API referenceAdmin APISecurity & dataEncryption keyGet the key

Get the encryption key

⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/encryption_key

Return the customer-managed key the organization uses for stored content, its health, and the progress of any re-encryption.

For how this fits into a full workflow, see Customer-managed keys.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys.
syntic-betaYes, while in previewadmin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.

Response

200 OK, Content-Type: application/json

{
  "type": "encryption_key",
  "provider": "gcp",
  "key_ref": "projects/acme-sec/locations/europe-west3/keyRings/syntic/cryptoKeys/content",
  "status": "active",
  "verified_at": "2026-11-05T10:00:00Z",
  "reencryption": {
    "status": "running",
    "objects_total": 48211,
    "objects_done": 1200
  }
}
FieldTypeDescription
providerstringgcp, aws or azure.
key_refstringThe key’s resource name, ARN or URL in your KMS.
statusstringverifying, active, unreachable (cannot be used right now) or revoked (your KMS denied access).
reencryptionobject or nullBackground re-encryption of existing content: status, objects_total, objects_done.

Examples

curl -sS https://app.syntic.ai/v1/organizations/encryption_key \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01"

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
404not_found_errorencryption_key_not_configuredThe organization uses Syntic-managed keys.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?