LElensesio
system

Initializes a new rekey attempt.

Only a single rekey attempt can take place at a time, and changing the parameters of a rekey requires canceling and starting a new rekey, which will also provide a new nonce.

post/sys/rekey/init

Request

Request body

backupboolean

Specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the PGP-encrypted keys.

pgp_keysstring[]

Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as secret_shares.

require_verificationboolean

Turns on verification functionality

secret_sharesinteger

Specifies the number of shares to split the unseal key into.

secret_thresholdinteger

Specifies the number of shares required to reconstruct the unseal key. This must be less than or equal secret_shares. If using Vault HSM with auto-unsealing, this value must be the same as secret_shares.

Response

OK

Changes

No recorded changes to this operation across all 1 revision of this API.