Reset the project encryption key

  • POST /_encryption/_reset
Auth

Destroy the current project encryption key (PEK) and generate a new one. This is the recovery path for when the on-disk encrypted PEK becomes permanently inaccessible, for example because the key encryption material protecting it was lost.

All data that was encrypted under the destroyed key becomes permanently unrecoverable. Each feature that stores encrypted data decides how to handle its own data during the reset: some features drop the encrypted values entirely, while others preserve the rest of the affected data and only clear the values that can no longer be decrypted.

Because this operation causes permanent data loss, it requires the accept_data_loss query parameter to be set to true.

Query parameters

accept_data_loss boolean required

Acknowledge that resetting the project encryption key permanently destroys all data that was encrypted under the current key. The request fails if this is not set to true.

master_timeout string · default: 30s

The period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

timeout string · default: 30s

The period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.

Response

application/json
acknowledged boolean required

For a successful response, this value is always true. On failure, an exception is returned instead.