# Manage & Operate › Key and Secret Manager › Keys API

> Part of the OVHcloud developer hub. Index of every page and section: https://developers.eu.ovhcloud.com/llms.txt
> The Manage & Operate product's sections: https://developers.eu.ovhcloud.com/reference/manage-operate/llms.txt
> Everything in one file: https://developers.eu.ovhcloud.com/llms-full.txt

> 5 operations of the OVHcloud API. Calls carry `authorization: Bearer $OVH_TOKEN`; the EU host is shown, Canada and the United States answer on api.ca.ovhcloud.com and api.us.ovhcloud.com.

Page: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/keys/

OpenAPI v1: https://api.eu.ovhcloud.com/1.0/__schemas/developer-hub-navigation/manage-operate/key-and-secret-manager/keys.json?format=openapi3
OpenAPI v2: https://api.eu.ovhcloud.com/v2/__schemas/developer-hub-navigation/manage-operate/key-and-secret-manager/keys.json?format=openapi3

## Operations

- `GET /okms/resource/{okmsId}/serviceKey` — List service keys
- `POST /okms/resource/{okmsId}/serviceKey` — Create or import a service key
- `GET /okms/resource/{okmsId}/serviceKey/{keyId}` — Get a service key
- `PUT /okms/resource/{okmsId}/serviceKey/{keyId}` — Update a service key
- `DELETE /okms/resource/{okmsId}/serviceKey/{keyId}` — Delete a service key

## List service keys

`GET /v2/okms/resource/{okmsId}/serviceKey`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/keys/#get-okms-resource-okmsid-servicekey

