# April 28, 2025 - Enhanced security for encrypted tenant options

**URL:** <https://community.cumulocity.com/t/april-28-2025-enhanced-security-for-encrypted-tenant-options/12246>\
**Category:** Platform services\
**Tags:** Api-change, rest-api, platform-services\
**Created:** [May 6, 2025, 7:04am UTC](https://community.cumulocity.com/t/april-28-2025-enhanced-security-for-encrypted-tenant-options/12246 "2025-05-06T07:04:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/system/32/31990_2.png) [@system](https://community.cumulocity.com/u/system)\
**Post date:** [May 6, 2025, 7:04am UTC](https://community.cumulocity.com/t/april-28-2025-enhanced-security-for-encrypted-tenant-options/12246/1 "2025-05-06T07:04:00Z")

</div>

## Context

* * *

**Change Type:** API change  
**Product area:** Platform services  
**Component:** REST API  
**Deployed at:** [eu.latest.cumulocity.com](http://eu.latest.cumulocity.com), [apj.cumulocity.com](http://apj.cumulocity.com), [jp.cumulocity.com](http://jp.cumulocity.com), [cumulocity.com](http://cumulocity.com), [us.cumulocity.com](http://us.cumulocity.com)

> **Technical details**
>
> **Build artifact:** cumulocity (2025.116.0)  
> **Internal ID:** MTM-62399

## Description

* * *

A new security feature has been introduced to restrict the decryption of encrypted [tenant options](https://cumulocity.com/api/core/#tag/Options) with the `credentials.` prefix. These options can now only be decrypted by system users (such as bootstrap or microservice users) if they own the options.

Ownership is determined based on the category of the tenant option, in the following priority:

1. The `settingsCategory` defined in the microservice manifest.
2. The microservice’s context path.
3. The microservice name.

This change is currently disabled by default and can be enabled via a feature toggle `secure-tenant-options` through the [API](https://cumulocity.com/api/core/#operation/setCurrentTenantFeatureToggleValue).

> **Important**  
> In Q4 2025 for the SaaS instances and in 2026 for the yearly releases, this restriction will become **mandatory**. We strongly recommend reviewing your microservices now to ensure compatibility with the upcoming enforcement. This gives microservice developers time to adapt, especially if their services depend on reading `credentials.*` options in categories **not owned** by the microservice.