CMEK

Enable CMEK on a vault

Enable client-side encryption on a vault. Requires Business or Enterprise plan. Only the key's SHA-256 fingerprint is stored — the key never touches the server.

Refused with 400 on the signing-key vaults (__agent-keys, __treasury-keys): the server signs with the keys they hold, and a key it cannot open without the customer would break every signature.

post/v1/vaults/{vault_id}/cmek

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/vaults/{vault_id}/cmek
  • Auth: HTTP bearer

Path parameters

vault_idstring uuid required

Request body

fingerprintstring required

SHA-256 hex fingerprint of the CMEK key (64 chars)

Response

CMEK enabled

idstring uuid required
namestring required
descriptionstring
created_bystring
created_by_typestring
created_atstring date-time required
cmek_enabledboolean

Whether client-managed encryption is enabled

cmek_fingerprintstring

SHA-256 fingerprint of the CMEK key (64 hex chars)

mpc_custodystring

MPC custody mode (e.g. "2-of-2", "2-of-3"), absent when MPC is not enabled

mpc_thresholdinteger

Number of shares required to reconstruct the key

mpc_providersstring[]

List of MPC share providers (e.g. ["server", "client"])

Changes

No recorded changes to this operation across all 1 revision of this API.