---
title: "Update Primary Vault Key"
method: PUT
path: "/api/v1/vault/keys/primary"
tags: ["Vault Keys"]
---

# Update Primary Vault Key

`PUT /api/v1/vault/keys/primary`

## Request body

- VaultKeyUpdateRequest
  - `id` string, uuid, required
  - `wrapped_org_encryption_key` string, required — AES-256-GCM ciphertext wrapping the org encryption key (base64)
  - `auth_hash` string, required — SHA-256(newMasterKey) hex digest for the new primary key
  - `current_auth_hash` string, nullable — Stored auth hash of the current primary vault key
  - `recovery_auth_hash` string, nullable — Stored auth hash of a recovery code

## Response `200`

Successful Response

- VaultKeyResponse
  - `id` string, uuid, required
  - `key_type` 'primary' | 'recovery', required
  - `created_by` string, nullable, required
  - `invalidated_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `422` — Validation Error
- `4XX` — Client error with Support Agent information.
- `5XX` — Server error with Support Agent information.

---

[API](https://skmtc.dev/inkbox/apis/inkbox-api.md) · [All operations](https://skmtc.dev/inkbox/apis/inkbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/inkbox/inkbox-api/revisions/31f357e7e6f8/schema)