---
title: "Re-encrypt"
method: POST
path: "/kms-key/{id}/re-encrypt"
tags: ["crypto"]
---

# Re-encrypt

`POST /kms-key/{id}/re-encrypt`

## Request

- Base URL: `https://api-ch-gva-2.exoscale.com/v2`
- URL: `https://api-ch-gva-2.exoscale.com/v2/kms-key/{id}/re-encrypt`
- Auth: none declared
- TypeScript: <https://skmtc.dev/exoscale/apis/exoscale-api/docs/kms-key/:id/re-encrypt/post.ts> (a function with typed inputs; its response is checked against the schema)

Decrypts an existing ciphertext using its original key material and re-encrypts the underlying plaintext using a specified KMS key or the latest key material of the same KMS Key.

## Path parameters

- `id` string, uuid, required

## Request body

- ReEncryptRequest
  - `source` object, required
    - `key` string, uuid, required: The ID of the source key currently protecting the data payload.
    - `encryption-context` string, byte, nullable: Optional Base64-encoded encryption context originally appended to the AAD to confirm package validation rules.
    - `ciphertext` string, byte, required: The Base64-encoded encrypted payload package ready to undergo source-side key decryption.
  - `destination` object, required
    - `key` string, uuid, required: The ID of the target key chosen to encapsulate the newly shifted data translation.
    - `encryption-context` string, byte, nullable: Optional new Base64-encoded encryption context to apply under the target destination envelope.

## Response `200`

Base64 encoded ciphertext

- ReEncryptResponse
  - `ciphertext` string, byte, required: The new Base64-encoded ciphertext block safely wrapped by the chosen destination key parameters.

## Other responses

- `400`: ### Errors Key Not Found: The request was rejected because the specified KMS Key could not be found. Key is Disabled: The request was rejected because the specified KMS key is disabled. Not on Default: The request was rejected because the operation is not allowed on the default key. Bad Request: The request was rejected because of an invalid request body or path parameter.

## Changes

- **2026-11-06** `63da6f74c845`: 2 warning
  - removed the optional property `errors` from the response with the `400` status
  - removed the optional property `instance` from the response with the `400` status
- **2026-03-16** `e05707a7b346`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/exoscale/apis/exoscale-api/changes/kms-key/:id/re-encrypt/post.md)

---

[API](https://skmtc.dev/exoscale/apis/exoscale-api.md) - [All operations](https://skmtc.dev/exoscale/apis/exoscale-api/llms.txt) - [OpenAPI document](https://skmtc.dev/exoscale/apis/exoscale-api/revisions/63da6f74c845?raw)