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:serviceKey/get`

Returns the service keys of the service, with their metadata.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Pagination-Cursor` | header | string |  | Pagination cursor |
| `X-Pagination-Size` | header | integer |  | Pagination size |
| `iamTags` | query | object |  | Filter resources on IAM tags |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.serviceKey.ResponseWithIAM[] | successful operation |
| 400 | object | Error 400 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `alwaysSensitive` | boolean | read-only | Whether the key has always been sensitive since creation |
| `class` | okms.KeyClassEnum | read-only | Class of the key — one of `KEY_PAIR`, `PUBLIC_KEY`, `SECRET_KEY` |
| `consumerCount` | integer | read-only | Number of declared consumers |
| `consumers` | okms.serviceKey.Consumer[] | read-only | List of declared consumers of the key |
| `consumers[].additionalInfo` | string | read-only | Additionnal information on the consumer |
| `consumers[].createdAt` | string (date-time) | read-only | Date of consumer declaration |
| `consumers[].type` | string | read-only | Type of resource consuming the key |
| `consumers[].urn` | string | read-only | Urn of the resource consuming the key |
| `createdAt` | string (date-time) | read-only | Creation time of the key |
| `curve` | okms.KeyCurveEnum | read-only | Curve type for Elliptic Curve (EC) keys — one of `P-256`, `P-384`, `P-521` |
| `extractable` | boolean | read-only | Whether the key material can be extracted from the KMS |
| `iam` | iam.ResourceMetadata | read-only | IAM resource metadata |
| `iam.displayName` | string | read-only | Resource display name |
| `iam.id` | string (uuid) | read-only | Unique identifier of the resource |
| `iam.state` | iam.ResourceMetadata.StateEnum | read-only | Resource state — one of `EXPIRED`, `IN_CREATION`, `OK`, `SUSPENDED` |
| `iam.tags` | object | read-only | Resource tags. Tags that were internally computed are prefixed with ovh: |
| `iam.urn` | string | read-only | Unique resource name used in policies |
| `id` | string (uuid) | read-only | Key ID |
| `keys` | okms.serviceKey.JsonWebKeyResponse[] | read-only | The key in JWK format |
| `keys[].alg` | okms.KeyAlgEnum | read-only | The algorithm intended to be used with the key — one of `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512`, `RS256`, `RS384`, `RS512` |
| `keys[].crv` | okms.KeyCurveEnum | read-only | The cryptographic curve used with the key — one of `P-256`, `P-384`, `P-521` |
| `keys[].d` | string (password) | read-only | The RSA or EC private exponent |
| `keys[].dp` | string (password) | read-only | The RSA private key's first factor CRT exponent |
| `keys[].dq` | string (password) | read-only | The RSA private key's second factor CRT exponent |
| `keys[].e` | string | read-only | The exponent value for the RSA public key |
| `keys[].k` | string (password) | read-only | The value of the symmetric (or other single-valued) key |
| `keys[].key_ops` | okms.KeyOpsEnum[] | read-only | The operation for which the key is intended to be used |
| `keys[].kid` | string | read-only | key ID parameter used to match a specific key |
| `keys[].kty` | okms.KeyTypeEnum | read-only | Key type parameter identifies the cryptographic algorithm family used with the key, such as RSA or EC — one of `EC`, `RSA`, `oct` |
| `keys[].n` | string | read-only | The modulus value for the RSA public key |
| `keys[].p` | string (password) | read-only | The first prime factor of the RSA private key |
| `keys[].q` | string (password) | read-only | The second prime factor of the RSA private key |
| `keys[].qi` | string (password) | read-only | The CRT coefficient of the second factor of the RSA private key |
| `keys[].use` | okms.KeyUseEnum | read-only | The intended use of the public key — one of `enc`, `sig` |
| `keys[].x` | string | read-only | The x coordinate for the Elliptic Curve point |
| `keys[].y` | string | read-only | The y coordinate for the Elliptic Curve point |
| `keysPEM` | okms.serviceKey.PEM[] | read-only | The key in PEM format |
| `keysPEM[].pem` | string | read-only | Data in PEM format |
| `name` | string | read-only | Key name |
| `neverExtractable` | boolean | read-only | Whether the key has never been extractable at any point in its lifetime |
| `operations` | okms.KeyOpsEnum[] | read-only | The operations for which the key is intended to be used |
| `protectionLevel` | okms.KeyProtectionLevelEnum | read-only | Key protection level — one of `HSM`, `SOFTWARE` |
| `sensitive` | boolean | read-only | Whether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form. |
| `size` | okms.KeySizeEnum | read-only | Size of the key — one of `128`, `192`, `256`, `384`, `521`, `2048`, `3072`, `4096` |
| `state` | okms.KeyStateEnum | read-only | State of the key — one of `ACTIVE`, `ALL`, `COMPROMISED`, `DEACTIVATED`, `DESTROYED`, `DESTROYED_COMPROMISED`, `PRE_ACTIVE` |
| `type` | okms.KeyTypeEnum | read-only | Key type — one of `EC`, `RSA`, `oct` |

```json
[
  {
    "alwaysSensitive": true,
    "class": "KEY_PAIR",
    "consumerCount": 0,
    "consumers": [
      {
        "additionalInfo": "string",
        "createdAt": "2024-01-01T12:00:00Z",
        "type": "string",
        "urn": "string"
      }
    ],
    "createdAt": "2024-01-01T12:00:00Z",
    "curve": "P-256",
    "extractable": true,
    "iam": {
      "displayName": "string",
      "id": "00000000-0000-0000-0000-000000000000",
      "state": "EXPIRED",
      "tags": {
        "key": "string"
      },
      "urn": "string"
    },
    "id": "00000000-0000-0000-0000-000000000000",
    "keys": [
      {
        "alg": "ES256",
        "crv": "P-256",
        "d": "string",
        "dp": "string",
        "dq": "string",
        "e": "string",
        "k": "string",
        "key_ops": [
          "decrypt"
        ],
        "kid": "string",
        "kty": "EC",
        "n": "string",
        "p": "string",
        "q": "string",
        "qi": "string",
        "use": "enc",
        "x": "string",
        "y": "string"
      }
    ],
    "keysPEM": [
      {
        "pem": "string"
      }
    ],
    "name": "string",
    "neverExtractable": true,
    "operations": [
      "decrypt"
    ],
    "protectionLevel": "HSM",
    "sensitive": true,
    "size": 128,
    "state": "ACTIVE",
    "type": "EC"
  }
]
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/serviceKey" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/resource/{okmsId}/serviceKey")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/resource/{okmsId}/serviceKey");

print_r($result);
?>
```

## Create or import a service key

`POST /v2/okms/resource/{okmsId}/serviceKey`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/keys/#post-okms-resource-okmsid-servicekey

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:serviceKey/create`, `okms:apiovh:serviceKey/import`

To create a new service key, omit the key material from the request. The KMS generates it from the type, size, curve and operations you specify.

To import an existing service key, supply its key material in the request. The key is stored in the KMS with the attributes you provide.

