Enable Northflank-managed envelope encryption

Opts into Northflank-managed envelope encryption for new writes without supplying a customer KMS configuration. Repeated requests are a no-op once enabled. Existing data is unchanged; DEKs created after opt-in can later be migrated to a customer KMS. If a customer configuration is active, deactivate it to switch to Northflank-managed envelope encryption; no separate opt-in request is needed. Requires customer-managed keys to be enabled.

Required permission

Account > Admin > Encryption > Manage

Response body

{object}
Response object.

data
{object} required
Result data.

encryptionMode
string required
Encryption used for new writes after opt-in.
one of
northflank-envelope
changed
boolean required
False when Northflank-managed envelope encryption was already active.

API

CLI

JS Client

POST /v1/encryption/northflank-managed/activate

POST /v1/teams/{teamId}/encryption/northflank-managed/activate

Example response

200 OK

Northflank-managed envelope encryption enabled.

JSON

Example response

400 Bad Request

Northflank-managed key validation failed.

Example response

409 Conflict

A customer encryption configuration is active, or the configuration changed concurrently. Deactivating an active customer configuration switches to Northflank-managed envelope encryption without a separate opt-in request.