/sys/rotate/config
The /sys/rotate
endpoint is used to configure automatic key rotation.
Configure automatic key rotation
This endpoint configures the automatic rotation of the backend encryption key. By default, the key is rotated after just under 4 billion encryptions, to satisfy the recommendation of NIST SP 800-38D. One can configure rotations after fewer encryptions or on a time based schedule.
Create or update the auto rotation configuration
POST
/sys/rotate/config
Parameters
max_operations
(int: 3865470566)
- Specify the limit of encryptions after which the key will be automatically rotated. The number must be between 1,000,000 and the default.interval
`(string: "") - If set, the age of the active key at which an automatic rotation is triggered. Specified as a Go duration string (e.g. 4320h), the value must be at least 24 hours.enabled
(bool: true)
- If set to false, automatic rotations will not be performed. Tracking of encryption counts will continue.
Sample payload
Sample request
Get the auto rotation configuration
GET
/sys/rotate/config
Sample request
Sample response
Last updated