Sign in
instance

Run one phase of the crash-safe root-key rotation.

Changed on

Replaces the operator-held root through a three-phase protocol over a dual-wrapped master. NO key material crosses the wire: prepare reads the NEW root from the server-side source (HIKYO_NEW_ROOT_KEY_FILE) and seals a second master wrapper; the operator then installs the new root at the PRIMARY source; verify re-reads the primary source and confirms it now unwraps the new wrapper; finalize retires the old wrapper.

A crash at any point leaves the instance bootable under either root, and every start warns until finalize. This is the rotation operators need after an env-file leak — it re-wraps the master only, touching no data.

post/api/v1/instance/rotate-root-key

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/instance/rotate-root-key
  • Auth: HTTP bearer

Request body

phase'prepare' | 'verify' | 'finalize' required

prepare seals the master under the new root; verify confirms the operator installed it at the primary source; finalize retires the old wrapper. Run in that order.

Response

The phase result.

phase'prepare' | 'verify' | 'finalize' required
root_key_epochinteger required

The epoch this phase concerns — the new epoch for prepare/verify, the surviving epoch after finalize.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status