Import key
Either a private key wrapped as a JWE, or a bare public_key_pem.
Importing only a public half keeps the unwrapping key off this server
entirely, which is the point of doing it that way.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The configuration's proxy slug. Sixteen random lowercase characters unless one was pinned at creation.
"952zpx6vyig3sdyp"
Body
Supply exactly one of jwe or public_key_pem.
AES, RSA The private key wrapped to this service's transport public key, from
GET /api/v3/qanapi-public-key.
A bare public half. Importing only this keeps the unwrapping key off this server entirely.
Response
Imported.
AES, RSA Named as the v3 API this service replaces names it: the key length without the cipher mode.
"AES-256"
"RSA-2048"
active, revoked Whether the private half may ever leave this service. Fixed at creation: it can be withdrawn later but never granted, because the guarantee made when the key was generated has to keep holding.
encrypt, decrypt, sign, verify A caller's own identifier, for reconciling against another system.
Absent for RSA. This service tracks the mode per key and the v3 API
does not, so it is reported here rather than folded into algorithm.
gcm, cbc The key this one replaced, when it came from a rotation.
After this, export is refused even for an exportable key. Present only on exportable keys.
How many times the private half has been exported.
RSA keys only.
Present only in the response to an export, or to a create with
export_on_create. Never returned by a plain fetch.