---
title: "Migrate Encryption Endpoint"
method: POST
path: "/credentials/migrate-encryption"
tags: ["credential management"]
---

# Migrate Encryption Endpoint

`POST /credentials/migrate-encryption`

Re-encrypt all at-rest credentials into the AES-256-GCM (``v2:gcm:``) format.

Admin only. Requires ``general_settings.encryption_algorithm: aes-256-gcm``.
Idempotent and resumable — re-running skips already-migrated values. Pass
``dry_run=true`` for a non-mutating scan (equivalent to ``--check``).

## Query parameters

- `dry_run` boolean — If true, scan and report without writing any changes.

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-18** `082b5fabd909` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/flock/apis/litellm-api/changes/credentials/migrate-encryption/post.md)

---

[API](https://skmtc.dev/flock/apis/litellm-api.md) · [All operations](https://skmtc.dev/flock/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flock/apis/litellm-api/revisions/3b2b241e4b0b?raw)