Update configuration
Changing proxy_slug changes the URL every caller encrypts through.
Existing ciphertext stays readable, because an envelope names a key
record rather than a slug.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The configuration's id, or its proxy slug.
Response
Updated.
Appears in the URL of every encryption call.
"aes-256-gcm"Where the master key lives. local_aek keeps it in the database
sealed under the application key; other providers hand custody to an
HSM or a cloud KMS.
"local_aek"
An HSM handle or key ARN, for providers that use one.