---
title: "Re-pin ceremony (owner + step-up)"
method: POST
path: "/vaults/v1/{vault_id}/recipients/{principal_id}/repin"
tags: ["vault"]
---

# Re-pin ceremony (owner + step-up)

`POST /vaults/v1/{vault_id}/recipients/{principal_id}/repin`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/recipients/{principal_id}/repin`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Owner + step-up (`gitvault.rotate`, protocol rev 42 D197). Issues a `recipient_confirmation_receipt` with `purpose:"repin"` — `old_ek_fingerprint` MUST equal this principal's currently-admitted pin exactly, or the call refuses `409 RECIPIENT_SET_MISMATCH` naming what is actually pinned. IDEMPOTENT (rev 43 D206), same 200-vs-201 convention as /confirm.

## Path parameters

- `vault_id` string, required
- `principal_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `old_ek_fingerprint` string, required: MUST equal this principal's currently-admitted `ek_…` fingerprint exactly.
  - `new_fingerprint` string, required: The recipient's new `ek_<32 hex>` encryption-key fingerprint.

## Response `200`

rev 43 D206 — idempotent replay of the SAME previously-issued receipt for this identical tuple

- object

## Other responses

- `201`: A genuinely fresh recipient_confirmation_receipt
- `400`: VALIDATION_FAILED — old_ek_fingerprint or new_fingerprint is not a well-formed ek_… fingerprint
- `403`: VAULT_ACCESS_DENIED
- `409`: RECIPIENT_SET_MISMATCH — old_ek_fingerprint does not match the currently-admitted manifest's recorded entry for this principal

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)