---
title: "Start server-assisted CMEK key rotation"
method: POST
path: "/v1/vaults/{vault_id}/cmek-rotate"
tags: ["CMEK"]
---

# Start server-assisted CMEK key rotation

`POST /v1/vaults/{vault_id}/cmek-rotate`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/vaults/{vault_id}/cmek-rotate`
- Auth: HTTP bearer

Re-encrypts all secrets from the old CMEK key to the new one.
Keys are passed in headers (TLS-only) and exist in server memory
only during the rotation. Batched in groups of 100 secrets.

Refused with 400 on the signing-key vaults (`__agent-keys`,
`__treasury-keys`): a rotation rewrites ciphertext in place, which the
key escrow would not pick up, leaving the escrowed copy sealed under the
retired key.

## Path parameters

- `vault_id` string, uuid, required

## Headers

- `x-cmek-old-key` string, required
- `x-cmek-new-key` string, required

## Request body

- CmekRotateRequest
  - `new_fingerprint` string, required: SHA-256 hex fingerprint of the new CMEK key

## Response `202`

Rotation job started

- CmekRotationJobResponse
  - `id` string, uuid, required
  - `vault_id` string, uuid, required
  - `old_fingerprint` string
  - `new_fingerprint` string
  - `status` 'pending' | 'running' | 'completed' | 'failed', required
  - `total_secrets` integer, required
  - `processed` integer, required
  - `error` string
  - `started_at` string, date-time
  - `completed_at` string, date-time
  - `created_at` string, date-time, required

## Other responses

- `400`: Invalid request

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)