# Activate encryption configuration

Revalidates KMS access and atomically selects this configuration for new encryption. Other configurations are retained for decryption. Repeated activation revalidates the selected configuration. Requires customer-managed keys to be enabled.

Required permission: Account > Admin > Encryption > Manage

**Path parameters:**

{object}
- `encryptionConfigurationId`: (string) (required) Name-derived ID of the encryption configuration.

**Response body:**

{object}
- `data`: {object}
  - `id`: (string) (required) The name-derived ID of the encryption configuration.
  - `name`: (string) (required)
  - `description`: (string)
  - `createdAt`: (string) (required) (format: date-time)
  - `active`: (boolean) (required)
  - `firstActivatedAt`: (string) Time of first activation; absent for unused configurations. (format: date-time)
  - `envelope`: (multiple options) {object}
     - `provider`: (string) (required) (enum: aws)
     - `region`: (string) (required)
     - `keyId`: (string) (required)
     - `externalId`: (string) External ID used for cross-account role assumption.
     - `options`: {object}
       - `maxUses`: (integer) Maximum encryption uses per data key.
       - `maxAgeMs`: (integer) Maximum data-key lifetime in milliseconds.
       - `cacheTtlSeconds`: (integer) Decrypted data-key cache TTL in seconds. | {object}
     - `provider`: (string) (required) (enum: gcp)
     - `projectId`: (string) (required)
     - `location`: (string) (required)
     - `keyRing`: (string) (required)
     - `cryptoKey`: (string) (required)
     - `serviceAccountEmail`: (string) Northflank-generated identity to grant access to the KMS key.
     - `keyfileServiceAccountEmail`: (string) Service-account email from the supplied key file.
     - `options`: {object}
       - `maxUses`: (integer) Maximum encryption uses per data key.
       - `maxAgeMs`: (integer) Maximum data-key lifetime in milliseconds.
       - `cacheTtlSeconds`: (integer) Decrypted data-key cache TTL in seconds. | {object}
     - `provider`: (string) (required) (enum: azure)
     - `keyId`: (string) (required)
     - `options`: {object}
       - `maxUses`: (integer) Maximum encryption uses per data key.
       - `maxAgeMs`: (integer) Maximum data-key lifetime in milliseconds.
       - `cacheTtlSeconds`: (integer) Decrypted data-key cache TTL in seconds. | {object}
     - `provider`: (string) (required) (enum: vault-transit)
     - `address`: (string) (required)
     - `mountPath`: (string)
     - `namespace`: (string)
     - `keyName`: (string) (required)
     - `options`: {object}
       - `maxUses`: (integer) Maximum encryption uses per data key.
       - `maxAgeMs`: (integer) Maximum data-key lifetime in milliseconds.
       - `cacheTtlSeconds`: (integer) Decrypted data-key cache TTL in seconds.
  - `vault`: {object}
    - `version`: (string) (required)

## API reference

POST /v1/encryption/configurations/{encryptionConfigurationId}/activate

POST /v1/teams/{teamId}/encryption/configurations/{encryptionConfigurationId}/activate

### Example Response

200 OK: Encryption configuration after activation.

```json
{
  "data": {
    "id": "production-kms"
  }
}
```

### Example Response

400 Bad Request: Invalid configuration, failed KMS check, or unsupported state transition.

### Example Response

404 Not Found: Encryption configuration not found in this team or organization.

### Example Response

409 Conflict: Concurrent configuration change. Read the current state before retrying.

## CLI reference

$ northflank activate encryption configuration

Options:

- `--encryptionConfigurationId <encryptionConfigurationId>`: Name-derived ID of the encryption configuration.

- `--verbose `: Verbose output

- `--quiet `: No console output

- `-o --output <format>`: Output formatting 

### Example Response

 Encryption configuration after activation.

```json
{
  "id": "production-kms"
}
```

## JavaScript client reference

### Example request



```javascript
await apiClient.activate.encryption.configuration({
  parameters: {
    "encryptionConfigurationId": "production-kms"
  }
});
```

### Example Response

 Encryption configuration after activation.

```json
{
  "data": {
    "id": "production-kms"
  },
  "rawResponse": "...",
  "request": "...",
  "error": "..."
}
```

Previous: [Get encryption configuration](/docs/v1/api/org/encryption-configurations/get-encryption-configuration)

Next: [Deactivate encryption configuration](/docs/v1/api/org/encryption-configurations/deactivate-encryption-configuration)