CMEK

Start server-assisted CMEK key rotation

Re-encrypts all secrets from the old CMEK key to the new one. Keys are passed in headers (TLS-only) and exist in server memory only during the rotation. Batched in groups of 100 secrets.

Refused with 400 on the signing-key vaults (__agent-keys, __treasury-keys): a rotation rewrites ciphertext in place, which the key escrow would not pick up, leaving the escrowed copy sealed under the retired key.

post/v1/vaults/{vault_id}/cmek-rotate

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/vaults/{vault_id}/cmek-rotate
  • Auth: HTTP bearer

Path parameters

vault_idstring uuid required

Headers

x-cmek-old-keystring required

Base64-encoded old CMEK key (32 bytes)

x-cmek-new-keystring required

Base64-encoded new CMEK key (32 bytes)

Request body

new_fingerprintstring required

SHA-256 hex fingerprint of the new CMEK key

Response

Rotation job started

idstring uuid required
vault_idstring uuid required
old_fingerprintstring
new_fingerprintstring
status'pending' | 'running' | 'completed' | 'failed' required
total_secretsinteger required
processedinteger required
errorstring
started_atstring date-time
completed_atstring date-time
created_atstring date-time required

Changes

No recorded changes to this operation across all 2 revisions of this API.