Get encryption configuration

Gets safe settings and activation state for a customer-visible encryption configuration. Credentials and key-verification material are never returned.

Required permission

Account > Admin > Encryption > Read

Path parameters

encryptionConfigurationId
string required
Name-derived ID of the encryption configuration.

Response body

{object}
Response object.

data
{object} required
Result data.

id
string required
The name-derived ID of the encryption configuration.
name
string required
description
string
createdAt
string required
active
boolean required
firstActivatedAt
string
Time of first activation; absent for unused configurations.
envelope
(multiple options: anyOf)

{object}

provider
string required
one of
aws
region
string required
keyId
string required
externalId
string
External ID used for cross-account role assumption.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
gcp
projectId
string required
location
string required
keyRing
string required
cryptoKey
string required
serviceAccountEmail
string
Northflank-generated identity to grant access to the KMS key.
keyfileServiceAccountEmail
string
Service-account email from the supplied key file.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
azure
keyId
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
vault-transit
address
string required
mountPath
string
namespace
string
keyName
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

vault
{object}
Legacy Vault configuration.

version
string required

API

CLI

JS Client

GET /v1/encryption/configurations/{encryptionConfigurationId}

GET /v1/teams/{teamId}/encryption/configurations/{encryptionConfigurationId}

Example response

200 OK

Encryption configuration details.

JSON

{
  "data": {
    "id": "production-kms"
  }
}