方法：rewrap
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
此方法可帮助您从旧版密钥访问控制列表服务迁移
(KACLS1) 连接到较新的 KACLS (KACLS2)。它需要数据加密密钥 (DEK)
并使用 KACLS1 的 wrap API 封装，并返回
使用 KACLS2 的 wrap API 封装的 DEK。
HTTP 请求
POST https://KACLS_URL/rewrap
将 KACLS_URL 替换为密钥访问控制列表
服务 (KACLS) 网址。
路径参数
无。
请求正文
请求正文中包含结构如下的数据：
| JSON 表示法 |
{
"authorization": string,
"original_kacls_url": string,
"reason": string,
"wrapped_key": string
}
|
| 字段 |
authorization |
string
一个 JWT，断言允许用户解封 resource_name 的密钥。请参阅授权令牌。
|
original_kacls_url |
string
当前 wrapped_key 的 KACLS 的网址。
|
reason |
string (UTF-8)
提供操作的其他上下文的直通式 JSON 字符串。提供的 JSON 应在显示之前进行清理。大小上限：1 KB。
|
wrapped_key |
string
wrap 返回的 base64 二进制对象。
|
响应正文
如果成功，此方法将返回一个不透明的二进制对象，该对象将被存储
并在任何后续操作中按原样发送
密钥解封操作。它还应该返回 base64 编码的
resource_key_hash。
如果操作失败，
结构化错误回复
。
该二进制对象应包含已加密 DEK 的唯一副本，
实现特定数据可以存储在其中。
不要将该 DEK 存储在您的 KACLS 系统中，而应将其加密并返回
wrapped_key 对象。这样可防止
文档及其密钥。例如，为了确保用户的数据
或确保以前的版本已经恢复
文件均可解密
删除对象时，Google 不会向 KACLS 发送删除请求。
| JSON 表示法 |
{
"resource_key_hash": string,
"wrapped_key": string
}
|
| 字段 |
resource_key_hash |
string
base64 编码的二进制对象。请参阅
资源密钥哈希。
|
wrapped_key |
string
采用 base64 编码的二进制对象。大小上限：1 KB。
|
示例
此示例提供了 rewrap 方法的示例请求和响应。
请求
POST https://mykacls.example.com/v1/rewrap
{
"wrapped_key": "7qTh6Mp+svVwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==",
"authorization": "eyJhbGciOi...",
"original_kacls_url": "https://original.example.com/kacls/v1",
"reason": "{client:'drive' op:'read'}"
}
响应
{
"wrapped_key": "3qTh6Mp+svPwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==",
"resource_key_hash": "SXOyPekBAUI95zuZSuJzsBlK4nO5SuJK4nNCPem5SuI="
}
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-25。
[null,null,["最后更新时间 (UTC)：2025-07-25。"],[[["\u003cp\u003eThis method facilitates migrating from the older Key Access Control List Service (KACLS1) to the newer KACLS (KACLS2) by converting Data Encryption Keys (DEKs) wrapped with KACLS1 to be wrapped with KACLS2.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003erewrap\u003c/code\u003e method requires an authorization token, the original KACLS URL, a reason for the operation, and the KACLS1-wrapped DEK in the request body.\u003c/p\u003e\n"],["\u003cp\u003eA successful response provides a KACLS2-wrapped DEK and a resource key hash, ensuring the encrypted data remains accessible and manageable within Google Workspace.\u003c/p\u003e\n"],["\u003cp\u003eKACLS providers should encrypt and return the DEK within the \u003ccode\u003ewrapped_key\u003c/code\u003e object to prevent lifetime discrepancies and ensure data integrity.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Workspace doesn't send deletion requests to KACLS when objects are deleted, implying KACLS providers manage key lifecycles independently.\u003c/p\u003e\n"]]],["The `rewrap` method migrates data encryption keys (DEKs) from KACLS1 to KACLS2. It requires a `POST` request to the KACLS URL, including a JSON body with the `authorization`, `original_kacls_url`, `reason`, and the KACLS1-wrapped `wrapped_key`. The successful response returns a KACLS2-wrapped `wrapped_key` and `resource_key_hash`, which should be stored with the encrypted object. The DEK should only exist in its encrypted state, and not stored in the KACLS.\n"],null,["# Method: rewrap\n\nThis method helps you migrate from the old Key Access Control List Service\n(KACLS1) to the newer KACLS (KACLS2). It takes a Data Encryption Key (DEK)\nwrapped with KACLS1's [`wrap`](/workspace/cse/reference/wrap) API, and returns a\nDEK wrapped with KACLS2's [`wrap`](/workspace/cse/reference/wrap) API.