According to CLOUDP-17925, the Cloud team will make changes to the Public API to support encrypted backups, including:
Initiating (how?) encrypted backups
Initiating requests to rotate the key
Encryption fields/flags in backup-related resources

Changes needed:

• Bug on the documentation: "Backup Configurations" -> "storageEngine" field should be "storageEngineName"
• "Backup Configurations" -> New field "encryptionEnabled" indicates whether or not backup configuration is encrypted (boolean)
• "Snapshots" -> New field "parts.encryptionEnabled" indicates whether or not snapshot data is encrypted (boolean)
• "Snapshots" -> New field "parts.masterKeyUUID" is set with the masterKeyUUID of the encrypted data if encryption is enabled (String)
• "Restores Jobs" -> New field "encryptionEnabled" indicates whether or not restored snapshot data is encrypted (boolean)
• "Restore Jobs" -> New field "masterKeyUUID" is set with the masterKeyUUID of the encrypted data if encryption is enabled (String)
• Add API changes for getting and rotating backup configuration keys...

Note - all of these are Ops Manager Only. The fields labeled encryptionEnabled will always be false in Cloud Manager, and the masterKeyUUID field will therefore never appear.