方法：重新包裝
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
這個方法可協助您從舊的金鑰存取控制清單服務遷移
(KACLS1) 升級至新版 KACLS (KACLS2)。必須使用資料加密金鑰 (DEK)
並透過 KACLS1 的 wrap API 包裝，然後傳回
DEK 已包裝在 KACLS2 的 wrap API 中。
HTTP 要求
POST https://KACLS_URL/rewrap
將 KACLS_URL 替換為金鑰存取控制清單
服務 (KACLS) 網址。
路徑參數
無。
要求主體
要求主體的資料會採用以下結構：
| JSON 表示法 |
{
"authorization": string,
"original_kacls_url": string,
"reason": string,
"wrapped_key": string
}
|
| 欄位 |
authorization |
string
JWT 宣告是否允許使用者為 resource_name 解除包裝金鑰。查看授權權杖。
|
original_kacls_url |
string
目前 wrap_key 的 KACLS 網址。
|
reason |
string (UTF-8)
直通式 JSON 字串，提供作業的其他背景資訊。提供的 JSON 必須先經過處理，才會顯示。大小上限：1 KB。
|
wrapped_key |
string
wrap 傳回的 Base64 二進位物件。
|
回應主體
如果成功的話，這個方法會傳回不透明的二進位物件。這個物件即將儲存
透過加密物件的方式傳送，並在後續
金鑰解除包裝作業。此外，您也應該傳回採用 Base64 編碼的
resource_key_hash。
如果作業失敗，
結構化錯誤回覆
。
二進位物件應包含加密 DEK 的唯一副本。
可以儲存實作專屬資料。
不要將 DEK 儲存在 KACLS 系統中，而是將其加密並回傳
wrapped_key 物件。這樣就能避免
文件及其金鑰例如，在 2012 年 4 月 1 日前
或是在使用者要求檔案時清除清除資料，或要確保已還原先前的版本。
系統就會解密
在物件遭到刪除時，Google 不會將刪除要求傳送給 KACLS。
| JSON 表示法 |
{
"resource_key_hash": string,
"wrapped_key": string
}
|
| 欄位 |
resource_key_hash |
string
Base64 編碼的二進位物件。詳情請參閱
資源金鑰雜湊。
|
wrapped_key |
string
Base64 編碼的二進位物件。大小上限：1 KB。
|
範例
這個範例提供了 rewrap 方法的要求和回應範例。
要求
POST https://mykacls.example.com/v1/rewrap
{
"wrapped_key": "7qTh6Mp+svVwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==",
"authorization": "eyJhbGciOi...",
"original_kacls_url": "https://original.example.com/kacls/v1",
"reason": "{client:'drive' op:'read'}"
}
回應
{
"wrapped_key": "3qTh6Mp+svPwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==",
"resource_key_hash": "SXOyPekBAUI95zuZSuJzsBlK4nO5SuJK4nNCPem5SuI="
}
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-25 (世界標準時間)。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[[["\u003cp\u003eThis method facilitates migrating from the older Key Access Control List Service (KACLS1) to the newer KACLS (KACLS2) by converting Data Encryption Keys (DEKs) wrapped with KACLS1 to be wrapped with KACLS2.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003erewrap\u003c/code\u003e method requires an authorization token, the original KACLS URL, a reason for the operation, and the KACLS1-wrapped DEK in the request body.\u003c/p\u003e\n"],["\u003cp\u003eA successful response provides a KACLS2-wrapped DEK and a resource key hash, ensuring the encrypted data remains accessible and manageable within Google Workspace.\u003c/p\u003e\n"],["\u003cp\u003eKACLS providers should encrypt and return the DEK within the \u003ccode\u003ewrapped_key\u003c/code\u003e object to prevent lifetime discrepancies and ensure data integrity.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Workspace doesn't send deletion requests to KACLS when objects are deleted, implying KACLS providers manage key lifecycles independently.\u003c/p\u003e\n"]]],["The `rewrap` method migrates data encryption keys (DEKs) from KACLS1 to KACLS2. It requires a `POST` request to the KACLS URL, including a JSON body with the `authorization`, `original_kacls_url`, `reason`, and the KACLS1-wrapped `wrapped_key`. The successful response returns a KACLS2-wrapped `wrapped_key` and `resource_key_hash`, which should be stored with the encrypted object. The DEK should only exist in its encrypted state, and not stored in the KACLS.\n"],null,["# Method: rewrap\n\nThis method helps you migrate from the old Key Access Control List Service\n(KACLS1) to the newer KACLS (KACLS2). It takes a Data Encryption Key (DEK)\nwrapped with KACLS1's [`wrap`](/workspace/cse/reference/wrap) API, and returns a\nDEK wrapped with KACLS2's [`wrap`](/workspace/cse/reference/wrap) API.