Export a key's private material
Returns the private half wrapped as an RFC 7516 JWE under the named RSA
wrap key, so it is readable only by whoever holds that key’s private
half. Requires kms:export and a key marked
private_material_retrievable.
Each export increments export_count, which is on the audit trail.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The key's key_id.
Body
An RSA key whose public half wraps the export. Whoever holds its private half is the only party that can read the result.
Response
The key, with private_key_material.jwe present.
AES, RSA Named as the v3 API this service replaces names it: the key length without the cipher mode.
"AES-256"
"RSA-2048"
active, revoked Whether the private half may ever leave this service. Fixed at creation: it can be withdrawn later but never granted, because the guarantee made when the key was generated has to keep holding.
encrypt, decrypt, sign, verify A caller's own identifier, for reconciling against another system.
Absent for RSA. This service tracks the mode per key and the v3 API
does not, so it is reported here rather than folded into algorithm.
gcm, cbc The key this one replaced, when it came from a rotation.
After this, export is refused even for an exportable key. Present only on exportable keys.
How many times the private half has been exported.
RSA keys only.
Present only in the response to an export, or to a create with
export_on_create. Never returned by a plain fetch.