createExchangeWithPassphrase

Strict / airgapped strictness only. Companion to createExchange. Without it, strict-mode orgs can't add exchanges — the standard createExchange mutation fails with ErrPassphraseLocked because Exchange's config encrypt hook has no cached KEK and strict mode forbids session-style caching.

Same mechanism as createBotRunnerWithPassphrase: derive an ephemeral KEK from the passphrase, inject on ctx, run the standard CreateExchange resolver under the scoped ctx. Cleanup zeros the KEK on return. Audit: secrets.passphrase.encrypt_with_action, resourceType="Exchange".

createExchangeWithPassphrase(
  input: CreateExchangeInput!
  passphrase: String!
): Exchange!

Arguments

createExchangeWithPassphrase.input ● CreateExchangeInput! non-null input

Same shape as CreateExchangeInput on the regular mutation.

createExchangeWithPassphrase.passphrase ● String! non-null scalar

Plaintext passphrase. Never logged. Zeroed after the operation.

Type

Exchange object