luxolus/open-vault
2
0
Fork 0
Code Issues 1 Pull requests Releases Activity
open-vault/website/source/docs/http/sys-rekey.html.md

3.4 KiB
Raw Blame History

layout page_title sidebar_current description
http HTTP API: /sys/rekey/ docs-http-rotate-rekey The `/sys/rekey/` endpoints are used to rekey the unseal keys for Vault.

/sys/rekey/init

GET

Description
Reads the configuration and progress of the current rekey attempt.
Method
GET
URL
`/sys/rekey/init`
Parameters
None
Returns
If a rekey is started, then "n" is the new shares to generate and "t" is the threshold required for the new shares. The "progress" is how many unseal keys have been provided for this rekey, where "required" must be reached to complete. 
```javascript
{
  "started": true,
  "t": 3,
  "n": 5,
  "progress": 1,
  "required": 3
}
```

PUT

Description
Initializes a new rekey attempt. Only a single rekey attempt can take place at a time, and changing the parameters of a rekey requires canceling and starting a new rekey.
Method
PUT
URL
`/sys/rekey/init`
Parameters
  • secret_shares required The number of shares to split the master key into.
  • secret_threshold required The number of shares required to reconstruct the master key. This must be less than or equal to secret_shares.
  • pgp_keys optional An array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as secret_shares.
Returns
`204` response code.

DELETE

Description
Cancels any in-progress rekey. This clears the rekey settings as well as any progress made. This must be called to change the parameters of the rekey.
Method
DELETE
URL
`/sys/rekey/init`
Parameters
None
Returns
`204` response code.

/sys/rekey/update

PUT

Description
Enter a single master key share to progress the rekey of the Vault. If the threshold number of master key shares is reached, Vault will complete the rekey. Otherwise, this API must be called multiple times until that threshold is met.
Method
PUT
URL
`/sys/rekey/update`
Parameters
  • key required A single master share key.
Returns
A JSON-encoded object indicating completion and if so with the (possibly encrypted, if pgp_keys was provided) new master keys: 
```javascript
{
  "complete": true,
  "keys": ["one", "two", "three"]
}
```