2017-03-15 06:40:33 +00:00
|
|
|
---
|
2017-03-17 18:06:03 +00:00
|
|
|
layout: "api"
|
2017-03-15 06:40:33 +00:00
|
|
|
page_title: "/sys/rotate - HTTP API"
|
|
|
|
|
sidebar_current: "docs-http-system-rotate"
|
|
|
|
|
description: |-
|
|
|
|
|
The `/sys/rotate` endpoint is used to rotate the encryption key.
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# `/sys/rotate`
|
|
|
|
|
|
|
|
|
|
The `/sys/rotate` endpoint is used to rotate the encryption key.
|
|
|
|
|
|
|
|
|
|
## Rotate Encryption Key
|
|
|
|
|
|
|
|
|
|
This endpoint triggers a rotation of the backend encryption key. This is the key
|
|
|
|
|
that is used to encrypt data written to the storage backend, and is not provided
|
|
|
|
|
to operators. This operation is done online. Future values are encrypted with
|
|
|
|
|
the new key, while old values are decrypted with previous encryption keys.
|
|
|
|
|
|
2018-05-09 14:19:35 +00:00
|
|
|
This path requires `sudo` capability in addition to `update`.
|
|
|
|
|
|
2017-03-15 06:40:33 +00:00
|
|
|
| Method | Path | Produces |
|
|
|
|
|
| :------- | :--------------------------- | :--------------------- |
|
|
|
|
|
| `PUT` | `/sys/rotate` | `204 (empty body)` |
|
|
|
|
|
|
|
|
|
|
### Sample Request
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
$ curl \
|
|
|
|
|
--header "X-Vault-Token: ..." \
|
|
|
|
|
--request PUT \
|
2018-03-23 15:41:51 +00:00
|
|
|
http://127.0.0.1:8200/v1/sys/rotate
|
2017-03-15 06:40:33 +00:00
|
|
|
```
|
