Re-encrypt data (streaming).

post

https://staging.ankatech.co/api/v3/crypto/stream/reencrypt

Decrypts the incoming ciphertext using oldKid (from the JWE header)
and re-encrypts it on the fly with newKid (provided via query parameter).
Returns a multipart/mixed response (PRD §64): the new JWE header part,
the re-encrypted ciphertext part, and a trailing application/json
StreamVerdict part emitted AFTER the source AES-GCM tag is verified at

end-of-stream (an INVALID verdict signals a tampered source; no committed
ciphertext is promotable). All key-selection metadata is returned in the single
Crypto-Policy-Info response header.

Supports all key type combinations:

• SIMPLE → SIMPLE (single recipient → single recipient)

• SIMPLE → COMPOSITE (single recipient → multiple recipients)

• COMPOSITE → COMPOSITE (multiple recipients → multiple recipients)

• COMPOSITE → SIMPLE (multiple recipients → single recipient)

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

newKid

string

required

KID of the key the payload is re-encrypted TO.

sourceKidOverride

string

KID of the key the payload is decrypted FROM. Required only for a legacy envelope whose header carries no kid; otherwise the header's own kid is used.

Body Params

Sequential multipart body — the parts are read in the order they arrive and the server never buffers the payload.

header MUST be sent before file. A file-first body is rejected with 400 application/problem+json, type .../errors/multipart-part-order. This is a property of streaming, not a policy: the server cannot look ahead past a 512 MiB payload to find the part that tells it what to do with it.

header is bounded at 2 MiB; file has no size limit.

header

object

required

Detached General-JSON JWET header used by the streaming
re-encryption endpoint.

The kid inside recipients[0].header
is intentionally absent.

file

required

Original ciphertext envelope (binary).

Headers

string

enum

Defaults to application/problem+json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

multipart/mixed

application/problem+json

200multipart/mixed: new JWE header + re-encrypted ciphertext + trailing StreamVerdict (VALID/INVALID after the source AES-GCM tag check).

400Malformed multipart, invalid JWE, or key does not support the requested operation. PQC session transport is also refused here: an X-PQC-Transport: true or X-PQC-Session header on this route yields .../errors/pqc-transport-not-available-for-streaming, refused before any body byte is read.

401Unauthorized.

404KID not found or unsuitable.

409Conflict: the tenant's key-protection backend is not configured - never declared, or declared but not yet bound. Durable: complete the setup rather than retrying. No Retry-After is sent.

413Payload Too Large: the small part (metadata or header) exceeded its 2 MiB cap. file has NO size limit — this response never refers to the payload.

429Too Many Requests: the streaming concurrency bound is full, either globally or for this tenant. Retry-After carries the suggested delay in seconds. This bound replaced the edge client_max_body_size ceiling PRD §130 removed, so it is emittable on every streaming endpoint.

500Unexpected failure.

503Service Unavailable: the tenant's key-protection backend is bound but not currently usable. Transient - retry after the Retry-After interval. The body is oracle-safe and names no backend, token, slot, PIN or vendor.