GET/containers/{containerId}/kek-log
Page a container's KEK rotation log
Operation containers.kekLog.get
Description
Pages a container's append-only KEK rotation log: every epoch with its write-once predecessor bridge and retained wraps, plus the sealed keyring of one epoch the request names. Clients use it to rebuild or repair a damaged container KEK keyring. Any current reader of the container may page the whole log, because current read access includes retained history.
Authentication
Requires a signed-in session: the client sends its session token as a bearer token in the Authorization header.
Parameters
| Name | In | Type | Details |
|---|---|---|---|
containerId | path | string | required |
keyringForEpoch | query | integer | optional
|
afterKeyEpoch | query | integer | optional
|
Responses
200 OK
application/jsonContainerKekLogResponse
One page of a container's KEK rotation log, oldest epoch first.
3 fields
containerIdstringrequired- not empty
- at most 256 items
hasMorebooleanrequiredTrue when later epochs remain.
Other fields are allowed.
Other responses
| Status | Meaning | Body |
|---|---|---|
| 400 | Bad Request |
|
| 401 | Unauthorized |
|
| 403 | Forbidden |
|
| 404 | Not Found |
|
| 409 | Conflict |
|
| 500 | Internal Server Error |
|
| 503 | Service Unavailable |
|
Additional rules
The server also enforces these rules, which the schema above cannot express.
A container KEK log page contains at most one sealed keyring.