HYhyperbrowser

Replace a secret version's wrapping

Changed on

Replaces a customer-protected version's wrapped envelope with one wrapped with another of your keys, to rotate your key. The value and version number don't change. The SDKs' rewrap does this for every version. See Customer-protected secrets. Secrets are enabled for teams on request; please contact support to enable them (otherwise 403 SECRETS_FEATURE_DISABLED). Restricted API keys need the secrets.manage scope. When you're signed in rather than using an API key, you must be a team owner or admin (otherwise 403 SECRETS_ADMIN_REQUIRED).

put/api/secrets/{id}/versions/{version}/wrapping

Request

Path parameters

idstring uuid required

Secret ID.

versioninteger required

Version number.

Request body

envelopestring required

The version's inner envelope, wrapped with your new key, in the same form as a customer-protected version upload.

innerDigeststring required

The version's innerDigest. It must match: only the wrapping changes, never the value (otherwise 409 SECRET_DIGEST_MISMATCH).

Response

Success

versioninteger required
kidstring required

ID of the platform public key the inner envelope is encrypted to.

retiresAtstring date-time nullable required

When that platform key is retired, or null.

outerKidstring required

ID of your key that wrapped the version.

innerDigeststring required

Unpadded base64url SHA-256 of the inner envelope. Check the envelope you unwrap against it.

envelopestring required

The wrapped envelope, which only your key can open.

Changes