List encryption configurations

Lists customer-visible encryption configurations and the current encryption mode for the authenticated team or organization, including retained and legacy Vault configurations. Credentials and internal Northflank-managed configurations are never returned.

Required permission

Account > Admin > Encryption > Read

Query parameters

per_page
integer
The number of results to display per request. Maximum of 100 results per page.
page
integer
The page number to access.
cursor
string
The cursor returned from the previous page of results, used to request the next page.

Response body

{object}
Response object.

data
{object} required
Result data.

encryptionConfigurations
[array] required

{object}

id
string required
The name-derived ID of the encryption configuration.
name
string required
description
string
createdAt
string required
active
boolean required
firstActivatedAt
string
Time of first activation; absent for unused configurations.
envelope
(multiple options: anyOf)

{object}

provider
string required
one of
aws
region
string required
keyId
string required
externalId
string
External ID used for cross-account role assumption.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
gcp
projectId
string required
location
string required
keyRing
string required
cryptoKey
string required
serviceAccountEmail
string
Northflank-generated identity to grant access to the KMS key.
keyfileServiceAccountEmail
string
Service-account email from the supplied key file.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
azure
keyId
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
vault-transit
address
string required
mountPath
string
namespace
string
keyName
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

vault
{object}
Legacy Vault configuration.

version
string required

encryptionMode
string required
Encryption used for new writes: legacy Northflank default, Northflank-managed envelope, or a customer-managed configuration. Customer-managed includes envelope KMS and legacy Vault configurations; legacy Vault data cannot be migrated through DEK migration.
one of
default, northflank-envelope, customer-managed

pagination
{object} required
Data about the endpoint pagination.

hasNextPage
boolean required
Is there another page of results available?
cursor
string
The cursor to access the next page of results.
count
number required
The number of results returned by this request.

API

CLI

JS Client

GET /v1/encryption/configurations

GET /v1/teams/{teamId}/encryption/configurations

Example response

200 OK

Encryption configurations.

JSON

{
  "data": {
    "encryptionConfigurations": [
      {
        "id": "production-kms"
      }
    ]
  },
  "pagination": {
    "hasNextPage": false,
    "count": 1
  }
}