List configurations
Every configuration, by name. Requires configuration:read. Key
material never appears. Not paginated.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Response
Every configuration.
Appears in the URL of every encryption call, and is how policy statements name this configuration.
Fixed at creation and not changeable.
"aes-256-gcm"Where the master key lives. local_aek keeps it in the database
sealed under the application key; other providers hand custody to an
HSM or a cloud KMS.
"local_aek"
An HSM handle or key ARN, for providers that use one.