---
title: "Generate Jump Server Backup Key"
method: POST
path: "/api/v2/privileged-access/backup-key"
tags: ["Privileged Access"]
---

# Generate Jump Server Backup Key

`POST /api/v2/privileged-access/backup-key`

## Request

- Base URL: `https://console.jumpcloud.com`
- URL: `https://console.jumpcloud.com/api/v2/privileged-access/backup-key`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/docs/api/v2/privileged-access/backup-key/post.ts> (a function with typed inputs; its response is checked against the schema)

Generate or rotate the Jump Server backup key and return it once. This is the only response that ever contains the plaintext key, so the caller must surface it immediately. Rotation keeps `keyId` stable and stores a new key version; each backup file records the version it was encrypted with, so backups taken before a rotation still require their earlier key. Not idempotent. Requires the PAM Backup permission.

## Request body

- JumpcloudPrivilegedAccessGeneratePrivilegedAccessBackupKeyRequest

## Response `200`

A successful response.

- JumpcloudPrivilegedAccessGeneratePrivilegedAccessBackupKeyReply
  - `key` string
  - `keyId` string
  - `version` string

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/revisions/f396d9271b46?raw)