---
type: api
title: Reset the project encryption key
description: Destroy the current project encryption key (PEK) and generate a new one.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-encryption-reset
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-encryption-reset
products:
  - Elasticsearch
---

# Reset the project encryption key

Availability: 9.5+

## Paths

- `POST` `/_encryption/_reset`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#bearerauth)

## Description

Destroy the current project encryption key (PEK) and generate a new one.
This is the recovery path for when the on-disk encrypted PEK becomes permanently
inaccessible, for example because the key encryption material protecting it was lost.

All data that was encrypted under the destroyed key becomes permanently unrecoverable.
Each feature that stores encrypted data decides how to handle its own data during the
reset: some features drop the encrypted values entirely, while others preserve the rest
of the affected data and only clear the values that can no longer be decrypted.

Because this operation causes permanent data loss, it requires the `accept_data_loss`
query parameter to be set to `true`.

## Query String Parameters

- `accept_data_loss` (boolean)
  Acknowledge that resetting the project encryption key permanently destroys all data
that was encrypted under the current key.
The request fails if this is not set to `true`.
- `master_timeout` (string Duration · default: 30s)
  The period to wait for a connection to the master node.
If no response is received before the timeout expires, the request fails and returns an error.
- `timeout` (string Duration · default: 30s)
  The period to wait for a response.
If no response is received before the timeout expires, the request fails and returns an error.

## Response

`application/json`

- `acknowledged` (boolean)
  For a successful response, this value is always true. On failure, an exception is returned instead.
## Code Examples

#### Console

```console
POST /_encryption/_reset?accept_data_loss=true
```

#### JavaScript

```javascript
const response = await client.encryption.reset({
  accept_data_loss: "true",
});
```

#### Python

```python
resp = client.encryption.reset(
    accept_data_loss=True,
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_encryption/_reset?accept_data_loss=true" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.encryption().reset(r -> r
    .acceptDataLoss(true)
);
```

#### PHP

```php
$resp = $client->encryption()->reset([
    "accept_data_loss" => "true",
]);
```

#### Ruby

```ruby
response = client.encryption.reset(
  accept_data_loss: "true"
)
```

## Response Examples

#### Reset the project encryption key

A successful response from `POST /_encryption/_reset?accept_data_loss=true`.

```json
{
  "acknowledged": true
}
```