> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cipher keys

> Read and rotate organization field-encryption keys.

Organization cipher keys use AES-256-GCM. Key material must decode to exactly 32 bytes and is never
returned by read APIs.

| Method and path                          | Permission            | Purpose                                               |
| ---------------------------------------- | --------------------- | ----------------------------------------------------- |
| `GET /api/v1/cipher_keys`                | `org.settings.read`   | List key metadata.                                    |
| `GET /api/v1/cipher_keys/{name}`         | `org.settings.read`   | Read the latest version metadata.                     |
| `POST /api/v1/cipher_keys`               | `org.settings.manage` | Create a named key from `key_material_b64`.           |
| `POST /api/v1/cipher_keys/{name}/rotate` | `org.settings.manage` | Add a new version and keep historical decryption.     |
| `DELETE /api/v1/cipher_keys/{name}`      | `org.settings.manage` | Delete a named key.                                   |
| `POST /api/v1/field_encryption/rotate`   | `org.settings.manage` | Generate and rotate the default field-encryption DEK. |

<Warning>
  Review encrypted-field dependencies before deleting a key. See
  [Security → Field-level encryption](/en-US/security#field-level-encryption).
</Warning>