---
type: api
title: Rotate a key for encrypted saved objects
description: Superuser role required.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-rotateencryptionkey
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-rotateencryptionkey
products:
  - Kibana
---

# Rotate a key for encrypted saved objects

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/encrypted_saved_objects/_rotate_key`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

## Description

Superuser role required.

If a saved object cannot be decrypted using the primary encryption key, then Kibana will attempt to decrypt it using the specified decryption-only keys. In most of the cases this overhead is negligible, but if you're dealing with a large number of saved objects and experiencing performance issues, you may want to rotate the encryption key.

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

## Query String Parameters

- `batch_size` (number · default: 10000)
  Specifies a maximum number of saved objects that Kibana can process in a single batch. Bulk key rotation is an iterative process since Kibana may not be able to fetch and process all required saved objects in one go and splits processing into consequent batches. By default, the batch size is 10000, which is also a maximum allowed value.
- `type` (string)
  Limits encryption key rotation only to the saved objects with the specified type. By default, Kibana tries to rotate the encryption key for all saved object types that may contain encrypted attributes.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `failed` (number)
  Indicates the number of the saved objects that were still encrypted with one of the old encryption keys that Kibana failed to re-encrypt with the primary key.
- `successful` (number)
  Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.

NOTE: In most cases, `total` will be greater than `successful` even if `failed` is zero. The reason is that Kibana may not need or may not be able to rotate encryption keys for all encrypted saved objects.
- `total` (number)
  Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.
#### `400`

Bad request

`application/json`

- `error` (enum)
  Values: `Bad Request`
- `message` (string)
- `statusCode` (enum)
  Values: `400`
#### `429`

Already in progress.

`application/json`

Type: `object`

## Code Examples

#### Console

```console
POST /api/encrypted_saved_objects/_rotate_key
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/encrypted_saved_objects/_rotate_key"
```

## Response Examples

#### Encryption key rotation using default parameters.

```json
{
  "failed": 0,
  "successful": 300,
  "total": 1000
}
```