Sign in
instance

Append a new DEK version for one project or the instance scope.

Changed on

Appends a new data-encryption-key version. New writes seal under it immediately; ciphertext under the previous version stays readable until reencrypt walks it onto the new one (Vault keyring semantics). Free on its own, and incomplete without a following reencrypt.

Its own capability, rotate-dek, never bundled - the post-compromise recovery order runs each rotation under a distinct authority.

post/api/v1/instance/rotate-dek

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/instance/rotate-dek
  • Auth: HTTP bearer

Request body

scope'project' | 'instance' required

project rotates one project's DEK (org and project required); instance rotates the instance DEK for rows belonging to no project.

orgstring

Organisation id. Required when scope is project, absent otherwise.

projectstring

Project id. Required when scope is project, absent otherwise.

Response

The rotation.

scope'project' | 'instance' required
orgstring
projectstring
key_versioninteger required

The new active DEK version. Old versions remain readable until reencrypt.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status