Destroy the current project encryption key (PEK) and generate a new one. This is the recovery path for when the on-disk encrypted PEK becomes permanently inaccessible, for example because the key encryption material protecting it was lost.
All data that was encrypted under the destroyed key becomes permanently unrecoverable. Each feature that stores encrypted data decides how to handle its own data during the reset: some features drop the encrypted values entirely, while others preserve the rest of the affected data and only clear the values that can no longer be decrypted.
Because this operation causes permanent data loss, it requires the accept_data_loss
query parameter to be set to true.
Query parameters
-
Acknowledge that resetting the project encryption key permanently destroys all data that was encrypted under the current key. The request fails if this is not set to
true. -
The period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.
External documentation -
The period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.
External documentation
POST /_encryption/_reset?accept_data_loss=true
resp = client.encryption.reset(
accept_data_loss=True,
)const response = await client.encryption.reset({
accept_data_loss: "true",
});response = client.encryption.reset(
accept_data_loss: "true"
)$resp = $client->encryption()->reset([
"accept_data_loss" => "true",
]);curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_encryption/_reset?accept_data_loss=true"client.encryption().reset(r -> r
.acceptDataLoss(true)
);
{
"acknowledged": true
}