For a secure BYOK import, send the key material encrypted in `wrappedKeys` (RSA wrap) instead of in cleartext. The KMS unwraps it with the referenced transport key and stores the resulting service key.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Request body (required)

Type: `okms.serviceKey.Creation`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `context` | string |  | Context of the key |
| `curve` | okms.KeyCurveEnum |  | Curve type for Elliptic Curve (EC) keys — one of `P-256`, `P-384`, `P-521` |
| `extractable` | boolean |  | Whether the key material can be extracted from the KMS. Defaults to false. |
| `keys` | okms.serviceKey.JsonWebKeyRequest[] |  | Set of JSON Web Keys in case of import, incompatible with type,size,curve and operations |
| `keys[].alg` | okms.KeyAlgEnum |  | The algorithm intended to be used with the key — one of `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512`, `RS256`, `RS384`, `RS512` |
| `keys[].crv` | okms.KeyCurveEnum |  | The cryptographic curve used with the key — one of `P-256`, `P-384`, `P-521` |
| `keys[].d` | string (password) |  | The RSA or EC private exponent |
| `keys[].dp` | string (password) |  | The RSA private key's first factor CRT exponent |
| `keys[].dq` | string (password) |  | The RSA private key's second factor CRT exponent |
| `keys[].e` | string |  | The exponent value for the RSA public key |
| `keys[].k` | string (password) |  | The value of the symmetric (or other single-valued) key |
| `keys[].key_ops` | okms.KeyOpsEnum[] |  | The operation for which the key is intended to be used |
| `keys[].kid` | string |  | key ID parameter used to match a specific key |
| `keys[].kty` | okms.KeyTypeEnum | yes | Key type parameter identifies the cryptographic algorithm family used with the key, such as RSA or EC — one of `EC`, `RSA`, `oct` |
| `keys[].n` | string |  | The modulus value for the RSA public key |
| `keys[].p` | string (password) |  | The first prime factor of the RSA private key |
| `keys[].q` | string (password) |  | The second prime factor of the RSA private key |
| `keys[].qi` | string (password) |  | The CRT coefficient of the second factor of the RSA private key |
| `keys[].use` | okms.KeyUseEnum |  | The intended use of the public key — one of `enc`, `sig` |
| `keys[].x` | string |  | The x coordinate for the Elliptic Curve point |
| `keys[].y` | string |  | The y coordinate for the Elliptic Curve point |
| `name` | string |  | Key name |
| `operations` | okms.KeyOpsEnum[] |  | The operations for which the key is intended to be used |
| `protectionLevel` | okms.KeyProtectionLevelEnum |  | Key protection level — one of `HSM`, `SOFTWARE` |
| `size` | okms.KeySizeEnum |  | Size of the key to be created — one of `128`, `192`, `256`, `384`, `521`, `2048`, `3072`, `4096` |
| `type` | okms.KeyTypeEnum |  | Type of the key to be created — one of `EC`, `RSA`, `oct` |

```json
{
  "context": "string",
  "curve": "P-256",
  "extractable": true,
  "keys": [
    {
      "alg": "ES256",
      "crv": "P-256",
      "d": "string",
      "dp": "string",
      "dq": "string",
      "e": "string",
      "k": "string",
      "key_ops": [
        "decrypt"
      ],
      "kid": "string",
      "kty": "EC",
      "n": "string",
      "p": "string",
      "q": "string",
      "qi": "string",
      "use": "enc",
      "x": "string",
      "y": "string"
    }
  ],
  "name": "string",
  "operations": [
    "decrypt"
  ],
  "protectionLevel": "HSM",
  "size": 128,
  "type": "EC"
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.serviceKey.Response | successful operation |
| 400 | object | Error 400 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `alwaysSensitive` | boolean | read-only | Whether the key has always been sensitive since creation |
