Update encryption configuration settings

Replaces key coordinates and credentials after validating them. The provider cannot change. Previously activated configurations must still reach the same key; unused configurations may change keys. DEK options are preserved and must be updated through the options endpoint. Requires customer-managed keys to be enabled.

Required permission

Account > Admin > Encryption > Manage

Path parameters

encryptionConfigurationId
string required
Name-derived ID of the encryption configuration.

Request body

{object}

envelope
(multiple options: anyOf) required
Replacement provider settings and credentials. Update options separately.

{object}

provider
required
one of
gcp
projectId
string required
pattern
^[a-z][a-z0-9-]{4,28}[a-z0-9]$
location
string required
max length
63
pattern
^[a-z0-9-]+$
keyRing
string required
max length
63
pattern
^[A-Za-z0-9_-]+$
cryptoKey
string required
max length
63
pattern
^[A-Za-z0-9_-]+$
credentials
{object}

keyfileJson
string

{object}

provider
required
one of
aws
region
string required
keyId
string required
credentials
{object} required

accessKey
string
secretKey
string
roleArn
string
externalId
string

{object}

provider
required
one of
azure
keyId
string required
max length
2048
pattern
^[^?#@\s\\%]+$
credentials
{object} required

tenantId
string required
clientId
string required
secret
string required

{object}

provider
required
one of
vault-transit
address
string required
max length
2048
pattern
^[^?#@\s\\%]+$
mountPath
string
max length
256
pattern
^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$
namespace
string
max length
256
pattern
^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$
keyName
string required
max length
256
pattern
^(?!\.+$)[A-Za-z0-9_.-]+$
credentials
{object} required

token
string required
max length
4096

Response body

{object}
Response object.

data
{object} required
Result data.

id
string required
The name-derived ID of the encryption configuration.
name
string required
description
string
createdAt
string required
active
boolean required
firstActivatedAt
string
Time of first activation; absent for unused configurations.
envelope
(multiple options: anyOf)

{object}

provider
string required
one of
aws
region
string required
keyId
string required
externalId
string
External ID used for cross-account role assumption.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
gcp
projectId
string required
location
string required
keyRing
string required
cryptoKey
string required
serviceAccountEmail
string
Northflank-generated identity to grant access to the KMS key.
keyfileServiceAccountEmail
string
Service-account email from the supplied key file.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
azure
keyId
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
vault-transit
address
string required
mountPath
string
namespace
string
keyName
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

vault
{object}
Legacy Vault configuration.

version
string required

API

CLI

JS Client

PUT /v1/encryption/configurations/{encryptionConfigurationId}/settings

PUT /v1/teams/{teamId}/encryption/configurations/{encryptionConfigurationId}/settings

Example request

Request body

curl --header "Content-Type: application/json" \
  --header "Authorization: Bearer NORTHFLANK_API_TOKEN" \
  --request PUT \
  --data '{"envelope":{"provider":"gcp","projectId":"string","location":"string","keyRing":"string","cryptoKey":"string"}}' \
  https://api.northflank.com/v1/encryption/configurations/{encryptionConfigurationId}/settings

Example response

200 OK

Updated configuration without credentials.

JSON

{
  "data": {
    "id": "production-kms"
  }
}

Example response

400 Bad Request

Invalid configuration, failed KMS check, or unsupported state transition.

Example response

404 Not Found

Encryption configuration not found in this team or organization.

Example response

409 Conflict

Concurrent configuration change. Read the current state before retrying.