# `Arangox.API.Security`
[🔗](https://github.com/ArangoDB-Community/arangox/blob/v0.8.0/lib/arangox/api/security.ex#L1)

ArangoDB's Security operations.

Every function takes the pool as its first argument and returns the decoded
response body. See `Arangox.API.Client` for the options they all accept and
for what a `404` returns.

# `reload_server_tls`

```elixir
@spec reload_server_tls(
  Arangox.conn(),
  keyword()
) :: {:ok, term()} | {:error, Exception.t()}
```

Reload the TLS data

This API call triggers a reload of all the TLS data (server key, client-auth CA)
and then returns a summary. The JSON response is exactly as in the corresponding
GET request.

This is a protected API and can only be executed with superuser rights.

# `reload_server_tls!`

```elixir
@spec reload_server_tls!(
  Arangox.conn(),
  keyword()
) :: term()
```

Reload the TLS data. Raises on error.

See `reload_server_tls/1`.

# `rotate_encryption_at_rest_key`

```elixir
@spec rotate_encryption_at_rest_key(
  Arangox.conn(),
  keyword()
) :: {:ok, term()} | {:error, Exception.t()}
```

Rotate the encryption at rest key

Change the user-supplied encryption at rest key by sending a request without
payload to this endpoint. The file supplied via `--rocksdb.encryption-keyfolder`
will be reloaded and the internal encryption key will be re-encrypted with the
new user key.

This is a protected API and can only be executed with superuser rights.
This API is not available on Coordinator nodes.

# `rotate_encryption_at_rest_key!`

```elixir
@spec rotate_encryption_at_rest_key!(
  Arangox.conn(),
  keyword()
) :: term()
```

Rotate the encryption at rest key. Raises on error.

See `rotate_encryption_at_rest_key/1`.

# `server_tls`

```elixir
@spec server_tls(
  Arangox.conn(),
  keyword()
) :: {:ok, term()} | {:error, Exception.t()}
```

Get the TLS data

Return a summary of the TLS data. The JSON response will contain a field
`result` with the following components:

- `keyfile`: Information about the key file.
- `clientCA`: Information about the Certificate Authority (CA) for
  client certificate verification.

If server name indication (SNI) is used and multiple key files are
configured for different server names, then there is an additional
attribute `SNI`, which contains for each configured server name
the corresponding information about the key file for that server name.

In all cases the value of the attribute will be a JSON object, which
has a subset of the following attributes (whatever is appropriate):

- `sha256`: The value is a string with the SHA256 of the whole input
  file.
- `certificates`: The value is a JSON array with the public
  certificates in the chain in the file.
- `privateKeySha256`: In cases where there is a private key (`keyfile`
  but not `clientCA`), this field is present and contains a
  JSON string with the SHA256 of the private key.

This API requires authentication.

## Returns

Recorded against ArangoDB 3.12.10:

    %{
      "code" => integer,
      "error" => boolean,
      "result" => %{}
    }

# `server_tls!`

```elixir
@spec server_tls!(
  Arangox.conn(),
  keyword()
) :: term()
```

Get the TLS data. Raises on error.

See `server_tls/1`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*