Keys
All operations require authentication.
List service keysProduction
Returns the service keys of the service, with their metadata.
Path parameters
Okms ID
Query parameters
Filter resources on IAM tags
Headers
Pagination cursor
Pagination size
Response
Whether the key has always been sensitive since creation
Class of the key
KEY_PAIRPUBLIC_KEYSECRET_KEYNumber of declared consumers
List of declared consumers of the key
Creation time of the key
Curve type for Elliptic Curve (EC) keys
P-256P-384P-521Whether the key material can be extracted from the KMS
IAM resource metadata
Key ID
The key in JWK format
The key in PEM format
Key name
Whether the key has never been extractable at any point in its lifetime
The operations for which the key is intended to be used
decryptencryptsignunwrapKeyverifywrapKeyKey protection level
HSMSOFTWAREWhether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form.
Size of the key
128192256384521204830724096State of the key
ACTIVEALLCOMPROMISEDDEACTIVATEDDESTROYEDDESTROYED_COMPROMISEDPRE_ACTIVEKey type
ECRSAoctExample uses okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/[ { "alwaysSensitive": true, "class": "KEY_PAIR", "consumerCount": 0, "consumers": [ { "additionalInfo": "string", "createdAt": "2024-01-01T12:00:00Z", "type": "string", "urn": "string" } ], "createdAt": "2024-01-01T12:00:00Z", "curve": "P-256", "extractable": true, "iam": { "displayName": "string", "id": "00000000-0000-0000-0000-000000000000", "state": "EXPIRED", "tags": { "key": "string" }, "urn": "string" }, "id": "00000000-0000-0000-0000-000000000000", "keys": [ { "alg": "ES256", "crv": "P-256", "d": "string", "dp": "string", "dq": "string", "e": "string", "k": "string", "key_ops": [ "decrypt" ], "kid": "string", "kty": "EC", "n": "string", "p": "string", "q": "string", "qi": "string", "use": "enc", "x": "string", "y": "string" } ], "keysPEM": [ { "pem": "string" } ], "name": "string", "neverExtractable": true, "operations": [ "decrypt" ], "protectionLevel": "HSM", "sensitive": true, "size": 128, "state": "ACTIVE", "type": "EC" }]
Create or import a service keyProduction
To create a new service key, omit the key material from the request. The KMS generates it from the type, size, curve and operations you specify.
To import an existing service key, supply its key material in the request. The key is stored in the KMS with the attributes you provide.
For a secure BYOK import, send the key material encrypted in wrappedKeys (RSA wrap) instead of in cleartext. The KMS unwraps it with the referenced transport key and stores the resulting service key.
Path parameters
Okms ID
Request body (required)
Context of the key
Curve type for Elliptic Curve (EC) keys
P-256P-384P-521Whether the key material can be extracted from the KMS. Defaults to false.
Set of JSON Web Keys in case of import, incompatible with type,size,curve and operations
Key name
The operations for which the key is intended to be used
decryptencryptsignunwrapKeyverifywrapKeyKey protection level
HSMSOFTWARESize of the key to be created
128192256384521204830724096Type of the key to be created
ECRSAoctResponse
Whether the key has always been sensitive since creation
Class of the key
KEY_PAIRPUBLIC_KEYSECRET_KEYNumber of declared consumers
List of declared consumers of the key
Creation time of the key
Curve type for Elliptic Curve (EC) keys
P-256P-384P-521Whether the key material can be extracted from the KMS
Key ID
The key in JWK format
The key in PEM format
Key name
Whether the key has never been extractable at any point in its lifetime
The operations for which the key is intended to be used
decryptencryptsignunwrapKeyverifywrapKeyKey protection level
HSMSOFTWAREWhether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form.
Size of the key
128192256384521204830724096State of the key
ACTIVEALLCOMPROMISEDDEACTIVATEDDESTROYEDDESTROYED_COMPROMISEDPRE_ACTIVEKey type
ECRSAoctExample uses okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/{ "alwaysSensitive": true, "class": "KEY_PAIR", "consumerCount": 0, "consumers": [ { "additionalInfo": "string", "createdAt": "2024-01-01T12:00:00Z", "type": "string", "urn": "string" } ], "createdAt": "2024-01-01T12:00:00Z", "curve": "P-256", "extractable": true, "id": "00000000-0000-0000-0000-000000000000", "keys": [ { "alg": "ES256", "crv": "P-256", "d": "string", "dp": "string", "dq": "string", "e": "string", "k": "string", "key_ops": [ "decrypt" ], "kid": "string", "kty": "EC", "n": "string", "p": "string", "q": "string", "qi": "string", "use": "enc", "x": "string", "y": "string" } ], "keysPEM": [ { "pem": "string" } ], "name": "string", "neverExtractable": true, "operations": [ "decrypt" ], "protectionLevel": "HSM", "sensitive": true, "size": 128, "state": "ACTIVE", "type": "EC"}
Get a service keyProduction
Returns one service key and its metadata. Pass optional format to also export the key material as JWK or PEM, when the key is extractable.
