# Manage & Operate › Key and Secret Manager › References API

> Part of the OVHcloud developer hub. Index of every page and section: https://developers.eu.ovhcloud.com/llms.txt
> The Manage & Operate product's sections: https://developers.eu.ovhcloud.com/reference/manage-operate/llms.txt
> Everything in one file: https://developers.eu.ovhcloud.com/llms-full.txt

> 3 operations of the OVHcloud API. Calls carry `authorization: Bearer $OVH_TOKEN`; the EU host is shown, Canada and the United States answer on api.ca.ovhcloud.com and api.us.ovhcloud.com.

Page: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/references/

OpenAPI v1: https://api.eu.ovhcloud.com/1.0/__schemas/developer-hub-navigation/manage-operate/key-and-secret-manager/references.json?format=openapi3
OpenAPI v2: https://api.eu.ovhcloud.com/v2/__schemas/developer-hub-navigation/manage-operate/key-and-secret-manager/references.json?format=openapi3

## Operations

- `GET /okms/reference/regions` — List regions
- `GET /okms/reference/secretConfig` — Get the default secret configuration
- `GET /okms/reference/serviceKey` — Get valid service key parameters combinations

## List regions

`GET /v2/okms/reference/regions`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/references/#get-okms-reference-regions

**Status:** Stable production version

Returns the regions where a service can be ordered, with their certifications and the KMIP and REST endpoints of each.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Pagination-Cursor` | header | string |  | Pagination cursor |
| `X-Pagination-Size` | header | integer |  | Pagination size |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.reference.Region[] | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `certifications` | observability.setting.infrastructure.CertificationLevelEnum[] | read-only | Certifications of the region |
| `id` | okms.RegionEnum | read-only | Name of the region — one of `ap-south-mum`, `ap-southeast-sgp`, `ap-southeast-syd`, `ca-east-bhs`, `ca-east-tor`, `eu-central-waw`, `eu-south-mil`, `eu-west-eri`, `eu-west-gra`, `eu-west-lim`, `eu-west-par`, `eu-west-rbx`, … |
| `kmipEndpoint` | string | read-only | KMS kmip API endpoint |
| `restEndpoint` | string | read-only | KMS rest API endpoint |
| `type` | location.TypeEnum | read-only | General typology of the region — one of `LOCAL-ZONE`, `REGION-1-AZ`, `REGION-3-AZ` |

```json
[
  {
    "certifications": [
      "HDS"
    ],
    "id": "ap-south-mum",
    "kmipEndpoint": "string",
    "restEndpoint": "string",
    "type": "LOCAL-ZONE"
  }
]
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/reference/regions" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/reference/regions")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/reference/regions");

print_r($result);
?>
```

## Get the default secret configuration

`GET /v2/okms/reference/secretConfig`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/references/#get-okms-reference-secretconfig

**Status:** Stable production version

Returns the default secret settings of a region: whether `cas` is required and the number of versions to keep.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `region` | query | okms.RegionEnum | yes | OKMS Region — one of `ap-south-mum`, `ap-southeast-sgp`, `ap-southeast-syd`, `ca-east-bhs`, `ca-east-tor`, `eu-central-waw`, `eu-south-mil`, `eu-west-eri`, `eu-west-gra`, `eu-west-lim`, `eu-west-par`, `eu-west-rbx`, … |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.reference.secretConfig.Response | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `casRequired` | boolean | read-only | The cas parameter will be required for all write requests if set to true |
| `maxVersions` | integer | read-only | The number of versions to keep |

```json
{
  "casRequired": true,
  "maxVersions": 0
}
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/reference/secretConfig" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/reference/secretConfig")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/reference/secretConfig");

print_r($result);
?>
```

## Get valid service key parameters combinations

`GET /v2/okms/reference/serviceKey`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/references/#get-okms-reference-servicekey

**Status:** Stable production version

Returns the valid combinations of key type, size, curve, operations and protection level for a region. Use it before creating or importing a service key.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Pagination-Cursor` | header | string |  | Pagination cursor |
| `X-Pagination-Size` | header | integer |  | Pagination size |
| `region` | query | okms.RegionEnum | yes | OKMS Region — one of `ap-south-mum`, `ap-southeast-sgp`, `ap-southeast-syd`, `ca-east-bhs`, `ca-east-tor`, `eu-central-waw`, `eu-south-mil`, `eu-west-eri`, `eu-west-gra`, `eu-west-lim`, `eu-west-par`, `eu-west-rbx`, … |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.reference.serviceKey.Response[] | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `curves` | okms.reference.serviceKey.Curve[] | read-only | Allowed service key curves for type |
| `curves[].default` | boolean | read-only | Is default service key curve for type? |
| `curves[].value` | okms.KeyCurveEnum | read-only | Service key curve for type — one of `P-256`, `P-384`, `P-521` |
| `default` | boolean | read-only | Is default service key type? |
| `operations` | okms.reference.serviceKey.Operations[] | read-only | Allowed service key operations for type |
| `operations[].default` | boolean | read-only | Is default service key operations for type? |
| `operations[].value` | okms.KeyOpsEnum[] | read-only | Service key operations for type |
| `protectionLevel` | okms.reference.serviceKey.ProtectionLevel[] | read-only | Allowed protection level for type |
| `protectionLevel[].default` | boolean | read-only | Is default service key protection level ? |
| `protectionLevel[].value` | okms.KeyProtectionLevelEnum | read-only | Service key protection level — one of `HSM`, `SOFTWARE` |
| `sizes` | okms.reference.serviceKey.Size[] | read-only | Allowed service key sizes for type |
| `sizes[].default` | boolean | read-only | Is default service key size for type? |
| `sizes[].value` | okms.KeySizeEnum | read-only | Service key size for type — one of `128`, `192`, `256`, `384`, `521`, `2048`, `3072`, `4096` |
| `type` | okms.KeyTypeEnum | read-only | Service key type — one of `EC`, `RSA`, `oct` |

```json
[
  {
    "curves": [
      {
        "default": true,
        "value": "P-256"
      }
    ],
    "default": true,
    "operations": [
      {
        "default": true,
        "value": [
          "decrypt"
        ]
      }
    ],
    "protectionLevel": [
      {
        "default": true,
        "value": "HSM"
      }
    ],
    "sizes": [
      {
        "default": true,
        "value": 128
      }
    ],
    "type": "EC"
  }
]
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/reference/serviceKey" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/reference/serviceKey")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/reference/serviceKey");

print_r($result);
?>
```