\n\n### HTTP request\n\n`POST https://`\u003cvar translate=\"no\"\u003eKACLS_URL\u003c/var\u003e`/rewrap`\n\nReplace \u003cvar translate=\"no\"\u003eKACLS_URL\u003c/var\u003e with the Key Access Control List\nService (KACLS) URL.\n\n### Path parameters\n\nNone.\n\n### Request body\n\nThe request body contains data with the following structure:\n\n| JSON representation ||\n|------------------------------------------------------------------------------------------------------------|---|\n| ``` { \"authorization\": string, \"original_kacls_url\": string, \"reason\": string, \"wrapped_key\": string } ``` |\n\n| Fields ||\n|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `authorization` | `string` A JWT asserting that the user is allowed to unwrap a key for `resource_name`. See [authorization tokens](/workspace/cse/reference/authorization-tokens). |\n| `original_kacls_url` | `string` URL of current wrapped_key's KACLS. |\n| `reason` | `string (UTF-8)` A passthrough JSON string providing additional context about the operation. The JSON provided should be sanitized before being displayed. Max size: 1 KB. |\n| `wrapped_key` | `string` The base64 binary object returned by [`wrap`](/workspace/cse/reference/wrap). |\n\n### Response body\n\nIf successful, this method returns an opaque binary object that will be stored\nby Google Workspace along the encrypted object and sent as-is in any subsequent\nkey unwrapping operation. It should also return the base64-encoded\n[resource_key_hash](/workspace/cse/reference/resource-key-hash).\n\nIf the operation fails, a\n[structured error reply](/workspace/cse/reference/structured-errors)\nshould be returned.\n\nThe binary object should contain the only copy of the encrypted DEK,\nimplementation specific data can be stored in it.\n\nDon't store the DEK in your KACLS system, instead encrypt it and return it in\nthe `wrapped_key` object. This prevents lifetime discrepancies between the\ndocument and its keys. For example, to ensure that the user's data is fully\nwiped out when they request it, or to make sure that previous versions restored\nfrom a backup will be decryptable.\n\nGoogle won't send deletion requests to the KACLS when objects are deleted.\n\n| JSON representation ||\n|----------------------------------------------------------------|---|\n| ``` { \"resource_key_hash\": string, \"wrapped_key\": string } ``` |\n\n| Fields ||\n|---------------------|-------------------------------------------------------------------------------------------------------------|\n| `resource_key_hash` | `string` base64 encoded binary object. See [resource key hash](/workspace/cse/reference/resource-key-hash). |\n| `wrapped_key` | `string` The base64-encoded binary object. Max size: 1 KB. |\n\n### Example\n\nThis example provides a sample request and response for the `rewrap` method.\n\n#### Request\n\n POST https://mykacls.example.com/v1/rewrap\n\n {\n \"wrapped_key\": \"7qTh6Mp+svVwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==\",\n \"authorization\": \"eyJhbGciOi...\",\n \"original_kacls_url\": \"https://original.example.com/kacls/v1\",\n \"reason\": \"{client:'drive' op:'read'}\"\n }\n\n#### Response\n\n {\n \"wrapped_key\": \"3qTh6Mp+svPwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==\",\n \"resource_key_hash\": \"SXOyPekBAUI95zuZSuJzsBlK4nO5SuJK4nNCPem5SuI=\"\n }"]]
