Accept the encrypted export key envelope

POST

/api/replication-backups/{grantId}/exports/{operationId}/key-challenges/{challengeId}/accept

Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/replication-backups/example/exports/example/key-challenges/example/accept \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Tenant-Id: example' \
  --data '{ "envelope": "example", "handoff": "example" }'

Requires the grant-specific bearer credential and exact X-Tenant-Id. Every request rechecks expiry, revocation and installed source scope. Only exports created by this grant with the fixed issuer and selection are accessible. Audit persistence is required. The operation key store validates the challenge and its tenant, operation, request digest, creator and expiry before accepting the encrypted envelope and handoff.

Authorizations

replicationExportCredential

Parameters

Path Parameters

grantId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

operationId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

challengeId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

Header Parameters

X-Tenant-Id

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

Must match both the installed source deployment and the grant tenant.

Request Body^required

application/json

object

envelope

required

string

/^[a-f0-9]{186}$/

handoff

required

string

/^[a-f0-9]{512}$/

key

additional properties

Example ^generated

{
  "envelope": "example",
  "handoff": "example"
}

Responses

200

Operation result. Responses are not cacheable.

application/json

object

accepted

required

boolean

key

additional properties