Rotate the encryption key
⚠️
Preview — this feature is being built; the design below is the spec.
POST https://app.syntic.ai/v1/organizations/encryption_key/rotateSwitch to a new key version or a new key and re-encrypt stored data in the background. Reads keep working throughout because data still under the old key is decrypted with it; do not disable the old key until reencryption.status is completed.
For how this fits into a full workflow, see Customer-managed keys.
Headers
| Header | Required | Value |
|---|---|---|
Authorization | Yes | Bearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys. |
syntic-beta | Yes, while in preview | admin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning. |
Content-Type | Yes | application/json |
Idempotency-Key | No | Up to 255 characters. Retrying with the same key within 24 hours returns the first result instead of acting twice. See Idempotency. |
Body parameters
| Parameter | Type | Required | Notes |
|---|---|---|---|
key_ref | string | No | A different key. Leave out to switch to the latest version of the key already in use. |
Response
202 Accepted, Content-Type: application/json
{
"type": "encryption_key",
"provider": "gcp",
"key_ref": "projects/acme-sec/locations/europe-west3/keyRings/syntic/cryptoKeys/content-2027",
"status": "active",
"previous_key_ref": "projects/acme-sec/locations/europe-west3/keyRings/syntic/cryptoKeys/content",
"reencryption": {
"status": "running",
"objects_total": 48211,
"objects_done": 0
}
}| Field | Type | Description |
|---|---|---|
previous_key_ref | string | Keep this key enabled until re-encryption completes. |
reencryption | object | Progress of the background re-encryption. |
Examples
curl -sS "https://app.syntic.ai/v1/organizations/encryption_key/rotate" \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "syntic-beta: admin-2026-11-01" \
-H "Idempotency-Key: 8d6f0c1e-4b2a-4a57-9f0e-2f1d3c4b5a69" \
-H "Content-Type: application/json" \
-d '{
"key_ref": "projects/acme-sec/locations/europe-west3/keyRings/syntic/cryptoKeys/content-2027"
}'Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 400 | invalid_request_error | key_unusable | The new key failed the test encrypt and decrypt. |
| 409 | conflict_error | reencryption_running | A previous rotation has not finished. |
| 401 | authentication_error | invalid_api_key | The admin key is missing, unknown, revoked or expired. |
| 403 | permission_error | admin_key_required | An inference key was used. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
Was this page helpful?