def reencrypt_entries(
  project,
  environment,
  entries,
  product: nil,
  timeout: nil
)

def reencrypt_entries: (
  String project,
  String environment,
  Array[reencrypt_entry_input | Hash[Symbol | String, untyped]] entries,
  ?product: (String | Symbol)?,
  ?timeout: seconds?
) -> reencrypted_entries_resource

Writes back version entry ciphertext that you re-encrypted client side, the other half of the rotation pair. Only value and defaultValue are touched, and only for entries belonging to a version of this environment, so an id from elsewhere cannot be written through this route. Names, types and version metadata are left alone.

The endpoint is lenient rather than strict. Entries whose id is not a valid uuid v7, and entries whose value is longer than 20000 characters, are skipped with no error, and if every entry is skipped the call still returns updated: 0. Every value must still be ciphertext: a plaintext or empty one refuses the whole request with 400 variable.ciphertext_invalid and writes nothing. Compare updated against the number of entries you sent and re-drive the difference yourself.

defaultValue is written with a coalesce, so nil or an omitted defaultValue keeps whatever is already stored. There is no way to clear a stored defaultValue here. At most 200 entries per call, and rotate the entries in the same run as the live variables or every later rollback silently breaks.

Example

ruby

require "envless/sdk"

workspace_id = Envless.me.get[:workspaceId]
from = ENV.fetch("ENVLESS_PASSPHRASE")
to = ENV.fetch("ENVLESS_NEW_PASSPHRASE")
old_key = Envless.derive_workspace_key(from, workspace_id)
new_key = Envless.derive_workspace_key(to, workspace_id)
entries = Envless.versions.list_all_entries("api", "production")

batch = entries.first(100).filter_map do |entry|
  value = entry[:value]
  next unless value

  plaintext = Envless.decrypt_with_key(old_key, value)
  rewrapped = Envless.encrypt_with_key(new_key, plaintext)
  {id: entry[:id], value: rewrapped}
end

result = Envless.versions.reencrypt_entries(
  "api",
  "production",
  batch
)

updated = result[:updated]
raise "some entries were skipped" unless updated == batch.size

Parameters

Parameter	Type	Required	Description
`project`	`String`	Yes	Project slug or project uniqueId.
`environment`	`String`	Yes	Environment slug whose version entries are being rewritten.
`entries`	`Array[reencrypt_entry_input]`	Yes	Between 1 and 200 rewritten entries, sent as the request body under `entries`.
`entries[i][:id]`	`String`	Yes	Version entry uniqueId as returned by `list_entries`.
`entries[i][:value]`	`String`	Yes	Ciphertext re-encrypted under the new key, non empty and at most 20000 characters.
`entries[i][:defaultValue]`	`String \| nil`	No	Re-encrypted default value, where `nil` or omitted keeps the stored one.
`product:`	`String \| Symbol`	No	Product slug used to disambiguate a project slug shared across products.
`timeout:`	`Integer \| Float \| Rational`	No	Seconds each attempt of this call may take, redirects and the response body included, before it raises `Envless::NetworkError` with `timeout?` set. Overrides the client's `timeout` for this call, and `0` turns the limit off.

Returns

reencrypted_entries_resource with updated, the count of entries actually written.

Worth knowing

Requires both versions:write and variables:write.
An empty array, or one over 200 entries, fails with 400 and error.field of entries rather than being trimmed.
Envless.rotate_workspace_passphrase drives live variables and history together and already batches this call at 100 entries.

Required scopes

versions:write and variables:write

Underlying endpoint

POST /projects/{slug}/environments/{environmentSlug}/versions/entries/reencrypt

Request and response schema, every error code, and a live playground.

In TypeScript

envless.versions.reencryptEntries()

The same method in @goenvless/sdk, with the same request, retries and errors.

Example#

Parameters#

Returns#

Worth knowing#

Required scopes#

Underlying endpoint#