Reencrypt Tenant Identity Secrets

POST

https://nico-rest-api.nico.svc.cluster.local/v2/org/:org/nico/site/:siteID/tenant-identity/re-encrypt

Re-wrap stored tenant_identity_config ciphertext with the Site’s current master encryption key (KEK rotation). This is a site-operator operation, not a per-tenant one.

User must have authorization role with PROVIDER_ADMIN suffix in the URL {org}.

Authentication

AuthorizationBearer

export JWT_BEARER_TOKEN="<jwt-bearer-token>"
# Example org name: "acme-inc
export ORG_NAME=<org-name>
# Use the JWT bearer token in your API request auth header:
curl -v -X GET -H "Content-Type: application/json" -H "Authorization: Bearer $JWT_BEARER_TOKEN" https://nico-rest-api.nico.svc.cluster.local/v2/org/$ORG_NAME/nico/user/current

``` export JWT_BEARER_TOKEN="<jwt-bearer-token>" # Example org name: "acme-inc export ORG_NAME=<org-name> # Use the JWT bearer token in your API request auth header: curl -v -X GET -H "Content-Type: application/json" -H "Authorization: Bearer $JWT_BEARER_TOKEN" https://nico-rest-api.nico.svc.cluster.local/v2/org/$ORG_NAME/nico/user/current ```

Path parameters

orgstringRequired

Name of the provider organization authorizing the operation

siteIDstringRequiredformat: "uuid"

ID of the target Site

Request

This endpoint expects an object.

organizationIdstring or nullOptionalformat: "^[A-Za-z0-9_-]+$">=1 character

Optional tenant organization identifier (org), not the tenant’s REST resource UUID or display name. A non-null value must contain one or more ASCII letters, digits, underscores, or hyphens; empty and whitespace-containing strings are rejected, not treated as site-wide scope. The value is matched case-insensitively and is lowercased before the Tenant lookup and before it reaches Core. The tenant must have an allocation and tenant identity configuration on the Site; only that organization’s secrets are re-wrapped. The URL {org} separately identifies the provider authorizing the operation. If omitted or null, every row in the Site’s tenant identity store is processed.

dryRunbooleanOptionalDefaults to false

When true, decrypt and validate only; no changes are written.

Response

Reencryption completed; counters and any per-field failures are reported in the body.

rowsExaminedinteger

Number of rows examined.

rowsUpdatedinteger

Number of rows re-wrapped with the current key.

rowsSkippedAllOnTargetinteger

Number of rows skipped because all fields were already on the target key.

fieldsReencryptedinteger

Number of individual fields re-wrapped.

fieldsSkippedOnTargetinteger

Number of fields skipped because they were already on the target key.

rowsFailedinteger

Number of rows with at least one field that failed to re-wrap.

failureslist of objects

Per-field re-wrap failures; an empty array when none occurred.

currentEncryptionKeyIdstring

Site machine_identity.current_encryption_key_id used as the re-wrap target.

Errors

400

Bad Request Error

403

Forbidden Error

404

Not Found Error

500

Internal Server Error

503

Service Unavailable Error

504

Gateway Timeout Error