SetStrategyWrappedDEKsInput

Replaces the wrapped-DEK envelope set for one Strategy. The full list is provided each call (no partial updates) so the server's view of "who can unwrap this resource" is always derivable from one mutation trip — important when a DEK is rotated and old envelopes must be discarded atomically. For incremental adds (sharing C in T2.4, admin escrow in T2.5) we will add narrower mutations layered on top.

input SetStrategyWrappedDEKsInput {
  wrappedDEKs: [WrappedDEKInput!]!
}

Fields

SetStrategyWrappedDEKsInput.wrappedDEKs ● [WrappedDEKInput!]! non-null input

Full envelope list. Empty list clears the strategy back to plaintext-DEK mode (i.e. T2.2 disabled for this resource); the caller is responsible for re-encrypting the payload columns first.

Member Of

setStrategyWrappedDEKs mutation