<!-- llms.txt: https://workos.com/llms.txt -->

# Encryption key management

The key management APIs can be used to generate isolated encryption keys for local encryption and decryption operations.

## Create a data key

Generate a data key for local encryption based on the provided key context.

The encrypted data key **MUST** be stored by the application, as it cannot be retrieved after generation.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/vault/v1/keys/data-key" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "context": {
            "organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"
        }
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

await workos.vault.createDataKey({
  context: { organizationId: 'org_01EHZNVPK3SFK441A1RGBFSHRT' },
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.vault.create_data_key(context: { organization_id: "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P" })
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.vault.create_data_key(
    context={"organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"}
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Vault().CreateDataKey(context.Background(), &workos.VaultCreateDataKeyParams{
		Context: map[string]any{"organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"},
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->vault()
    ->createDataKey(
        context: ["organization_id" => "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"],
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.vault.VaultApi.CreateDataKeyOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

CreateDataKeyOptions options =
    CreateDataKeyOptions.builder()
        .context(Map.of("organization_id", "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"))
        .build();

workos.vault.createDataKey(options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Vault.CreateDataKeyAsync(new VaultCreateDataKeyOptions {
    Context =
        new Dictionary<string, object> {
            { "organization_id", "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P" },
        },
});
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::vault::CreateDataKeyParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .vault()
        .create_data_key(
            CreateDataKeyParams {
                context: serde_json::json!({ "organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P" }),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "context": {
    "organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"
  },
  "data_key": "DR9idtey9MpMrA1VRFrz30HB1yNgL2PoHZyjAkFeWgg=",
  "encrypted_keys": "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
  "id": "bf51ccec-78b4-5200-b383-35730e71ef61"
}
```

:::

## Decrypt a data key

Decrypt a previously encrypted data key from WorkOS Vault.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/vault/v1/keys/decrypt" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "keys": "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj"
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

await workos.vault.decryptDataKey({
  keys: 'V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJDU2OWYyNDdjLTFkY2QtNDQzMC04MjRmLWQ3N2MxZDNhZmU1NgF0NTY5ZjI0N2MtMWRjZC00NDMwLTgyNGYtZDc3YzFkM2FmZTU2pWvKMbiudRtpyjYexZCX/K9ggOEioUw2c0B62kEh+oj68uuAJQWNfPKTC+mapgJPxdnMKniKxzI7a6zmHgXTK7dSOmAzJBDhDgtEiaqyKTM=',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.vault.create_decrypt(keys: "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.vault.create_decrypt(
    keys="V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj"
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Vault().CreateDecrypt(context.Background(), &workos.VaultCreateDecryptParams{
		Keys: "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->vault()
    ->createDecrypt(
        keys: "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.vault.VaultApi.CreateDecryptOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

CreateDecryptOptions options =
    CreateDecryptOptions.builder()
        .keys(
            "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj")
        .build();

workos.vault.createDecrypt(options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Vault.CreateDecryptAsync(new VaultCreateDecryptOptions {
    Keys =
        "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
});
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::vault::CreateDecryptParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .vault()
        .create_decrypt(
            CreateDecryptParams {
                keys: "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "data_key": "DR9idtey9MpMrA1VRFrz30HB1yNgL2PoHZyjAkFeWgg=",
  "id": "bf51ccec-78b4-5200-b383-35730e71ef61"
}
```

:::

## Decrypt data

Decrypt data that was previously encrypted with Vault. The data key in the ciphertext is decrypted using the Vault API and used to decrypt the remaining data. The decryption operations happen locally and neither the plaintext nor encrypted data are sent over the network.

:::code-group

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

await workos.vault.decrypt(
  'J/HGPfUVMxY1GGvViE3MDe31fOU9BuIUja0/ekDOraRaA3v13YRnwLvDWbnSPjWjzgFXT1MuRUtNLnYxAGQ0ZWNkYjkwLTMwZmMtNTYwYS04MGM0LWExYWQ2N2IyYjUzYwEBMQEkMDIxOTlmM2EtMjE4NS00ODg4LTkzNzgtZTA0ODAxOGRkN2M1AXQwMjE5OWYzYS0yMTg1LTQ4ODgtOTM3OC1lMDQ4MDE4ZGQ3YzWdnLz+Zc8ySzyfZYOVKmuz2k3rNFa6MAihjl9+5u6fiXOjmavMBUcSg0wLFDxznK0UToroLyHDaPOnpN8MTlKO8lN1Qz4KSCpQWawThmSIZ2wwwiR1jY3AOo9P/YygzE5v',
);
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

workos_client = WorkOSClient(api_key="sk_example_123456789")

plaintext = workos_client.vault.decrypt(
    encrypted_data="J/HGPfUVMxY1GGvViE3MDe31fOU9BuIUja0/ekDOraRaA3v13YRnwLvDWbnSPjWjzgFXT1MuRUtNLnYxAGQ0ZWNkYjkwLTMwZmMtNTYwYS04MGM0LWExYWQ2N2IyYjUzYwEBMQEkMDIxOTlmM2EtMjE4NS00ODg4LTkzNzgtZTA0ODAxOGRkN2M1AXQwMjE5OWYzYS0yMTg1LTQ4ODgtOTM3OC1lMDQ4MDE4ZGQ3YzWdnLz+Zc8ySzyfZYOVKmuz2k3rNFa6MAihjl9+5u6fiXOjmavMBUcSg0wLFDxznK0UToroLyHDaPOnpN8MTlKO8lN1Qz4KSCpQWawThmSIZ2wwwiR1jY3AOo9P/YygzE5v"
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"
	"fmt"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	plaintext, err := client.Vault().Decrypt(
		context.Background(),
		"J/HGPfUVMxY1GGvViE3MDe31fOU9BuIUja0/ekDOraRaA3v13YRnwLvDWbnSPjWjzgFXT1MuRUtNLnYxAGQ0ZWNkYjkwLTMwZmMtNTYwYS04MGM0LWExYWQ2N2IyYjUzYwEBMQEkMDIxOTlmM2EtMjE4NS00ODg4LTkzNzgtZTA0ODAxOGRkN2M1AXQwMjE5OWYzYS0yMTg1LTQ4ODgtOTM3OC1lMDQ4MDE4ZGQ3YzWdnLz+Zc8ySzyfZYOVKmuz2k3rNFa6MAihjl9+5u6fiXOjmavMBUcSg0wLFDxznK0UToroLyHDaPOnpN8MTlKO8lN1Qz4KSCpQWawThmSIZ2wwwiR1jY3AOo9P/YygzE5v",
		"",
	)
	if err != nil {
		panic(err)
	}

