---
title: "Rotate encryption keys"
method: POST
path: "/api/v1/admin/encryption/rotate"
tags: ["Encryption Admin"]
---

# Rotate encryption keys

`POST /api/v1/admin/encryption/rotate`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/api/v1/admin/encryption/rotate`
- Auth: API key in header `X-Platform-Admin-Token`

Re-encrypts all secrets (endpoints, incoming sources, incoming destinations, alert rule keys) with the currently active encryption key version, across ALL tenants. Requires the platform-admin operator credential (X-Platform-Admin-Token).

## Response `200`

Rotation completed with no errors

## Other responses

- `207`: Rotation completed but some records failed to re-encrypt — see 'errors'
- `403`: Forbidden — requires the platform-admin operator credential
- `409`: Rotation already in progress on another node

---

[API](https://skmtc.dev/railhook/apis/railhook-api.md) · [All operations](https://skmtc.dev/railhook/apis/railhook-api/llms.txt) · [OpenAPI document](https://skmtc.dev/railhook/apis/railhook-api/revisions/4e2c76dfc33d?raw)