---
title: "Initializes a new rekey attempt."
method: POST
path: "/sys/rekey/init"
tags: ["system"]
---

# Initializes a new rekey attempt.

`POST /sys/rekey/init`

Only a single rekey attempt can take place at a time, and changing the parameters of a rekey requires canceling and starting a new rekey, which will also provide a new nonce.

## Request body

- SystemRekeyInitRequest
  - `backup` boolean — Specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the PGP-encrypted keys.
  - `pgp_keys` string[] — Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as secret_shares.
  - `require_verification` boolean — Turns on verification functionality
  - `secret_shares` integer — Specifies the number of shares to split the unseal key into.
  - `secret_threshold` integer — Specifies the number of shares required to reconstruct the unseal key. This must be less than or equal secret_shares. If using Vault HSM with auto-unsealing, this value must be the same as secret_shares.

## Response `200`

OK

---

[API](https://skmtc.net/lensesio/apis/hashicorp-vault-api.md) · [All operations](https://skmtc.net/lensesio/apis/hashicorp-vault-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lensesio/hashicorp-vault-api/versions/bd8194de0697/schema)