---
title: "Reencrypt Hosted Providers"
method: POST
path: "/api/v1/hosted-providers/reencrypt"
tags: ["hosted-providers"]
---

# Reencrypt Hosted Providers

`POST /api/v1/hosted-providers/reencrypt`

## Request

- The document declares no server URL.
- Auth: one of:
  - API key in header `Otari-Key`
  - API key in header `x-api-key`

Re-encrypt every stored key and set of client arguments with the primary ``OTARI_SECRET_KEY``.

Run after rotating the key, alongside ``POST /api/v1/search-tools/reencrypt``.
A provider no configured key reads is left as it is, to be re-entered.

## Response `200`

Successful Response

- HostedProvidersReencryptPublic: What re-encrypting the stored hosted provider credentials did. ``unreadable`` counts providers no configured key reads, left as they were to be re-entered; ``skipped`` those edited while the rotation ran, already written under the primary key.
  - `reencrypted` integer, required
  - `skipped` integer, required
  - `unreadable` integer, required

## Changes

- **2026-10-19** `3d8fba047d0e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/mozilla-ai/apis/otari/changes/api/v1/hosted-providers/reencrypt/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc.dev/mozilla-ai/apis/otari/revisions/56a84a2d9087?raw)