opschain admin encryption status

Included from Basic tier

Prints the encryption key lifecycle census — the v2 SystemService.GetEncryptionStatus read, computed server-side with one set-based GROUP BY per encrypted column (a full scan of each, so expect seconds on a large properties_versions):

• current key and configured keys — the ring this server holds: OPSCHAIN_PRIMARY_KEY first, then OPSCHAIN_PREVIOUS_KEYS in order. A key id is the leading 64 bits (16 hex characters) of SHA-256 over the derived AES key; it names the (primary key, salt) pair without revealing either.
• pending re-encryption — envelopes not sealed under the current key, legacy envelopes (written before key references existed, or by ActiveRecord) included.
• MISSING keys — key ids referenced by stored envelopes, or registered and not retired, that this server's ring lacks. The verb exits 1 while any exist, so it slots into a rotation drill's checks.
• the key registry — one row per key id that has been a server's current key against this database: current, previous (configured here, not current), retired (a re-encryption run verified nothing references it; safe to drop from OPSCHAIN_PREVIOUS_KEYS), or MISSING.
• one row per table.column with the envelope count, how many are under the current key, how many are legacy, how many are pending, and the count per key id (<key>=<n>, marked (missing) when unconfigured).
• the last re-encryption run with its status and counts.

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

Under -o json / -o yaml the response document is printed verbatim (backend, current_key_id, configured_key_ids, keys[], columns[] with by_key[], pending, missing_key_ids, last_run); the exit code still reflects the missing-key verdict.

Exit codes

Code	Meaning
0	Every referenced key is configured on this server.
1	A referenced key is missing, the request failed, the server has no encryption keys configured, or the token was rejected.
2	Usage error — no server or no credential resolvable.

Examples

opschain admin encryption status
opschain admin encryption status -o json | jq '.pending, .missing_key_ids'

See also

• opschain docs cli/admin-encryption-reencrypt — the run that drains pending to zero and retires the old key.
• opschain docs storage — the keyset and the boot gate.