	fmt.Println(plaintext)
}
```

```bash language="curl" title="Response" tab="2"
"keep it secret, keep it safe"
```

:::

## Encrypt data

Perform a local encryption option. A data key is generated based on the provided key context and used to encrypt the data. The operation happens locally and neither the plaintext nor encrypted data are sent over the network.

:::code-group

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

await workos.vault.encrypt('keep it secret, keep it safe', {
  organizationId: 'org_01EHZNVPK3SFK441A1RGBFSHRT',
});
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

workos_client = WorkOSClient(api_key="sk_example_123456789")

ciphertext = workos_client.vault.encrypt(
    data="keep it secret, keep it safe",
    key_context={"organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT"},
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"
	"fmt"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	ciphertext, err := client.Vault().Encrypt(
		context.Background(),
		"keep it secret, keep it safe",
		map[string]string{"organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT"},
		"",
	)
	if err != nil {
		panic(err)
	}

	fmt.Println(ciphertext.EncryptedData)
}
```

```bash language="curl" title="Response" tab="2"
"J/HGPfUVMxY1GGvViE3MDe31fOU9BuIUja0/ekDOraRaA3v13YRnwLvDWbnSPjWjzgFXT1MuRUtNLnYxAGQ0ZWNkYjkwLTMwZmMtNTYwYS04MGM0LWExYWQ2N2IyYjUzYwEBMQEkMDIxOTlmM2EtMjE4NS00ODg4LTkzNzgtZTA0ODAxOGRkN2M1AXQwMjE5OWYzYS0yMTg1LTQ4ODgtOTM3OC1lMDQ4MDE4ZGQ3YzWdnLz+Zc8ySzyfZYOVKmuz2k3rNFa6MAihjl9+5u6fiXOjmavMBUcSg0wLFDxznK0UToroLyHDaPOnpN8MTlKO8lN1Qz4KSCpQWawThmSIZ2wwwiR1jY3AOo9P/YygzE5v"
```

:::

## Rekey a data key

Re-encrypt an existing data key using the provided key context.

Use this endpoint to migrate data keys from one key context to another without re-encrypting the underlying data.

If the encrypted data key includes multiple key entries, Vault decrypts the data key with the first entry it can decrypt and re-encrypts it using the provided key context.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/vault/v1/keys/rekey" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "context": {
            "organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"
        },
        "encrypted_keys": "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj"
    }
BODY
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.vault.create_rekey(
  context: { organization_id: "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P" },
  encrypted_keys: "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.vault.create_rekey(
    context={"organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"},
    encrypted_keys="V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Vault().CreateRekey(context.Background(), &workos.VaultCreateRekeyParams{
		Context:       map[string]any{"organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"},
		EncryptedKeys: "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->vault()
    ->createRekey(
        context: ["organization_id" => "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"],
        encryptedKeys: "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.vault.VaultApi.CreateRekeyOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

CreateRekeyOptions options =
    CreateRekeyOptions.builder()
        .context(Map.of("organization_id", "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"))
        .encryptedKeys(
            "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj")
        .build();

workos.vault.createRekey(options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Vault.CreateRekeyAsync(new VaultCreateRekeyOptions {
    Context =
        new Dictionary<string, object> {
            { "organization_id", "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P" },
        },
    EncryptedKeys =
        "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
});
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::vault::CreateRekeyParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .vault()
        .create_rekey(
            CreateRekeyParams {
                context: serde_json::json!({ "organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P" }),
                encrypted_keys: "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "context": {
    "organization_id": "org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"
  },
  "data_key": "DR9idtey9MpMrA1VRFrz30HB1yNgL2PoHZyjAkFeWgg=",
  "encrypted_keys": "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj",
  "id": "bf51ccec-78b4-5200-b383-35730e71ef61"
}
```

:::

### POST /vault/v1/keys/data-key

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `context` | object | Yes | Map of values used to determine the encryption key. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `context` | object | Map of values used to determine the encryption key. |
| `data_key` | string | Base64-encoded data encryption key. |
| `encrypted_keys` | string | Base64-encoded encrypted data key blob. |
| `id` | string | Unique identifier for the generated data key. |

### POST /vault/v1/keys/decrypt

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `keys` | string | Yes | Base64-encoded encrypted data key to decrypt. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `data_key` | string | Base64-encoded decrypted data key. |
| `id` | string | Unique identifier of the decrypted data key. |

### POST /vault/v1/keys/rekey

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `context` | object | Yes | Map of values used to determine the new encryption key. |
| `encrypted_keys` | string | Yes | The encrypted data key returned by Create a data key or a previous Rekey call. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `context` | object | Map of values used to determine the encryption key. |
| `data_key` | string | Base64-encoded data encryption key. |
| `encrypted_keys` | string | The encrypted data key returned by Create a data key or a previous Rekey call. |
| `id` | string | Unique identifier for the generated data key. |