---
title: "Register (or rotate) the public key Tuteliq uses to encrypt your incident records"
method: POST
path: "/api/v1/account/encryption-key"
tags: ["Account"]
---

# Register (or rotate) the public key Tuteliq uses to encrypt your incident records

`POST /api/v1/account/encryption-key`

## Request

- Base URL: `https://api.tuteliq.ai`
- URL: `https://api.tuteliq.ai/api/v1/account/encryption-key`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-api-key`

Registers an RSA public key. After registration, all NEW incident records (rationale, visual_description, etc.) are encrypted with a per-record AES key, which is itself wrapped with this RSA key (hybrid scheme RSA-OAEP + AES-256-GCM). Tuteliq cannot decrypt — only your dashboard (with the matching private key) can.

Rotating: POST a new key here. New incidents use the new key; old incidents remain readable with the old private key until they expire (90 days).

Private key is YOUR responsibility — Tuteliq cannot recover lost-key incidents.

## Request body

- object
  - `algorithm` 'RSA-OAEP-2048' | 'RSA-OAEP-4096', required: RSA-OAEP key size. 2048-bit is faster, 4096-bit is more conservative.
  - `public_key_pem` string, required: PEM-encoded SPKI public key (begins with "-----BEGIN PUBLIC KEY-----").

## Response `200`

Default Response

- object
  - `algorithm` string
  - `public_key_pem` string
  - `key_fingerprint` string
  - `registered_at` string
  - `rotated_from` string

---

[API](https://skmtc.dev/tuteliq/apis/tuteliq-api.md) · [All operations](https://skmtc.dev/tuteliq/apis/tuteliq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tuteliq/apis/tuteliq-api/revisions/8490332e0031?raw)