---
title: "POST /encryption/passphrase"
method: POST
path: "/encryption/passphrase"
tags: ["encryption"]
---

# POST /encryption/passphrase

`POST /encryption/passphrase`

## Request

- The document declares no server URL.
- Auth: one of:
  - API key in query parameter `auth`
  - API key in header `Authorization`

Replaces the passphrase for a space that contains only the local device.
The request body contains plaintext secrets and must never be logged.

## Request body

- ChangeEncryptionPassphraseRequest: Request body for `POST /encryption/passphrase`. Both fields contain plaintext secrets and must never be logged.
  - `passphrase` string, required
  - `passphraseConfirmation` string, required

## Response `200`

Passphrase changed

- EncryptionActionEnvelope: Canonical success envelope: `{ "data": T, "ts": <unix millis i64> }`. `ts` is `chrono::Utc::now().timestamp_millis()`, set in the webserver handler via [`ApiEnvelope::now`] (the contract carries only the type + the clock helper, not a hard dependency on when the handler reads the clock). `rename_all = "camelCase"` is a no-op for the single-word fields here but is declared for forward-compat. IMPORTANT (utoipa v4): every concrete `ApiEnvelope<X>` that needs a named OpenAPI component is declared in the `#[aliases(...)]` block below. Add a new alias line whenever a new payload type needs enveloping. NEVER register the bare `ApiEnvelope` in `components(schemas(...))` — utoipa errors on a bare generic, and an un-aliased generic inlines an anonymous schema.
  - `data` EncryptionActionResponse, required: Shared response payload for `POST /encryption/unlock` and `POST /encryption/lock`.
    - `success` boolean, required
  - `ts` integer, required: Server time when the response was built (unix epoch milliseconds).

## Other responses

- `400`: Passphrases do not match
- `409`: Space is not eligible for a passphrase change
- `503`: Passphrase change is unavailable

## Changes

- **2026-10-15** `4c664cabd0c5`: 3 info
  - added the optional property `requestId` to the response with the `400` status
  - added the optional property `requestId` to the response with the `409` status
  - added the optional property `requestId` to the response with the `503` status
- **2026-09-15** `bf9aba6dc99c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/uniclipboard/apis/uniclipboard-daemon-api/changes/encryption/passphrase/post.md)

---

[API](https://skmtc.dev/uniclipboard/apis/uniclipboard-daemon-api.md) - [All operations](https://skmtc.dev/uniclipboard/apis/uniclipboard-daemon-api/llms.txt) - [OpenAPI document](https://skmtc.dev/uniclipboard/apis/uniclipboard-daemon-api/revisions/48a01cf04e4c?raw)