Issue an export content-key challenge

POST

/api/replication-backups/{grantId}/exports/{operationId}/key-challenges

Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/replication-backups/example/exports/example/key-challenges \
  --header 'Authorization: Bearer <token>' \
  --header 'X-Tenant-Id: example'

Requires the grant-specific bearer credential and exact X-Tenant-Id. Every request rechecks expiry, revocation and installed source scope. Only exports created by this grant with the fixed issuer and selection are accessible. Audit persistence is required. Request body must be empty. The client uses RSA-OAEP SHA-256 and the returned context with the existing backup key-envelope protocol; no plaintext passphrase is sent.

Authorizations

replicationExportCredential

Parameters

Path Parameters

grantId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

operationId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

Header Parameters

X-Tenant-Id

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

Must match both the installed source deployment and the grant tenant.

Responses

201

Operation result. Responses are not cacheable.

application/json

object

publicKey

required

object

kty

required

string

Allowed values: RSA

required

string

required

string

alg

string

ext

boolean

key_ops

Array<string>

key

additional properties

context

required

object

tenantId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

operationId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

requestDigest

required

string

/^[a-f0-9]{64}$/

challengeId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

expiresAt

required

integer

key

additional properties

submitExpiresAt

required

integer

key

additional properties