curl --request POST \
--url https://api.example.com/api/connectors/tokens/reencrypt \
--header 'x-api-key: <api-key>'import requests
url = "https://api.example.com/api/connectors/tokens/reencrypt"
headers = {"x-api-key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.example.com/api/connectors/tokens/reencrypt', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/connectors/tokens/reencrypt",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/connectors/tokens/reencrypt"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/connectors/tokens/reencrypt")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/connectors/tokens/reencrypt")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": {
"cas_retries": 123,
"clients_failed": 123,
"clients_reencrypted": 123,
"clients_scanned": 123,
"clients_skipped": 123,
"failed": 123,
"failed_client_row_ids": [
"<string>"
],
"failed_connection_ids": [
"<string>"
],
"reencrypted": 123,
"scanned": 123,
"skipped": 123
}
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Re-encrypt connector tokens and client credentials under the current KEK
Re-encrypt every stored connector token and client credential under the current CONNECTORS_KEK.
The KEK-rotation convergence sweep: after CONNECTORS_KEK is rotated (new current
key, old key moved to CONNECTORS_KEK_PREVIOUS), this rewrites every connection blob
and every stored OAuth client blob still under a previous key so the previous key can
be retired. Idempotent — a blob already under the current key is skipped. A blob no
configured key can open is counted and named in failed_connection_ids /
failed_client_row_ids, never silently dropped. A missing/malformed
current CONNECTORS_KEK is a deployment-wide config fault and surfaces as a named
NotSupportedError (501), never an unnamed 500.
curl --request POST \
--url https://api.example.com/api/connectors/tokens/reencrypt \
--header 'x-api-key: <api-key>'import requests
url = "https://api.example.com/api/connectors/tokens/reencrypt"
headers = {"x-api-key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.example.com/api/connectors/tokens/reencrypt', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/connectors/tokens/reencrypt",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/connectors/tokens/reencrypt"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/connectors/tokens/reencrypt")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/connectors/tokens/reencrypt")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": {
"cas_retries": 123,
"clients_failed": 123,
"clients_reencrypted": 123,
"clients_scanned": 123,
"clients_skipped": 123,
"failed": 123,
"failed_client_row_ids": [
"<string>"
],
"failed_connection_ids": [
"<string>"
],
"reencrypted": 123,
"scanned": 123,
"skipped": 123
}
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Authorizations
Response
Success.
The KEK re-encrypt sweep's outcome, for the connection tokens and the stored client credentials.
scanned connection blobs split into reencrypted (rewritten under the current KEK), skipped
(already under the current key), and failed (no configured key could open them, or compare-and-set
contention was not resolved); failed_connection_ids names each failed connection. The clients_*
counts split the stored OAuth client blobs the same way, failed_client_row_ids naming each failed
client row. cas_retries counts the compare-and-set retries concurrent writers forced in both tables.
Show child attributes
Show child attributes

