> ## Documentation Index > Fetch the complete documentation index at: https://www.cockroachlabs.com/llms.txt > Use this file to discover all available pages before exploring further. # Update the CMEK-related status for a cluster. ## OpenAPI ````yaml /openapi/cloud/2022-03-31.json patch /api/v1/clusters/{cluster_id}/cmek openapi: 3.0.0 info: title: CockroachDB Cloud API description: >- This is an early access, experimental version of the Cloud API. The interface and output is subject to change, and there may be bugs. # Authentication version: '2022-03-31' contact: name: Cockroach Labs Support url: https://support.cockroachlabs.com email: support@cockroachlabs.com servers: - url: https://cockroachlabs.cloud security: - Bearer: [] tags: - name: CockroachCloud externalDocs: description: Use the CockroachDB Cloud API url: https://www.cockroachlabs.com/docs/cockroachcloud/cloud-api paths: /api/v1/clusters/{cluster_id}/cmek: patch: tags: - CockroachCloud summary: Update the CMEK-related status for a cluster. operationId: CockroachCloud_UpdateCMEKStatus parameters: - name: cluster_id in: path required: true schema: type: string requestBody: content: application/json: schema: type: object example: action: REVOKE properties: action: $ref: '#/components/schemas/CMEKCustomerAction' title: UpdateCMEKStatusRequest required: - action required: true responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/CMEKClusterInfo' '400': description: Returned when a request field is invalid. content: application/json: schema: {} '401': description: Returned when the token bearer cannot be authenticated. content: application/json: schema: {} '403': description: >- Returned when the user does not have permission to access the resource. content: application/json: schema: {} '404': description: Returned when the resource does not exist. content: application/json: schema: {} 5XX: description: Server error content: application/json: schema: {} default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/Status' x-codeSamples: - lang: curl source: |- curl --request PATCH \ --url https://cockroachlabs.cloud/api/v1/clusters/{cluster_id}/cmek \ --header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \ --header 'content-type: application/json' \ --data '{"action":"REVOKE"}' components: schemas: CMEKCustomerAction: type: string enum: - UNKNOWN_ACTION - REVOKE default: UNKNOWN_ACTION description: >- CMEKCustomerAction enumerates the actions a customer can take on a cluster that has been enabled for CMEK. CMEKClusterInfo: type: object properties: status: $ref: '#/components/schemas/CMEKStatus' region_infos: type: array items: $ref: '#/components/schemas/CMEKRegionInfo' description: |- CMEKClusterInfo contains the status of CMEK across an entire cluster, including within each one its regions. Status: type: object properties: code: type: integer format: int32 message: type: string details: type: array items: $ref: '#/components/schemas/Any' CMEKStatus: type: string enum: - UNKNOWN_STATUS - DISABLED - DISABLING - DISABLE_FAILED - ENABLED - ENABLING - ENABLE_FAILED - REVOKED - REVOKING - REVOKE_FAILED default: UNKNOWN_STATUS description: >- CMEKStatus describes the current status of CMEK for an entire CRDB cluster or a key within a region. - UNKNOWN_STATUS: UNKNOWN should never be used; if it is used, it indicates a bug. - DISABLED: DISABLED corresponds to the state of a cluster or region-level key when CMEK has finished being disabled. By default, CMEK will be disabled for new clusters. - DISABLING: DISABLED corresponds to the state of a cluster or region-level key when CMEK is in the process of being disabled. - DISABLE_FAILED: DISABLE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be disabled. - ENABLED: ENABLED corresponds to the state of a cluster or region-level key when CMEK is enabled. - ENABLING: ENABLING corresponds to the state of a cluster or region-level key when CMEK is in the process of being enabled. - ENABLE_FAILED: ENABLE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be enabled. - REVOKED: REVOKED corresponds to the state of a cluster or region-level key when the customer has revoked CockroachLab's permissions for their key. - REVOKING: REVOKING corresponds to the state of a cluster or region-level key when CMEK is in the process of being revoked. - REVOKE_FAILED: REVOKE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be revoked. CMEKRegionInfo: type: object properties: region: type: string key_infos: type: array items: $ref: '#/components/schemas/CMEKKeyInfo' description: >- CMEKRegionInfo contains the status of CMEK within a region. This includes current and past key specifications used within the region, as well as the status of those specifications. Any: type: object properties: '@type': type: string additionalProperties: {} CMEKKeyInfo: type: object properties: status: $ref: '#/components/schemas/CMEKStatus' user_message: type: string spec: $ref: '#/components/schemas/CMEKKeySpecification' created_at: type: string format: date-time updated_at: type: string format: date-time description: |- CMEKKeyInfo contains the status of a customer-provided key alongside the specification. CMEKKeySpecification: type: object properties: type: $ref: '#/components/schemas/CMEKKeyType' uri: type: string auth_principal: type: string description: >- CMEKKeySpecification contains all the details necessary to use a customer-provided encryption key. This involves the type/location of the key and the principal to authenticate as when accessing it. CMEKKeyType: type: string enum: - UNKNOWN_KEY_TYPE - AWS_KMS - GCP_CLOUD_KMS default: UNKNOWN_KEY_TYPE description: |- CMEKKeyType enumerates types of customer-managed keys. - UNKNOWN_KEY_TYPE: UNKNOWN should never be used; if it is used, it indicates a bug. securitySchemes: Bearer: type: http scheme: bearer ````