---
type: api
title: Migrate Deployment BYOK
description: Migrate an existing deployment to use customer-managed encryption keys (BYOK). Currently unavailable in self-hosted ECE.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/operation/operation-migrate-deployment-byok
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/operation/operation-migrate-deployment-byok
products:
  - Elastic Cloud Enterprise
---

# Migrate Deployment BYOK

## Paths

- `POST` `/deployments/{deployment_id}/byok-migration`

- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/authentication#basicauth)
- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/authentication#apikey)

#### Path Parameters

- `deployment_id` (string)
  Identifier for the Deployment

## Description

Migrate an existing deployment to use customer-managed encryption keys (BYOK). Currently unavailable in self-hosted ECE.

## Request Body

`application/json`

Request to migrate deployment to BYOK encryption

- `key_resource_path` (string) — required
  Key resource path for the customer-managed encryption key.

## Responses

#### `200`

BYOK migration request accepted.

`application/json`

- `accepted` (boolean)
  Whether the request was accepted.
- `message` (string)
  Response message.
#### `400`

* BYOK is not supported for system-owned deployments. (code: `byok_configuration.system_cluster_not_supported`)
* The deployment has ILM policies using found-snapshots in cold/frozen phases. (code: `byok_migration.ilm_policy_conflict`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `401`

You are not authorized to perform this action.

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
#### `404`

The Deployment specified by {deployment_id} cannot be found. (code: `deployments.deployment_not_found`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `409`

* A different key is already configured on the deployment. (code: `byok_migration.key_mismatch`)
* Another plan is pending on the deployment. (code: `deployments.resource_plan_state_error`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `500`

An error occurred while processing the request.

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
## Code Examples

#### Console

```console
POST /deployments/{deployment_id}/byok-migration
```

#### curl

```curl
curl -X POST "/deployments/{deployment_id}/byok-migration"
```