| `class` | okms.KeyClassEnum | read-only | Class of the key — one of `KEY_PAIR`, `PUBLIC_KEY`, `SECRET_KEY` |
| `consumerCount` | integer | read-only | Number of declared consumers |
| `consumers` | okms.serviceKey.Consumer[] | read-only | List of declared consumers of the key |
| `consumers[].additionalInfo` | string | read-only | Additionnal information on the consumer |
| `consumers[].createdAt` | string (date-time) | read-only | Date of consumer declaration |
| `consumers[].type` | string | read-only | Type of resource consuming the key |
| `consumers[].urn` | string | read-only | Urn of the resource consuming the key |
| `createdAt` | string (date-time) | read-only | Creation time of the key |
| `curve` | okms.KeyCurveEnum | read-only | Curve type for Elliptic Curve (EC) keys — one of `P-256`, `P-384`, `P-521` |
| `extractable` | boolean | read-only | Whether the key material can be extracted from the KMS |
| `id` | string (uuid) | read-only | Key ID |
| `keys` | okms.serviceKey.JsonWebKeyResponse[] | read-only | The key in JWK format |
| `keys[].alg` | okms.KeyAlgEnum | read-only | The algorithm intended to be used with the key — one of `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512`, `RS256`, `RS384`, `RS512` |
| `keys[].crv` | okms.KeyCurveEnum | read-only | The cryptographic curve used with the key — one of `P-256`, `P-384`, `P-521` |
| `keys[].d` | string (password) | read-only | The RSA or EC private exponent |
| `keys[].dp` | string (password) | read-only | The RSA private key's first factor CRT exponent |
| `keys[].dq` | string (password) | read-only | The RSA private key's second factor CRT exponent |
| `keys[].e` | string | read-only | The exponent value for the RSA public key |
| `keys[].k` | string (password) | read-only | The value of the symmetric (or other single-valued) key |
| `keys[].key_ops` | okms.KeyOpsEnum[] | read-only | The operation for which the key is intended to be used |
| `keys[].kid` | string | read-only | key ID parameter used to match a specific key |
| `keys[].kty` | okms.KeyTypeEnum | read-only | Key type parameter identifies the cryptographic algorithm family used with the key, such as RSA or EC — one of `EC`, `RSA`, `oct` |
| `keys[].n` | string | read-only | The modulus value for the RSA public key |
| `keys[].p` | string (password) | read-only | The first prime factor of the RSA private key |
| `keys[].q` | string (password) | read-only | The second prime factor of the RSA private key |
| `keys[].qi` | string (password) | read-only | The CRT coefficient of the second factor of the RSA private key |
| `keys[].use` | okms.KeyUseEnum | read-only | The intended use of the public key — one of `enc`, `sig` |
| `keys[].x` | string | read-only | The x coordinate for the Elliptic Curve point |
| `keys[].y` | string | read-only | The y coordinate for the Elliptic Curve point |
| `keysPEM` | okms.serviceKey.PEM[] | read-only | The key in PEM format |
| `keysPEM[].pem` | string | read-only | Data in PEM format |
| `name` | string | read-only | Key name |
| `neverExtractable` | boolean | read-only | Whether the key has never been extractable at any point in its lifetime |
| `operations` | okms.KeyOpsEnum[] | read-only | The operations for which the key is intended to be used |
| `protectionLevel` | okms.KeyProtectionLevelEnum | read-only | Key protection level — one of `HSM`, `SOFTWARE` |
| `sensitive` | boolean | read-only | Whether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form. |
| `size` | okms.KeySizeEnum | read-only | Size of the key — one of `128`, `192`, `256`, `384`, `521`, `2048`, `3072`, `4096` |
| `state` | okms.KeyStateEnum | read-only | State of the key — one of `ACTIVE`, `ALL`, `COMPROMISED`, `DEACTIVATED`, `DESTROYED`, `DESTROYED_COMPROMISED`, `PRE_ACTIVE` |
| `type` | okms.KeyTypeEnum | read-only | Key type — one of `EC`, `RSA`, `oct` |

