CMEK

Disable CMEK on a vault

Disable client-side encryption. Existing CMEK-encrypted secrets still require the key to decrypt. New secrets will use HSM-only encryption.

delete/v1/vaults/{vault_id}/cmek

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/vaults/{vault_id}/cmek
  • Auth: HTTP bearer

Path parameters

vault_idstring uuid required

Response

CMEK disabled

idstring uuid required
namestring required
descriptionstring
created_bystring
created_by_typestring
created_atstring date-time required
cmek_enabledboolean

Whether client-managed encryption is enabled

cmek_fingerprintstring

SHA-256 fingerprint of the CMEK key (64 hex chars)

mpc_custodystring

MPC custody mode (e.g. "2-of-2", "2-of-3"), absent when MPC is not enabled

mpc_thresholdinteger

Number of shares required to reconstruct the key

mpc_providersstring[]

List of MPC share providers (e.g. ["server", "client"])

Changes

No recorded changes to this operation across all 1 revision of this API.