Deactivate encryption configuration

Switches new encryption to Northflank-managed envelope encryption. Retains the old configuration for decryption and does not migrate existing data. Only the active configuration can be deactivated; repeated requests fail once it is inactive. Requires customer-managed keys to be enabled.

Required permission

Account > Admin > Encryption > Manage

Path parameters

encryptionConfigurationId
string required
Name-derived ID of the encryption configuration.

Response body

{object}
Response object.

data
{object} required
Result data.

id
string required
The name-derived ID of the encryption configuration.
name
string required
description
string
createdAt
string required
active
boolean required
firstActivatedAt
string
Time of first activation; absent for unused configurations.
envelope
(multiple options: anyOf)

{object}

provider
string required
one of
aws
region
string required
keyId
string required
externalId
string
External ID used for cross-account role assumption.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
gcp
projectId
string required
location
string required
keyRing
string required
cryptoKey
string required
serviceAccountEmail
string
Northflank-generated identity to grant access to the KMS key.
keyfileServiceAccountEmail
string
Service-account email from the supplied key file.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
azure
keyId
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
vault-transit
address
string required
mountPath
string
namespace
string
keyName
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

vault
{object}
Legacy Vault configuration.

version
string required

API

CLI

JS Client

POST /v1/encryption/configurations/{encryptionConfigurationId}/deactivate

POST /v1/teams/{teamId}/encryption/configurations/{encryptionConfigurationId}/deactivate

Example response

200 OK

Retained encryption configuration after deactivation.

JSON

{
  "data": {
    "id": "production-kms"
  }
}

Example response

400 Bad Request

Invalid configuration, failed KMS check, or unsupported state transition.

Example response

404 Not Found

Encryption configuration not found in this team or organization.

Example response

409 Conflict

Concurrent configuration change. Read the current state before retrying.