```json
{
  "alwaysSensitive": true,
  "class": "KEY_PAIR",
  "consumerCount": 0,
  "consumers": [
    {
      "additionalInfo": "string",
      "createdAt": "2024-01-01T12:00:00Z",
      "type": "string",
      "urn": "string"
    }
  ],
  "createdAt": "2024-01-01T12:00:00Z",
  "curve": "P-256",
  "extractable": true,
  "id": "00000000-0000-0000-0000-000000000000",
  "keys": [
    {
      "alg": "ES256",
      "crv": "P-256",
      "d": "string",
      "dp": "string",
      "dq": "string",
      "e": "string",
      "k": "string",
      "key_ops": [
        "decrypt"
      ],
      "kid": "string",
      "kty": "EC",
      "n": "string",
      "p": "string",
      "q": "string",
      "qi": "string",
      "use": "enc",
      "x": "string",
      "y": "string"
    }
  ],
  "keysPEM": [
    {
      "pem": "string"
    }
  ],
  "name": "string",
  "neverExtractable": true,
  "operations": [
    "decrypt"
  ],
  "protectionLevel": "HSM",
  "sensitive": true,
  "size": 128,
  "state": "ACTIVE",
  "type": "EC"
}
```

### Example

```bash
curl -X POST \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/serviceKey" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: okms.serviceKey.Creation
result = client.post("/v2/okms/resource/{okmsId}/serviceKey",
	context = None, # Context of the key (type: string, nullable)
	curve = None, # Curve type for Elliptic Curve (EC) keys (type: okms.KeyCurveEnum, nullable)
	extractable = None, # Whether the key material can be extracted from the KMS. Defaults to false. (type: boolean, nullable)
	keys = None, # Set of JSON Web Keys in case of import, incompatible with type,size,curve and operations (type: array, nullable)
	name = None, # Key name (type: string)
	operations = None, # The operations for which the key is intended to be used (type: array, nullable)
	protectionLevel = None, # Key protection level (type: okms.KeyProtectionLevelEnum, nullable)
	size = None, # Size of the key to be created (type: okms.KeySizeEnum, nullable)
	type = None, # Type of the key to be created (type: okms.KeyTypeEnum, nullable)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: okms.serviceKey.Creation
$result = $ovh->post("/v2/okms/resource/{okmsId}/serviceKey", array(
	context => null, // Context of the key (type: string, nullable)
	curve => null, // Curve type for Elliptic Curve (EC) keys (type: okms.KeyCurveEnum, nullable)
	extractable => null, // Whether the key material can be extracted from the KMS. Defaults to false. (type: boolean, nullable)
	keys => null, // Set of JSON Web Keys in case of import, incompatible with type,size,curve and operations (type: array, nullable)
	name => null, // Key name (type: string)
	operations => null, // The operations for which the key is intended to be used (type: array, nullable)
	protectionLevel => null, // Key protection level (type: okms.KeyProtectionLevelEnum, nullable)
	size => null, // Size of the key to be created (type: okms.KeySizeEnum, nullable)
	type => null, // Type of the key to be created (type: okms.KeyTypeEnum, nullable)
));

