> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Re-encrypt connector tokens and client credentials under the current KEK

> Re-encrypt every stored connector token and client credential under the current ``CONNECTORS_KEK``.

The KEK-rotation convergence sweep: after ``CONNECTORS_KEK`` is rotated (new current
key, old key moved to ``CONNECTORS_KEK_PREVIOUS``), this rewrites every connection blob
and every stored OAuth client blob still under a previous key so the previous key can
be retired. Idempotent — a blob already under the current key is skipped. A blob no
configured key can open is counted and named in ``failed_connection_ids`` /
``failed_client_row_ids``, never silently dropped. A missing/malformed
current ``CONNECTORS_KEK`` is a deployment-wide config fault and surfaces as a named
``NotSupportedError`` (501), never an unnamed 500.



## OpenAPI

````yaml /openapi.json post /api/connectors/tokens/reencrypt
openapi: 3.1.0
info:
  description: >-
    The operator HTTP surface served under /api/*. The platform's core routes.
    Plugin routes are published by each plugin.
  title: tai42-skeleton API
  version: 23.0.0
servers: []
security: []
paths:
  /api/connectors/tokens/reencrypt:
    post:
      tags:
        - connectors
      summary: Re-encrypt connector tokens and client credentials under the current KEK
      description: >-
        Re-encrypt every stored connector token and client credential under the
        current ``CONNECTORS_KEK``.


        The KEK-rotation convergence sweep: after ``CONNECTORS_KEK`` is rotated
        (new current

        key, old key moved to ``CONNECTORS_KEK_PREVIOUS``), this rewrites every
        connection blob

        and every stored OAuth client blob still under a previous key so the
        previous key can

        be retired. Idempotent — a blob already under the current key is
        skipped. A blob no

        configured key can open is counted and named in
        ``failed_connection_ids`` /

        ``failed_client_row_ids``, never silently dropped. A missing/malformed

        current ``CONNECTORS_KEK`` is a deployment-wide config fault and
        surfaces as a named

        ``NotSupportedError`` (501), never an unnamed 500.
      operationId: post_api_connectors_tokens_reencrypt
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/ConnectorReencryptResult'
                required:
                  - data
                type: object
          description: Success.
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Missing or invalid api key.
        '501':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Error.
      security:
        - ApiKeyAuth: []
components:
  schemas:
    ConnectorReencryptResult:
      description: >-
        The KEK re-encrypt sweep's outcome, for the connection tokens and the
        stored client credentials.


        ``scanned`` connection blobs split into ``reencrypted`` (rewritten under
        the current KEK), ``skipped``

        (already under the current key), and ``failed`` (no configured key could
        open them, or compare-and-set

        contention was not resolved); ``failed_connection_ids`` names each
        failed connection. The ``clients_*``

        counts split the stored OAuth client blobs the same way,
        ``failed_client_row_ids`` naming each failed

        client row. ``cas_retries`` counts the compare-and-set retries
        concurrent writers forced in both tables.
      properties:
        cas_retries:
          title: Cas Retries
          type: integer
        clients_failed:
          title: Clients Failed
          type: integer
        clients_reencrypted:
          title: Clients Reencrypted
          type: integer
        clients_scanned:
          title: Clients Scanned
          type: integer
        clients_skipped:
          title: Clients Skipped
          type: integer
        failed:
          title: Failed
          type: integer
        failed_client_row_ids:
          items:
            type: string
          title: Failed Client Row Ids
          type: array
        failed_connection_ids:
          items:
            type: string
          title: Failed Connection Ids
          type: array
        reencrypted:
          title: Reencrypted
          type: integer
        scanned:
          title: Scanned
          type: integer
        skipped:
          title: Skipped
          type: integer
      required:
        - scanned
        - reencrypted
        - skipped
        - failed
        - failed_connection_ids
        - clients_scanned
        - clients_reencrypted
        - clients_skipped
        - clients_failed
        - failed_client_row_ids
        - cas_retries
      title: ConnectorReencryptResult
      type: object
    Error:
      properties:
        code:
          description: >-
            Stable machine-readable reason a client keys a dedicated error state
            on, present on refusals that opt in (e.g. a 501 not-configured
            refusal). Optional: absent when the error carries only a
            human-readable message.
          type: string
        error:
          type: string
      required:
        - error
      type: object
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: x-api-key
      type: apiKey

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.