Reencrypt Tenant Identity Secrets
Re-wrap stored tenant_identity_config ciphertext with the Site’s
current master encryption key (KEK rotation). This is a
site-operator operation, not a per-tenant one.
User must have authorization role with PROVIDER_ADMIN suffix in the URL {org}.
Authentication
export JWT_BEARER_TOKEN="<jwt-bearer-token>"
# Example org name: "acme-inc
export ORG_NAME=<org-name>
# Use the JWT bearer token in your API request auth header:
curl -v -X GET -H "Content-Type: application/json" -H "Authorization: Bearer $JWT_BEARER_TOKEN" https://nico-rest-api.nico.svc.cluster.local/v2/org/$ORG_NAME/nico/user/current
Path parameters
Request
Optional tenant organization identifier (org), not the tenant’s
REST resource UUID or display name. A non-null value must contain
one or more ASCII letters, digits, underscores, or hyphens; empty
and whitespace-containing strings are rejected, not treated as
site-wide scope. The value is matched case-insensitively and is
lowercased before the Tenant lookup and before it reaches Core. The
tenant must be associated with and have tenant identity configuration on
the Site; only that organization’s secrets are re-wrapped. The URL
{org} separately identifies the provider authorizing the
operation. If omitted or null, every row in the Site’s tenant
identity store is processed.
When true, decrypt and validate only; no changes are written.
Response
Reencryption completed; counters and any per-field failures are reported in the body.
Number of rows re-wrapped with the current key.
Number of individual fields re-wrapped.
Number of rows with at least one field that failed to re-wrap.
Per-field re-wrap failures; an empty array when none occurred.
Site machine_identity.current_encryption_key_id used as the re-wrap target.