Reset the project encryption key
- POST /_encryption/_reset
Destroy the current project encryption key (PEK) and generate a new one. This is the recovery path for when the on-disk encrypted PEK becomes permanently inaccessible, for example because the key encryption material protecting it was lost.
All data that was encrypted under the destroyed key becomes permanently unrecoverable. Each feature that stores encrypted data decides how to handle its own data during the reset: some features drop the encrypted values entirely, while others preserve the rest of the affected data and only clear the values that can no longer be decrypted.
Because this operation causes permanent data loss, it requires the accept_data_loss
query parameter to be set to true.
Query Parameters
-
accept_data_lossbooleanrequired Acknowledge that resetting the project encryption key permanently destroys all data that was encrypted under the current key. The request fails if this is not set to
true.-
master_timeoutstring Duration · default: 30s The period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.
-
timeoutstring Duration · default: 30s The period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.
Response
-
acknowledgedbooleanrequired -
For a successful response, this value is always true. On failure, an exception is returned instead.