"Rotation" is used to mean three completely different operations, and confusing them causes outages. The tool uses three different verbs.
Command
What changes
Can it break your app?
When
secretsmgr key rotate
Your own keypair. You re-lock your vault keys to your new key
No. Affects only you, needs nobody's cooperation
Suspected key exposure; routine hygiene; new laptop
secretsmgr vault rotate-data-keys
The encryption keys, not the values. Everything is re-encrypted and reads back identically
No: guaranteed by design and by test
On a schedule, as routine hygiene
secretsmgr secret rotate(phase 4)
The real credential, upstream. The database password genuinely changes
Yes, if done carelessly, which is why it uses the grace period above
Offboarding, suspected leak, compliance schedule
One more key change happens on its own: when someone is removed from a vault, the vault gets a fresh vault key for everyone who remains, as part of the removal itself. You never run it; it is what makes taking access away work.
The one to remember
Only the third one is revocation. The first two are hygiene: valuable, but they do not invalidate anything an attacker or an ex-colleague already read.