type, title and detail are relayed verbatim under the PRD §126 relay contract, so branch on type rather than on this prose; instance and extensions.requestId are always this service's own. ProblemView carries no extension members, so an upstream extensions.code (for example INVALID_KEY_STATE) does NOT survive the relay — the type is the member to key on.

Unprocessable Entity: the rotation target is well-formed but the tenant rotation policy refuses it — relayed verbatim from Core API. A weakest-link security downgrade, mandatory-standards or family/structure violation surfaces as rotate-security-downgrade; a purpose-crossing target surfaces as rotation-purpose-violation.

Core API unavailable — upstream rotation service did not respond within the configured timeout.