Rotate key
Samvaad calls this endpoint to generate a new Data Encryption Key (DEK). This is part of the key rotation strategy. You must return both the new plaintext DEK and its encrypted form (the EDEK) along with the key-alias used for encyption. Samvaad will use this new key for all subsequent encryption operations for the associated data.
Authentication
AuthorizationBearer
A token sent in the `Authorization` header.
This can be one of two types:
1. A short-lived **JWT** obtained from the `/auth` endpoint.
2. A long-lived, static **API Key** provided during setup.
In both cases, the header format is `Authorization: Bearer <token>`.
Headers
x-request-id
A unique identifier for this specific API call, generated by the client (Samvaad).
x-trace-id
An identifier to trace a single request across multiple services.
x-request-timestamp
The ISO 8601 timestamp of when the client sent the request.
Response headers
X-Request-Id
A unique identifier for the request, generated by your service.
X-Trace-Id
The identifier for an end-to-end operation, passed from the client to be echoed in the response.
X-Request-Duration
The time in milliseconds the server took to process the request.
X-Response-Timestamp
The ISO 8601 timestamp of when the response was generated.
Response
New DEK successfully generated. Returns the new encrypted and plaintext DEK.
data
The response payload containing the new DEK in both plaintext and encrypted forms.
Errors
400
Bad Request Error
401
Unauthorized Error
422
Unprocessable Entity Error
500
Internal Server Error