> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Re-encrypt connector tokens under the current KEK

> Re-encrypt every stored connector token blob under the current ``CONNECTORS_KEK``.

The KEK-rotation convergence sweep: after ``CONNECTORS_KEK`` is rotated (new current
key, old key moved to ``CONNECTORS_KEK_PREVIOUS``), this rewrites every blob still
under a previous key so the previous key can be retired. Idempotent — a blob already
under the current key is skipped. A blob no configured key can open is counted and
named in ``failed_connection_ids``, never silently dropped. A missing/malformed
current ``CONNECTORS_KEK`` is a deployment-wide config fault and surfaces as a named
``NotSupportedError`` (501), never an unnamed 500.



## OpenAPI

````yaml /openapi.json post /api/connectors/tokens/reencrypt
openapi: 3.1.0
info:
  description: The operator HTTP surface served under /api/*.
  title: tai42-skeleton API
  version: 14.0.2
servers: []
security: []
paths:
  /api/connectors/tokens/reencrypt:
    post:
      tags:
        - connectors
      summary: Re-encrypt connector tokens under the current KEK
      description: >-
        Re-encrypt every stored connector token blob under the current
        ``CONNECTORS_KEK``.


        The KEK-rotation convergence sweep: after ``CONNECTORS_KEK`` is rotated
        (new current

        key, old key moved to ``CONNECTORS_KEK_PREVIOUS``), this rewrites every
        blob still

        under a previous key so the previous key can be retired. Idempotent — a
        blob already

        under the current key is skipped. A blob no configured key can open is
        counted and

        named in ``failed_connection_ids``, never silently dropped. A
        missing/malformed

        current ``CONNECTORS_KEK`` is a deployment-wide config fault and
        surfaces as a named

        ``NotSupportedError`` (501), never an unnamed 500.
      operationId: post_api_connectors_tokens_reencrypt
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/ConnectorReencryptResult'
                required:
                  - data
                type: object
          description: Success.
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Missing or invalid api key.
        '501':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Error.
      security:
        - ApiKeyAuth: []
components:
  schemas:
    ConnectorReencryptResult:
      description: >-
        The KEK re-encrypt sweep's outcome. ``scanned`` blobs split into
        ``reencrypted``

        (rewritten under the current KEK), ``skipped`` (already under the
        current key), and

        ``failed`` (no configured key could open them, or compare-and-set
        contention was not

        resolved). ``failed_connection_ids`` names each failed connection;
        ``cas_retries``

        counts compare-and-set retries forced by concurrent refreshes.
      properties:
        cas_retries:
          title: Cas Retries
          type: integer
        failed:
          title: Failed
          type: integer
        failed_connection_ids:
          items:
            type: string
          title: Failed Connection Ids
          type: array
        reencrypted:
          title: Reencrypted
          type: integer
        scanned:
          title: Scanned
          type: integer
        skipped:
          title: Skipped
          type: integer
      required:
        - scanned
        - reencrypted
        - skipped
        - failed
        - failed_connection_ids
        - cas_retries
      title: ConnectorReencryptResult
      type: object
    Error:
      properties:
        code:
          description: >-
            Stable machine-readable reason a client keys a dedicated error state
            on, present on refusals that opt in (e.g. a 501 not-configured
            refusal). Optional: absent when the error carries only a
            human-readable message.
          type: string
        error:
          type: string
      required:
        - error
      type: object
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: x-api-key
      type: apiKey

````