Re-encrypt data (streaming).

Decrypts the incoming ciphertext using oldKid (from the JWE header)
and re-encrypts it on the fly with newKid (provided via query parameter).
Returns a new multipart/mixed response containing the JWE header and the re-encrypted ciphertext.
All key-selection metadata is returned in the single Crypto-Policy-Info response header.


Supports all key type combinations:

• SIMPLE → SIMPLE (single recipient → single recipient)

• SIMPLE → COMPOSITE (single recipient → multiple recipients)

• COMPOSITE → COMPOSITE (multiple recipients → multiple recipients)

• COMPOSITE → SIMPLE (multiple recipients → single recipient)

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Query Params
string
required

Public-key kid for the new ciphertext.

string

Optional fallback kid to decrypt a JWE header that
contains no kid (legacy / unmanaged artefacts).

• Must reference a key already imported and flagged
decryptOnly.

Do not send this parameter when the JWE header
already includes a kid – the request will be
rejected with HTTP 400.

Body Params
header
object
required

JWE header in General-JSON serialization.

Managed flow – if recipients[0].header.kid
is present, that kid is used as the decryption key.

Migration flow – when the header lacks a kid
(legacy ciphertext) the caller must supply
sourceKidOverride.

file
required

Original ciphertext envelope (binary).

Headers
string
enum
Defaults to application/problem+json

Generated from available response content types

Allowed:
string
enum
Defaults to multipart/mixed

Generated from available request content types

Allowed:
Responses

Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
multipart/mixed
application/problem+json