Path parameters
Key ID
Okms ID
Query parameters
Optional additional output format of the key
JWKPEMResponse
Whether the key has always been sensitive since creation
Class of the key
KEY_PAIRPUBLIC_KEYSECRET_KEYNumber of declared consumers
List of declared consumers of the key
Creation time of the key
Curve type for Elliptic Curve (EC) keys
P-256P-384P-521Whether the key material can be extracted from the KMS
IAM resource metadata
Key ID
The key in JWK format
The key in PEM format
Key name
Whether the key has never been extractable at any point in its lifetime
The operations for which the key is intended to be used
decryptencryptsignunwrapKeyverifywrapKeyKey protection level
HSMSOFTWAREWhether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form.
Size of the key
128192256384521204830724096State of the key
ACTIVEALLCOMPROMISEDDEACTIVATEDDESTROYEDDESTROYED_COMPROMISEDPRE_ACTIVEKey type
ECRSAoctExample uses keyId = 00000000-0000-0000-0000-000000000000, okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/{ "alwaysSensitive": true, "class": "KEY_PAIR", "consumerCount": 0, "consumers": [ { "additionalInfo": "string", "createdAt": "2024-01-01T12:00:00Z", "type": "string", "urn": "string" } ], "createdAt": "2024-01-01T12:00:00Z", "curve": "P-256", "extractable": true, "iam": { "displayName": "string", "id": "00000000-0000-0000-0000-000000000000", "state": "EXPIRED", "tags": { "key": "string" }, "urn": "string" }, "id": "00000000-0000-0000-0000-000000000000", "keys": [ { "alg": "ES256", "crv": "P-256", "d": "string", "dp": "string", "dq": "string", "e": "string", "k": "string", "key_ops": [ "decrypt" ], "kid": "string", "kty": "EC", "n": "string", "p": "string", "q": "string", "qi": "string", "use": "enc", "x": "string", "y": "string" } ], "keysPEM": [ { "pem": "string" } ], "name": "string", "neverExtractable": true, "operations": [ "decrypt" ], "protectionLevel": "HSM", "sensitive": true, "size": 128, "state": "ACTIVE", "type": "EC"}
Update a service keyProduction
Updates the key's name or extractability.
You can also change the key state to activate, deactivate, or mark it as compromised. Deactivation requires deactivationReason.
A deactivated key keeps its material in the KMS and can be reactivated later.
Path parameters
Key ID
Okms ID
Request body (required)
Key deactivation reason
AFFILIATION_CHANGEDCA_COMPROMISECESSATION_OF_OPERATIONKEY_COMPROMISEPRIVILEGE_WITHDRAWNSUPERSEDEDUNSPECIFIEDWhether the key material can be extracted from the KMS
Key Name
Key desired state for activation, deactivation and compromise (specific case of deactivation)
ACTIVECOMPROMISEDDEACTIVATEDResponse
Whether the key has always been sensitive since creation
Class of the key
KEY_PAIRPUBLIC_KEYSECRET_KEYNumber of declared consumers
List of declared consumers of the key
Creation time of the key
Curve type for Elliptic Curve (EC) keys
P-256P-384P-521Whether the key material can be extracted from the KMS
Key ID
The key in JWK format
The key in PEM format
Key name
Whether the key has never been extractable at any point in its lifetime
The operations for which the key is intended to be used
decryptencryptsignunwrapKeyverifywrapKeyKey protection level
HSMSOFTWAREWhether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form.
Size of the key
128192256384521204830724096State of the key
ACTIVEALLCOMPROMISEDDEACTIVATEDDESTROYEDDESTROYED_COMPROMISEDPRE_ACTIVEKey type
ECRSAoctExample uses keyId = 00000000-0000-0000-0000-000000000000, okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/{ "alwaysSensitive": true, "class": "KEY_PAIR", "consumerCount": 0, "consumers": [ { "additionalInfo": "string", "createdAt": "2024-01-01T12:00:00Z", "type": "string", "urn": "string" } ], "createdAt": "2024-01-01T12:00:00Z", "curve": "P-256", "extractable": true, "id": "00000000-0000-0000-0000-000000000000", "keys": [ { "alg": "ES256", "crv": "P-256", "d": "string", "dp": "string", "dq": "string", "e": "string", "k": "string", "key_ops": [ "decrypt" ], "kid": "string", "kty": "EC", "n": "string", "p": "string", "q": "string", "qi": "string", "use": "enc", "x": "string", "y": "string" } ], "keysPEM": [ { "pem": "string" } ], "name": "string", "neverExtractable": true, "operations": [ "decrypt" ], "protectionLevel": "HSM", "sensitive": true, "size": 128, "state": "ACTIVE", "type": "EC"}
Delete a service keyProduction
Permanently deletes the key and its material from the KMS. Once deleted, the key cannot be recovered.
The key must already be deactivated, unless force is set.
Path parameters
Key ID
Okms ID
Query parameters
Force deletion of the key
Response
Example uses keyId = 00000000-0000-0000-0000-000000000000, okmsId = 00000000-0000-0000-0000-000000000000
$ curl https:/