print_r($result);
?>
```

## Get a service key

`GET /v2/okms/resource/{okmsId}/serviceKey/{keyId}`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/keys/#get-okms-resource-okmsid-servicekey-keyid

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:serviceKey/get`

Returns one service key and its metadata. Pass optional `format` to also export the key material as JWK or PEM, when the key is extractable.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `format` | query | okms.KeyFormatEnum |  | Optional additional output format of the key — one of `JWK`, `PEM` |
| `keyId` | path | string (uuid) | yes | Key ID |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.serviceKey.ResponseWithIAM | successful operation |
| 400 | object | Error 400 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `alwaysSensitive` | boolean | read-only | Whether the key has always been sensitive since creation |
| `class` | okms.KeyClassEnum | read-only | Class of the key — one of `KEY_PAIR`, `PUBLIC_KEY`, `SECRET_KEY` |
| `consumerCount` | integer | read-only | Number of declared consumers |
| `consumers` | okms.serviceKey.Consumer[] | read-only | List of declared consumers of the key |
| `consumers[].additionalInfo` | string | read-only | Additionnal information on the consumer |
| `consumers[].createdAt` | string (date-time) | read-only | Date of consumer declaration |
| `consumers[].type` | string | read-only | Type of resource consuming the key |
| `consumers[].urn` | string | read-only | Urn of the resource consuming the key |
| `createdAt` | string (date-time) | read-only | Creation time of the key |
| `curve` | okms.KeyCurveEnum | read-only | Curve type for Elliptic Curve (EC) keys — one of `P-256`, `P-384`, `P-521` |
| `extractable` | boolean | read-only | Whether the key material can be extracted from the KMS |
| `iam` | iam.ResourceMetadata | read-only | IAM resource metadata |
| `iam.displayName` | string | read-only | Resource display name |
| `iam.id` | string (uuid) | read-only | Unique identifier of the resource |
| `iam.state` | iam.ResourceMetadata.StateEnum | read-only | Resource state — one of `EXPIRED`, `IN_CREATION`, `OK`, `SUSPENDED` |
| `iam.tags` | object | read-only | Resource tags. Tags that were internally computed are prefixed with ovh: |
| `iam.urn` | string | read-only | Unique resource name used in policies |
| `id` | string (uuid) | read-only | Key ID |
| `keys` | okms.serviceKey.JsonWebKeyResponse[] | read-only | The key in JWK format |
| `keys[].alg` | okms.KeyAlgEnum | read-only | The algorithm intended to be used with the key — one of `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512`, `RS256`, `RS384`, `RS512` |
| `keys[].crv` | okms.KeyCurveEnum | read-only | The cryptographic curve used with the key — one of `P-256`, `P-384`, `P-521` |
| `keys[].d` | string (password) | read-only | The RSA or EC private exponent |
| `keys[].dp` | string (password) | read-only | The RSA private key's first factor CRT exponent |
| `keys[].dq` | string (password) | read-only | The RSA private key's second factor CRT exponent |
| `keys[].e` | string | read-only | The exponent value for the RSA public key |
| `keys[].k` | string (password) | read-only | The value of the symmetric (or other single-valued) key |
| `keys[].key_ops` | okms.KeyOpsEnum[] | read-only | The operation for which the key is intended to be used |
| `keys[].kid` | string | read-only | key ID parameter used to match a specific key |
| `keys[].kty` | okms.KeyTypeEnum | read-only | Key type parameter identifies the cryptographic algorithm family used with the key, such as RSA or EC — one of `EC`, `RSA`, `oct` |
| `keys[].n` | string | read-only | The modulus value for the RSA public key |
| `keys[].p` | string (password) | read-only | The first prime factor of the RSA private key |
| `keys[].q` | string (password) | read-only | The second prime factor of the RSA private key |
| `keys[].qi` | string (password) | read-only | The CRT coefficient of the second factor of the RSA private key |
| `keys[].use` | okms.KeyUseEnum | read-only | The intended use of the public key — one of `enc`, `sig` |
| `keys[].x` | string | read-only | The x coordinate for the Elliptic Curve point |
| `keys[].y` | string | read-only | The y coordinate for the Elliptic Curve point |
| `keysPEM` | okms.serviceKey.PEM[] | read-only | The key in PEM format |
| `keysPEM[].pem` | string | read-only | Data in PEM format |
| `name` | string | read-only | Key name |
| `neverExtractable` | boolean | read-only | Whether the key has never been extractable at any point in its lifetime |
| `operations` | okms.KeyOpsEnum[] | read-only | The operations for which the key is intended to be used |
| `protectionLevel` | okms.KeyProtectionLevelEnum | read-only | Key protection level — one of `HSM`, `SOFTWARE` |
| `sensitive` | boolean | read-only | Whether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form. |
| `size` | okms.KeySizeEnum | read-only | Size of the key — one of `128`, `192`, `256`, `384`, `521`, `2048`, `3072`, `4096` |
| `state` | okms.KeyStateEnum | read-only | State of the key — one of `ACTIVE`, `ALL`, `COMPROMISED`, `DEACTIVATED`, `DESTROYED`, `DESTROYED_COMPROMISED`, `PRE_ACTIVE` |
| `type` | okms.KeyTypeEnum | read-only | Key type — one of `EC`, `RSA`, `oct` |

```json
{
  "alwaysSensitive": true,
  "class": "KEY_PAIR",
  "consumerCount": 0,
  "consumers": [
    {
      "additionalInfo": "string",
      "createdAt": "2024-01-01T12:00:00Z",
      "type": "string",
      "urn": "string"
    }
  ],
  "createdAt": "2024-01-01T12:00:00Z",
  "curve": "P-256",
  "extractable": true,
  "iam": {
    "displayName": "string",
    "id": "00000000-0000-0000-0000-000000000000",
    "state": "EXPIRED",
    "tags": {
      "key": "string"
    },
    "urn": "string"
  },
  "id": "00000000-0000-0000-0000-000000000000",
  "keys": [
    {
      "alg": "ES256",
      "crv": "P-256",
      "d": "string",
      "dp": "string",
      "dq": "string",
      "e": "string",
      "k": "string",
      "key_ops": [
        "decrypt"
      ],
      "kid": "string",
      "kty": "EC",
      "n": "string",
      "p": "string",
      "q": "string",
      "qi": "string",
      "use": "enc",
      "x": "string",
      "y": "string"
    }
  ],
  "keysPEM": [
    {
      "pem": "string"
    }
  ],
  "name": "string",
  "neverExtractable": true,
  "operations": [
    "decrypt"
  ],
  "protectionLevel": "HSM",
  "sensitive": true,
  "size": 128,
  "state": "ACTIVE",
  "type": "EC"
}
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/serviceKey/{keyId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/resource/{okmsId}/serviceKey/{keyId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/resource/{okmsId}/serviceKey/{keyId}");