\n\n### HTTP request\n\n`POST https://`\u003cvar translate=\"no\"\u003eKACLS_URL\u003c/var\u003e`/rewrap`\n\nReplace \u003cvar translate=\"no\"\u003eKACLS_URL\u003c/var\u003e with the Key Access Control List\nService (KACLS) URL.\n\n### Path parameters\n\nNone.\n\n### Request body\n\nThe request body contains data with the following structure:\n\n| JSON representation ||\n|------------------------------------------------------------------------------------------------------------|---|\n| ``` { \"authorization\": string, \"original_kacls_url\": string, \"reason\": string, \"wrapped_key\": string } ``` |\n\n| Fields ||\n|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `authorization` | `string` A JWT asserting that the user is allowed to unwrap a key for `resource_name`. See [authorization tokens](/workspace/cse/reference/authorization-tokens). |\n| `original_kacls_url` | `string` URL of current wrapped_key's KACLS. |\n| `reason` | `string (UTF-8)` A passthrough JSON string providing additional context about the operation. The JSON provided should be sanitized before being displayed. Max size: 1 KB. |\n| `wrapped_key` | `string` The base64 binary object returned by [`wrap`](/workspace/cse/reference/wrap). |\n\n### Response body\n\nIf successful, this method returns an opaque binary object that will be stored\nby Google Workspace along the encrypted object and sent as-is in any subsequent\nkey unwrapping operation. It should also return the base64-encoded\n[resource_key_hash](/workspace/cse/reference/resource-key-hash).\n\nIf the operation fails, a\n[structured error reply](/workspace/cse/reference/structured-errors)\nshould be returned.\n\nThe binary object should contain the only copy of the encrypted DEK,\nimplementation specific data can be stored in it.\n\nDon't store the DEK in your KACLS system, instead encrypt it and return it in\nthe `wrapped_key` object. This prevents lifetime discrepancies between the\ndocument and its keys. For example, to ensure that the user's data is fully\nwiped out when they request it, or to make sure that previous versions restored\nfrom a backup will be decryptable.\n\nGoogle won't send deletion requests to the KACLS when objects are deleted.\n\n| JSON representation ||\n|----------------------------------------------------------------|---|\n| ``` { \"resource_key_hash\": string, \"wrapped_key\": string } ``` |\n\n| Fields ||\n|---------------------|-------------------------------------------------------------------------------------------------------------|\n| `resource_key_hash` | `string` base64 encoded binary object. See [resource key hash](/workspace/cse/reference/resource-key-hash). |\n| `wrapped_key` | `string` The base64-encoded binary object. Max size: 1 KB. |\n\n### Example\n\nThis example provides a sample request and response for the `rewrap` method.\n\n#### Request\n\n POST https://mykacls.example.com/v1/rewrap\n\n {\n \"wrapped_key\": \"7qTh6Mp+svVwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==\",\n \"authorization\": \"eyJhbGciOi...\",\n \"original_kacls_url\": \"https://original.example.com/kacls/v1\",\n \"reason\": \"{client:'drive' op:'read'}\"\n }\n\n#### Response\n\n {\n \"wrapped_key\": \"3qTh6Mp+svPwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==\",\n \"resource_key_hash\": \"SXOyPekBAUI95zuZSuJzsBlK4nO5SuJK4nNCPem5SuI=\"\n }"]]
