Rotate the encryption key

⚠️
Preview — this feature is being built; the design below is the spec.
POST https://app.syntic.ai/v1/organizations/encryption_key/rotate

Switch to a new key version or a new key and re-encrypt stored data in the background. Reads keep working throughout because data still under the old key is decrypted with it; do not disable the old key until reencryption.status is completed.

For how this fits into a full workflow, see Customer-managed keys.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys.
syntic-betaYes, while in previewadmin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.
Content-TypeYesapplication/json
Idempotency-KeyNoUp to 255 characters. Retrying with the same key within 24 hours returns the first result instead of acting twice. See Idempotency.

Body parameters

ParameterTypeRequiredNotes
key_refstringNoA different key. Leave out to switch to the latest version of the key already in use.

Response

202 Accepted, Content-Type: application/json

{
  "type": "encryption_key",
  "provider": "gcp",
  "key_ref": "projects/acme-sec/locations/europe-west3/keyRings/syntic/cryptoKeys/content-2027",
  "status": "active",
  "previous_key_ref": "projects/acme-sec/locations/europe-west3/keyRings/syntic/cryptoKeys/content",
  "reencryption": {
    "status": "running",
    "objects_total": 48211,
    "objects_done": 0
  }
}
FieldTypeDescription
previous_key_refstringKeep this key enabled until re-encryption completes.
reencryptionobjectProgress of the background re-encryption.

Examples

curl -sS "https://app.syntic.ai/v1/organizations/encryption_key/rotate" \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01" \
  -H "Idempotency-Key: 8d6f0c1e-4b2a-4a57-9f0e-2f1d3c4b5a69" \
  -H "Content-Type: application/json" \
  -d '{
      "key_ref": "projects/acme-sec/locations/europe-west3/keyRings/syntic/cryptoKeys/content-2027"
    }'

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
400invalid_request_errorkey_unusableThe new key failed the test encrypt and decrypt.
409conflict_errorreencryption_runningA previous rotation has not finished.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?