print_r($result);
?>
```

## Update a service key

`PUT /v2/okms/resource/{okmsId}/serviceKey/{keyId}`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/keys/#put-okms-resource-okmsid-servicekey-keyid

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:serviceKey/update`, `okms:apiovh:serviceKey/activate`, `okms:apiovh:serviceKey/deactivate`

Updates the key's name or extractability.

You can also change the key state to activate, deactivate, or mark it as compromised. Deactivation requires `deactivationReason`.

A deactivated key keeps its material in the KMS and can be reactivated later.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `keyId` | path | string (uuid) | yes | Key ID |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Request body (required)

Type: `okms.serviceKey.Update`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `deactivationReason` | okms.KeyDeactivationReasonEnum |  | Key deactivation reason — one of `AFFILIATION_CHANGED`, `CA_COMPROMISE`, `CESSATION_OF_OPERATION`, `KEY_COMPROMISE`, `PRIVILEGE_WITHDRAWN`, `SUPERSEDED`, `UNSPECIFIED` |
| `extractable` | boolean |  | Whether the key material can be extracted from the KMS |
| `name` | string |  | Key Name |
| `state` | okms.KeyStateUpdateEnum |  | Key desired state for activation, deactivation and compromise (specific case of deactivation) — one of `ACTIVE`, `COMPROMISED`, `DEACTIVATED` |

```json
{
  "deactivationReason": "AFFILIATION_CHANGED",
  "extractable": true,
  "name": "string",
  "state": "ACTIVE"
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.serviceKey.Response | successful operation |
| 400 | object | Error 400 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `alwaysSensitive` | boolean | read-only | Whether the key has always been sensitive since creation |
| `class` | okms.KeyClassEnum | read-only | Class of the key — one of `KEY_PAIR`, `PUBLIC_KEY`, `SECRET_KEY` |
| `consumerCount` | integer | read-only | Number of declared consumers |
| `consumers` | okms.serviceKey.Consumer[] | read-only | List of declared consumers of the key |
| `consumers[].additionalInfo` | string | read-only | Additionnal information on the consumer |
| `consumers[].createdAt` | string (date-time) | read-only | Date of consumer declaration |
| `consumers[].type` | string | read-only | Type of resource consuming the key |
| `consumers[].urn` | string | read-only | Urn of the resource consuming the key |
| `createdAt` | string (date-time) | read-only | Creation time of the key |
| `curve` | okms.KeyCurveEnum | read-only | Curve type for Elliptic Curve (EC) keys — one of `P-256`, `P-384`, `P-521` |
| `extractable` | boolean | read-only | Whether the key material can be extracted from the KMS |
| `id` | string (uuid) | read-only | Key ID |
| `keys` | okms.serviceKey.JsonWebKeyResponse[] | read-only | The key in JWK format |
| `keys[].alg` | okms.KeyAlgEnum | read-only | The algorithm intended to be used with the key — one of `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512`, `RS256`, `RS384`, `RS512` |
| `keys[].crv` | okms.KeyCurveEnum | read-only | The cryptographic curve used with the key — one of `P-256`, `P-384`, `P-521` |
| `keys[].d` | string (password) | read-only | The RSA or EC private exponent |
| `keys[].dp` | string (password) | read-only | The RSA private key's first factor CRT exponent |
| `keys[].dq` | string (password) | read-only | The RSA private key's second factor CRT exponent |
| `keys[].e` | string | read-only | The exponent value for the RSA public key |
| `keys[].k` | string (password) | read-only | The value of the symmetric (or other single-valued) key |
| `keys[].key_ops` | okms.KeyOpsEnum[] | read-only | The operation for which the key is intended to be used |
| `keys[].kid` | string | read-only | key ID parameter used to match a specific key |
| `keys[].kty` | okms.KeyTypeEnum | read-only | Key type parameter identifies the cryptographic algorithm family used with the key, such as RSA or EC — one of `EC`, `RSA`, `oct` |
| `keys[].n` | string | read-only | The modulus value for the RSA public key |
| `keys[].p` | string (password) | read-only | The first prime factor of the RSA private key |
| `keys[].q` | string (password) | read-only | The second prime factor of the RSA private key |
| `keys[].qi` | string (password) | read-only | The CRT coefficient of the second factor of the RSA private key |
| `keys[].use` | okms.KeyUseEnum | read-only | The intended use of the public key — one of `enc`, `sig` |
| `keys[].x` | string | read-only | The x coordinate for the Elliptic Curve point |
| `keys[].y` | string | read-only | The y coordinate for the Elliptic Curve point |
| `keysPEM` | okms.serviceKey.PEM[] | read-only | The key in PEM format |
| `keysPEM[].pem` | string | read-only | Data in PEM format |
| `name` | string | read-only | Key name |
| `neverExtractable` | boolean | read-only | Whether the key has never been extractable at any point in its lifetime |
| `operations` | okms.KeyOpsEnum[] | read-only | The operations for which the key is intended to be used |
| `protectionLevel` | okms.KeyProtectionLevelEnum | read-only | Key protection level — one of `HSM`, `SOFTWARE` |
| `sensitive` | boolean | read-only | Whether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form. |
| `size` | okms.KeySizeEnum | read-only | Size of the key — one of `128`, `192`, `256`, `384`, `521`, `2048`, `3072`, `4096` |
| `state` | okms.KeyStateEnum | read-only | State of the key — one of `ACTIVE`, `ALL`, `COMPROMISED`, `DEACTIVATED`, `DESTROYED`, `DESTROYED_COMPROMISED`, `PRE_ACTIVE` |
| `type` | okms.KeyTypeEnum | read-only | Key type — one of `EC`, `RSA`, `oct` |

```json
{
  "alwaysSensitive": true,
  "class": "KEY_PAIR",
  "consumerCount": 0,
  "consumers": [
    {
      "additionalInfo": "string",
      "createdAt": "2024-01-01T12:00:00Z",
      "type": "string",
      "urn": "string"
    }
  ],
  "createdAt": "2024-01-01T12:00:00Z",
  "curve": "P-256",
  "extractable": true,
  "id": "00000000-0000-0000-0000-000000000000",
  "keys": [
    {
      "alg": "ES256",
      "crv": "P-256",
      "d": "string",
      "dp": "string",
      "dq": "string",
      "e": "string",
      "k": "string",
      "key_ops": [
        "decrypt"
      ],
      "kid": "string",
      "kty": "EC",
      "n": "string",
      "p": "string",
      "q": "string",
      "qi": "string",
      "use": "enc",
      "x": "string",
      "y": "string"
    }
  ],
  "keysPEM": [
    {
      "pem": "string"
    }
  ],
  "name": "string",
  "neverExtractable": true,
  "operations": [
    "decrypt"
  ],
  "protectionLevel": "HSM",
  "sensitive": true,
  "size": 128,
  "state": "ACTIVE",
  "type": "EC"
}
```

