Skip to main content

​
POST /admin/tenant-kms/unseal

Force an immediate unseal attempt after restoring KMS access. This is not idempotent — once the tenant is unsealed, calling it again returns 409 not_sealed. Auth: served on the admin host with a session Authorization: Bearer <jwt> plus the X-Tenant-ID header (owner/admin role). This action also requires a recent step-up verification within a 2-minute window — enforced server-side against the authenticated user. No step-up header or token is sent on this request; instead the signed-in user must have re-authenticated shortly beforehand with a second factor, passing "action_scope": "tenant.kms" in the body: POST /auth/2fa/verify-step-up (authenticator-app code), POST /auth/passkey/verify-step-up (passkey, challenge from POST /auth/passkey/authenticate-options), or POST /auth/2fa/webauthn/verify-step-up (security key or passkey, challenge from POST /auth/2fa/webauthn/step-up-options). An emailed code does not satisfy this gate. If no recent verification exists, the endpoint returns 403 { "error": "Recent step-up verification required for this action", "requires_step_up": true, "max_age_minutes": 2, "action_scope": "tenant.kms", "allowed_methods": ["passkey", "2fa"] }. Omitting X-Tenant-ID returns 400. Manual unseal forces immediate recovery rather than waiting for the next BYOK bundle-renewal cycle.

​
Response

​
Error codes

unseal_failed includes a reason field: "access_denied" (IAM grant still missing) or "unreachable" (network issue).