oz0 tenant rotate-payload-key
For: Operators and developers looking up a command.
Retire the key a tenant's payloads are encrypted with before they reach Temporal. The edge makes a new key when it next encrypts, within 30 seconds, and nodes take it within a minute. The retired key still decrypts what it encrypted, so nothing becomes unreadable; keys are never deleted while the tenant exists.
Nothing is re-encrypted: payloads already in Temporal stay under the key they were written with, so rotation limits what a key leaked from now on can open, not what one leaked before could. Take a backup afterwards (oz0 tenant encryption says whether the newest one holds the new key). A reason is required, as for a governance change; the audit log keeps it with who rotated.
Usage
oz0 tenant rotate-payload-key <tenant> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--json | bool | print JSON instead of a table | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.