### Example

```bash
curl -X PUT \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/serviceKey/{keyId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: okms.serviceKey.Update
result = client.put("/v2/okms/resource/{okmsId}/serviceKey/{keyId}",
	deactivationReason = None, # Key deactivation reason (type: okms.KeyDeactivationReasonEnum, nullable)
	extractable = None, # Whether the key material can be extracted from the KMS (type: boolean, nullable)
	name = None, # Key Name (type: string, nullable)
	state = None, # Key desired state for activation, deactivation and compromise (specific case of deactivation) (type: okms.KeyStateUpdateEnum, nullable)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: okms.serviceKey.Update
$result = $ovh->put("/v2/okms/resource/{okmsId}/serviceKey/{keyId}", array(
	deactivationReason => null, // Key deactivation reason (type: okms.KeyDeactivationReasonEnum, nullable)
	extractable => null, // Whether the key material can be extracted from the KMS (type: boolean, nullable)
	name => null, // Key Name (type: string, nullable)
	state => null, // Key desired state for activation, deactivation and compromise (specific case of deactivation) (type: okms.KeyStateUpdateEnum, nullable)
));

print_r($result);
?>
```

## Delete a service key

`DELETE /v2/okms/resource/{okmsId}/serviceKey/{keyId}`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/keys/#delete-okms-resource-okmsid-servicekey-keyid

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:serviceKey/delete`

Permanently deletes the key and its material from the KMS. Once deleted, the key cannot be recovered.

The key must already be deactivated, unless `force` is set.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `force` | query | boolean |  | Force deletion of the key |
| `keyId` | path | string (uuid) | yes | Key ID |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | — | successful operation |

### Example

```bash
curl -X DELETE \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/serviceKey/{keyId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.delete("/v2/okms/resource/{okmsId}/serviceKey/{keyId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->delete("/v2/okms/resource/{okmsId}/serviceKey/{keyId}");

print_r($result);
?>
```