Update a configuration
Requires configuration:manage. Only name and proxy_slug can be
changed, and only the fields present in the body are touched.
Changing proxy_slug changes the URL every caller encrypts through.
Existing ciphertext stays readable, because an envelope names a key
record rather than a slug. A slug that any policy statement already
names is refused, because renaming a configuration onto it would hand
that statement’s holders another configuration’s plaintext.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The configuration's id, or its proxy slug. Either resolves.
"952zpx6vyig3sdyp"
Body
Response
Updated.
Appears in the URL of every encryption call, and is how policy statements name this configuration.
Fixed at creation and not changeable.
"aes-256-gcm"Where the master key lives. local_aek keeps it in the database
sealed under the application key; other providers hand custody to an
HSM or a cloud KMS.
"local_aek"
An HSM handle or key ARN, for providers that use one.