Issue a backup key challenge

POST

/api/admin/tenant-backups/{operationId}/key-challenges

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/admin/tenant-backups/example/key-challenges \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "inputId": "example" }'

Requires backup read, manage, the operation-specific export or import permission, and a human Admin session with fresh MFA (five minutes). The caller must be the operation creator and the operation must be queued or waiting. Import operations require one challenge per inputId; export operations use an empty body. Returns an RSA-OAEP SHA-256 public JWK and the exact binding context. The client wraps its content key with the operation key handoff format; it must never send its passphrase. submitExpiresAt and context.expiresAt are epoch milliseconds. The submission window is ten minutes and accepted keys expire after 24 hours.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Path Parameters

operationId

required

string

/^[A-Za-z0-9_.:-]{1,256}$/

Request Body

Media type application/json

object

inputId

required

string

/^[A-Za-z0-9_.:-]{1,256}$/

key

additional properties

Example ^generated

{
  "inputId": "example"
}

Responses

201

Issue a backup key challenge

Media type application/json

object

publicKey

required

object

kty

required

Allowed value: RSA

n

required

string

e

required

string

alg

string

ext

boolean

key_ops

Array<string>

context

required

object

tenantId

required

string

operationId

required

string

requestDigest

required

string

/^[a-f0-9]{64}$/

challengeId

required

string

expiresAt

required

integer

inputId

string

key

additional properties

submitExpiresAt

required

integer

key

additional properties

Example

{
  "publicKey": {
    "kty": "RSA"
  }
}

400

The request was rejected. No key material is returned.

Media type application/json

object

error

required

string

key

additional properties

Example ^generated

{
  "error": "example"
}

403

The request was rejected. No key material is returned.

Media type application/json

object

error

required

string

key

additional properties

Example ^generated

{
  "error": "example"
}

404

The request was rejected. No key material is returned.

Media type application/json

object

error

required

string

key

additional properties

Example ^generated

{
  "error": "example"
}

409

The request was rejected. No key material is returned.

Media type application/json

object

error

required

string

key

additional properties

Example ^generated

{
  "error": "example"
}

503

The request was rejected. No key material is returned.

Media type application/json

object

error

required

string

key

additional properties

Example ^generated

{
  "error": "example"
}