---
title: "Enable customer-managed key"
method: PUT
path: "/v1/account/encryption-key"
tags: ["account"]
---

# Enable customer-managed key

`PUT /v1/account/encryption-key`

## Request

- Base URL: `https://api.brixsignage.com`
- URL: `https://api.brixsignage.com/v1/account/encryption-key`
- Auth: HTTP bearer

Enables encryption with the workspace's own key in Azure Key Vault. Brix verifies the key, generates and wraps a data key, and starts re-encrypting existing secrets under it. Every new secret created after this call is protected with the customer's key.

## Request body

- object
  - `tenantId` string, required: Your Microsoft Entra tenant id (a UUID).
  - `keyId` string, required: `https://<vault>.vault.azure.net/keys/<name>/<version>`.

## Response `201`

Success.

- object
  - `data` object, required
    - `available` boolean, required: Customer-managed keys can be used on this platform.
    - `consentUrl` string, nullable, required: Microsoft admin-consent link for the Key Vault application. A tenant administrator opens it once; null when customer-managed keys are not available.
    - `covers` string, required
    - `doesNotCover` string, required
    - `key` object, nullable, required
      - `provider` 'azure-key-vault', required
      - `tenantId` string, required
      - `keyId` string, required: The key identifier in the vault (a URL). Not key material.
      - `status` 'error' | 'pending' | 'active' | 'disabling', required
      - `reencryptDone` integer, required
      - `reencryptTotal` integer, required
      - `lastUnwrapAt` string, nullable, required: ISO-8601 timestamp (UTC).
      - `lastError` string, nullable, required
      - `verifiedAt` string, required: ISO-8601 timestamp (UTC).
      - `createdBy` string, required: User id, or `api-key`.
      - `createdAt` string, required: ISO-8601 timestamp (UTC).
      - `updatedAt` string, required: ISO-8601 timestamp (UTC).
      - `wrappedKeyPreview` string, required: The first characters of the wrapped data key, to tell keys apart. Unusable without your key.
    - `firstPass` object, required: The first re-encryption pass, run inside the request; the rest runs hourly.
      - `status` string, required
      - `remaining` integer, required

## Other responses

- `401`: Missing, expired or revoked bearer token.
- `403`: You do not hold the permission for the whole workspace (a grant at one location is not enough).
- `409`: `conflict` (a key is already set; turn it off first) or `key_check_failed`.
- `422`: Bad `tenantId` or `keyId`.
- `503`: `not_available` on this platform.
- `5XX`: Server error. The body carries a `requestId` to quote to support.

---

[API](https://skmtc.dev/brixsignage/apis/brix-api.md) · [All operations](https://skmtc.dev/brixsignage/apis/brix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/brixsignage/apis/brix-api/revisions/02fd3665dc7d?raw)