Re-encrypt a JWE General JSON Serialization payload

post

https://staging.ankatech.co/api/v3/crypto/reencrypt

Decrypts the incoming JWE under the kid in its
protected header (or under sourceKidOverride if the
header has no kid) and re-encrypts the plaintext
under newKid. The result is a fresh JWE General JSON
Serialization (RFC 7516 §7.2) payload — single-recipient for
SIMPLE target keys, multi-recipient for COMPOSITE hybrid targets.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

JSON object with:
• jweToken – the source JWE General JSON Serialization
(RFC 7516 §7.2) payload to re-encrypt.
• newKid – key ID for the target public key.
• sourceKidOverride – optional fallback decrypt-kid
for legacy payloads whose protected header omits kid.

Request body for JWE re-encryption. Carries the source RFC 7516 §7.2
General JSON Serialization payload plus the target key identifier
(newKid). The optional sourceKidOverride
is the fallback decrypt-kid for legacy payloads that omit
kid from the protected header.

jweToken

object

required

Source JWE General JSON Serialization payload to re-encrypt.

newKid

string

required

length between 0 and 255

^[A-Za-z0-9._:-]+$

Target key identifier that will protect the new JWE.

sourceKidOverride

string

length between 0 and 255

^[A-Za-z0-9._:-]+$

Optional fallback key identifier used when the incoming JWE
protected header has no kid. MUST NOT be provided
when the header already includes a kid.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

200Re-encryption succeeded

400Bad Request: • The JWE header is either missing its kid or both a kid and sourceKidOverride have been supplied simultaneously, which is not allowed, OR • Key does not support the requested operation (decrypt or encrypt)

404Not Found: source or destination key missing or unsuitable

409Conflict: key state invalid (e.g. revoked, suspended)

413Payload Too Large: envelope or re-encrypted output exceeds the configured maximum size

422Unprocessable Entity: malformed JWE General JSON Serialization payload

500Internal Server Error: unexpected crypto failure

503Service Unavailable: the tenant's key-protection backend is bound but not currently usable. Transient - retry after the Retry-After interval. The body is oracle-safe and names no backend, token, slot, PIN or vendor.