Sign in
instance

Generate a new master key and re-wrap every tier-3 key under it.

Changed on

Generates a new master key, re-wraps every tier-3 key (all project DEKs, the instance DEK, the root token key) under it, and retires the old master after a fenced zero-reference check. Bounded by the number of projects, so seconds.

Step 2 of the post-compromise recovery order: an attacker who held process memory holds the master, so every DEK must be re-wrapped under a master they never saw. Refused while the root is dual-wrapped — finalize the root rotation first.

post/api/v1/instance/rotate-master-key

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/instance/rotate-master-key
  • Auth: HTTP bearer

Response

The rotation.

key_versioninteger required

The new master key version. Every tier-3 key is now wrapped under it.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status