Skip to main content

​
POST /admin/migrations/:id/commit

Write approved items into live KnoxCall secrets. Each item creates or updates a secret and one secret_environment_config row per target environment. After commit the item’s encrypted value is zeroed and its status becomes committed. Large migrations commit in batches. One request commits at most batch_size items (250) in a single transaction. If remaining_count in the response is greater than 0, the migration is left in awaiting_review and you issue the same request again to commit the next batch; already-committed items are never re-attempted, because the batch is selected by item status. An unbounded commit would exceed the 100-second edge timeout on large migrations, leaving the caller with a 524 and no report of what was written. Auth: migration_reviewer permission + 5-minute step-up Class B reveal (since 2026-10-05). This action also passes the reveal chokepoint: the caller’s own membership must be Owner or Admin (an Admin also needs the Owner-granted migration_reviewer delegation, checked first), the ONE secret.migration verification is consumed by the chokepoint itself (one verification per action), the per-person reveal budget is charged (60 per 5 minutes: 429 reveal_budget_exceeded, or 503 reveal_budget_unavailable when it cannot be counted), and a plaintext.reveal audit entry is written before anything is decrypted or changed (503 reveal_audit_unavailable if it cannot be). A missing verification answers 403 with "code": "reveal_step_up_required", "requires_step_up": true, "action_scope": "secret.migration" and "allowed_methods": ["passkey", "2fa"]. The migration must be in awaiting_review status. If any item in a batch fails to write, that whole batch is rolled back and the migration reverts to awaiting_review so the operator can investigate and retry. Batches committed by earlier requests are durable and are not rolled back. A migration.commit entry is written to audit_log_critical after each successful batch, carrying committed_count, remaining_count and batch_size.

​
Response

status is completed only when remaining_count is 0. While items remain it is awaiting_review:
Returns 409 if the migration is not in awaiting_review status, or if there are no approved items to commit.