Versions

$envless->versions->reencryptEntries()

Write back re-encrypted version entries

php
/**
 * @param list<ReencryptEntryInput> $entries
 * @return ReencryptedEntriesResource
 */
public function reencryptEntries(
    string $project,
    string $environment,
    array $entries,
    ?string $product = null,
    int|float|null $timeout = null,
): array

Writes back version entry ciphertext that you re-encrypted client side, the other half of the rotation pair. Only value and defaultValue are touched, and only for entries belonging to a version of this environment, so an id from elsewhere cannot be written through this route. Names, types and version metadata are left alone.

The endpoint is lenient rather than strict. Entries whose id is not a valid uuid v7, and entries whose value is longer than 20000 characters, are skipped with no error, and if every entry is skipped the call still returns 'updated' => 0. Every value must still be ciphertext: a plaintext or empty one refuses the whole request with 400 variable.ciphertext_invalid and writes nothing. Compare updated against the number of entries you sent and re-drive the difference yourself.

defaultValue is written with a coalesce, so null or an omitted defaultValue keeps whatever is already stored. There is no way to clear a stored defaultValue here. At most 200 entries per call, and rotate the entries in the same run as the live variables or every later rollback silently breaks.

Example

php
use Envless\Envless;

$envless = new Envless();

$workspaceId = $envless->me->get()['workspaceId'];
$from = (string) getenv('ENVLESS_PASSPHRASE');
$to = (string) getenv('ENVLESS_NEW_PASSPHRASE');
$oldKey = Envless::deriveWorkspaceKey($from, $workspaceId);
$newKey = Envless::deriveWorkspaceKey($to, $workspaceId);
$entries = $envless->versions->listAllEntries('api', 'production');
$batch = [];

foreach (array_slice($entries, 0, 100) as $entry) {
    if ($entry['value'] !== null) {
        $plaintext = Envless::decryptWithKey($oldKey, $entry['value']);
        $batch[] = [
            'id' => $entry['id'],
            'value' => Envless::encryptWithKey($newKey, $plaintext),
        ];
    }
}

$result = $envless->versions->reencryptEntries('api', 'production', $batch);

if ((int) $result['updated'] !== count($batch)) {
    throw new RuntimeException('Some entries were skipped.');
}

Parameters

ParameterTypeRequiredDescription
$projectstringYesProject slug or project uniqueId.
$environmentstringYesEnvironment slug whose version entries are being rewritten.
$entrieslist<ReencryptEntryInput>YesBetween 1 and 200 rewritten entries, sent as the request body under entries.
$entries[$i]['id']stringYesVersion entry uniqueId as returned by listEntries.
$entries[$i]['value']stringYesCiphertext re-encrypted under the new key, non empty and at most 20000 characters.
$entries[$i]['defaultValue']string|nullNoRe-encrypted default value, where null or omitted keeps the stored one.
$productstringNoProduct slug used to disambiguate a project slug shared across products.
$timeoutint|floatNoSeconds each attempt of this call may take, the response body included, before it throws Envless\Exception\NetworkException with isTimeout() true. Overrides the client's timeout for this call, and 0 turns the limit off.

Returns

ReencryptedEntriesResource with updated, the count of entries actually written.

Worth knowing

  • Requires both versions:write and variables:write.
  • An empty array, or one over 200 entries, fails with 400 and error.field of entries rather than being trimmed.
  • Envless::rotateWorkspacePassphrase() drives live variables and history together and already batches this call at 100 entries.

Required scopes

versions:write and variables:write

Underlying endpoint

POST /projects/{slug}/environments/{environmentSlug}/versions/entries/reencrypt

Request and response schema, every error code, and a live playground.

In TypeScript

envless.versions.reencryptEntries()

The same method in @goenvless/sdk, with the same request, retries and errors.