Revoke KMS key
Takes effect across every node at once through the revocation epoch. A revoked key cannot encrypt, decrypt or export until it is restored.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The key's key_id.
Body
"Key compromise"
Response
Revoked.
AES, RSA Named as the v3 API this service replaces names it: the key length without the cipher mode.
"AES-256"
"RSA-2048"
active, revoked Whether the private half may ever leave this service. Fixed at creation: it can be withdrawn later but never granted, because the guarantee made when the key was generated has to keep holding.
encrypt, decrypt, sign, verify A caller's own identifier, for reconciling against another system.
Absent for RSA. This service tracks the mode per key and the v3 API
does not, so it is reported here rather than folded into algorithm.
gcm, cbc The key this one replaced, when it came from a rotation.
After this, export is refused even for an exportable key. Present only on exportable keys.
How many times the private half has been exported.
RSA keys only.
Present only in the response to an export, or to a create with
export_on_create. Never returned by a plain fetch.