# Tenant Encryption

APIs to enable per-tenant encryption (PTE) for a company.

## Create or rotate tenant CMK

 - [POST /v3/tenant-encryption/{companyId}/key](https://developer.spotnana.com/openapi/companyapi/tenant-encryption/provisionorrotatetenantkey.md): First call provisions a Spotnana-managed CMK and DEK.
Subsequent calls rotate the CMK and re-wrap the existing DEK.
Returns 429 if called within the one-hour cooldown window.
Requires the COMPANY_MANAGEMENT WRITE permission on the company.