---
title: "Rotate the DataHub secret-service encryption key"
method: POST
path: "/project/{project}/service/{service_name}/rotate-secret-service-encryption-key"
tags: ["Service"]
---

# Rotate the DataHub secret-service encryption key

`POST /project/{project}/service/{service_name}/rotate-secret-service-encryption-key`

Generates a fresh SECRET\_SERVICE\_ENCRYPTION\_KEY (the key GMS uses to encrypt ingestion source credentials and other sensitive values at rest), re-encrypts every stored secret from the old key to the new one, and then restarts GMS on the new key. Because the stored secrets are migrated in place, ingestion resumes on its own after the restart. USER-VISIBLE SIDE EFFECT: none for API tokens or browser sessions. Ingestion pauses only for the duration of the GMS restart and then continues.

## Path parameters

- `project` string, required
- `service_name` string, required

## Response `200`

Response

- ServiceDataHubRotateSecretServiceEncryptionKeyResponse — ServiceDataHubRotateSecretServiceEncryptionKeyResponse
  - `errors` object[] — List of errors occurred during request processing
    - `message` string, required — Printable error message
    - `more_info` string — URL to the documentation of the error
    - `status` integer, required — HTTP error status code
  - `message` string, required — Printable result of the request
  - `rotation` object, required — DatahubEncryptionRotationGroup
    - `group` string, required — Rotated secret group

## Other responses

- `404` — Resource not found
- `409` — Request conflict

---

[API](https://skmtc.net/aiven/apis/aiven-api-documentation.md) · [All operations](https://skmtc.net/aiven/apis/aiven-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aiven/aiven-api-documentation/revisions/cca52db3227b/schema)