Credentials

All operations require authentication.

4 operationsv2/okms/resource

OpenAPI

Agent setup

List access credentialsProduction

GET

/v2/okms/resource/{okmsId}/credential

Returns the access credentials of the service, with their identity, status and expiry. Private keys are never returned.

Path parameters

okmsId

required

stringuuid

Okms ID

Headers

X-Pagination-Cursor

string

Pagination cursor

X-Pagination-Size

integer

Pagination size

Response

200GetResponse[]successful operation

certificatePEM

read-only

string

Certificate PEM of the credential

certificateType

read-only

CertificateTypeEnum

Type of the certificate (ECDSA or RSA)

ValuesECDSARSA

createdAt

read-only

stringdate-time

Creation time of the credential

description

read-only

string

Description of the credential

expiredAt

read-only

stringdate-time

Expiration time of the credential

fromCSR

read-only

boolean

Is the credential generated from CSR

read-only

stringuuid

Unique identifier of the credential

identityURNs

read-only

string[]

List of identity URNs associated with the credential

name

read-only

string

Name of the credential

status

read-only

CredentialStatusEnum

Status of the credential

ValuesCREATINGDELETINGERROREXPIREDREADY

400objectError 400 response

Example uses okmsId = 00000000-0000-0000-0000-000000000000

$ curl https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/credential \
  -H "authorization: Bearer $OVH_TOKEN"

ResponseExample

1[2  {3    "certificatePEM": "string",4    "certificateType": "ECDSA",5    "createdAt": "2024-01-01T12:00:00Z",6    "description": "string",7    "expiredAt": "2024-01-01T12:00:00Z",8    "fromCSR": true,9    "id": "00000000-0000-0000-0000-000000000000",10    "identityURNs": [11      "string"12    ],13    "name": "string",14    "status": "CREATING"15  }16]

Create an access credentialProduction

POST

/v2/okms/resource/{okmsId}/credential

Issues a certificate-based access credential bound to the given identity URNs.

With a CSR, only the signed certificate is produced. Without one, a key pair is generated and the private key is returned in this response only. It can never be retrieved afterward.

Path parameters

okmsId

required

stringuuid

Okms ID

Request body (required)

certificateType

CertificateTypeEnum

Type of the certificate (ECDSA or RSA, incompatible with CSR)

ValuesECDSARSA

csr

string

Valid Certificate Signing Request

description

string

Description of the credential. At most 200.

identityURNs

required

string[]

List of identity URNs associated with the credential. At most 25.

name

required

string

Name of the credential. At most 50.

validity

integer

Validity in days (default 365, max 365)

Response

200CreationResponsesuccessful operation

certificateType

read-only

CertificateTypeEnum

Type of the certificate (ECDSA or RSA)

ValuesECDSARSA

createdAt

read-only

stringdate-time

Creation time of the credential

description

read-only

string

Description of the credential

expiredAt

read-only

stringdate-time

Expiration time of the credential

fromCSR

read-only

boolean

Is the credential generated from CSR

read-only

stringuuid

Unique identifier of the credential

identityURNs

read-only

string[]

List of identity URNs associated with the credential

name

read-only

string

Name of the credential

privateKeyPEM

read-only

stringpassword

Private Key PEM of the credential if no CSR is provided (cannot be retrieve later)

status

read-only

CredentialStatusEnum

Status of the credential

ValuesCREATINGDELETINGERROREXPIREDREADY

400objectError 400 response

Example uses okmsId = 00000000-0000-0000-0000-000000000000

$ curl https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/credential \
  -H "authorization: Bearer $OVH_TOKEN"

ResponseExample

1{2  "certificateType": "ECDSA",3  "createdAt": "2024-01-01T12:00:00Z",4  "description": "string",5  "expiredAt": "2024-01-01T12:00:00Z",6  "fromCSR": true,7  "id": "00000000-0000-0000-0000-000000000000",8  "identityURNs": [9    "string"10  ],11  "name": "string",12  "privateKeyPEM": "string",13  "status": "CREATING"14}

Get an access credentialProduction

GET

/v2/okms/resource/{okmsId}/credential/{credentialId}

Returns the metadata and certificate of an access credential. The private key is returned only when the credential is created and can never be retrieved afterward.

Path parameters

credentialId

required

stringuuid

Credential ID

okmsId

required

stringuuid

Okms ID

Response

200GetResponsesuccessful operation

certificatePEM

read-only

string

Certificate PEM of the credential

certificateType

read-only

CertificateTypeEnum

Type of the certificate (ECDSA or RSA)

ValuesECDSARSA

createdAt

read-only

stringdate-time

Creation time of the credential

description

read-only

string

Description of the credential

expiredAt

read-only

stringdate-time

Expiration time of the credential

fromCSR

read-only

boolean

Is the credential generated from CSR

read-only

stringuuid

Unique identifier of the credential

identityURNs

read-only

string[]

List of identity URNs associated with the credential

name

read-only

string

Name of the credential

status

read-only

CredentialStatusEnum

Status of the credential

ValuesCREATINGDELETINGERROREXPIREDREADY

Example uses credentialId = 00000000-0000-0000-0000-000000000000, okmsId = 00000000-0000-0000-0000-000000000000

$ curl https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/credential/{credentialId} \
  -H "authorization: Bearer $OVH_TOKEN"

ResponseExample

1{2  "certificatePEM": "string",3  "certificateType": "ECDSA",4  "createdAt": "2024-01-01T12:00:00Z",5  "description": "string",6  "expiredAt": "2024-01-01T12:00:00Z",7  "fromCSR": true,8  "id": "00000000-0000-0000-0000-000000000000",9  "identityURNs": [10    "string"11  ],12  "name": "string",13  "status": "CREATING"14}

Delete an access credentialProduction

DELETE

/v2/okms/resource/{okmsId}/credential/{credentialId}

Revokes the credential and removes it. It can no longer be used to authenticate to the KMS.

Path parameters

credentialId

required

stringuuid

Credential ID

okmsId

required

stringuuid

Okms ID

Response

200GetResponsesuccessful operation

certificatePEM

read-only

string

Certificate PEM of the credential

certificateType

read-only

CertificateTypeEnum

Type of the certificate (ECDSA or RSA)

ValuesECDSARSA

createdAt

read-only

stringdate-time

Creation time of the credential

description

read-only

string

Description of the credential

expiredAt

read-only

stringdate-time

Expiration time of the credential

fromCSR

read-only

boolean

Is the credential generated from CSR

read-only

stringuuid

Unique identifier of the credential

identityURNs

read-only

string[]

List of identity URNs associated with the credential

name

read-only

string

Name of the credential

status

read-only

CredentialStatusEnum

Status of the credential

ValuesCREATINGDELETINGERROREXPIREDREADY

400objectError 400 response

Example uses credentialId = 00000000-0000-0000-0000-000000000000, okmsId = 00000000-0000-0000-0000-000000000000

$ curl https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/credential/{credentialId} \
  -H "authorization: Bearer $OVH_TOKEN"

ResponseExample

1{2  "certificatePEM": "string",3  "certificateType": "ECDSA",4  "createdAt": "2024-01-01T12:00:00Z",5  "description": "string",6  "expiredAt": "2024-01-01T12:00:00Z",7  "fromCSR": true,8  "id": "00000000-0000-0000-0000-000000000000",9  "identityURNs": [10    "string"11  ],12  "name": "string",13  "status": "CREATING"14}