Import a key
Requires kms:import on the configuration, and a current license.
Supply exactly one of two things: a private key wrapped as a JWE to this
service’s transport public key, or a bare public_key_pem. Importing
only a public half keeps the unwrapping key off this server entirely,
which is the point of doing it that way. type is required alongside
jwe.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The configuration's proxy slug. Sixteen random lowercase letters and digits unless one was pinned at creation.
"952zpx6vyig3sdyp"
Body
Supply exactly one of jwe or public_key_pem.
Required alongside jwe; inferred for a bare public key.
AES, RSA The material is checked against this where it can be. Inferred from the material when omitted.
aes-128-gcm, aes-192-gcm, aes-256-gcm, aes-128-cbc, aes-192-cbc, aes-256-cbc, rsa-2048, rsa-4096 The private key wrapped to this service's transport public key, from
GET /api/v3/qanapi-public-key.
A bare public half. Importing only this keeps the unwrapping key off this server entirely.
encrypt, decrypt, sign, verify Response
The imported key.
The compact form returned by the list endpoint.
How every other KMS endpoint names this key.
A caller's own identifier, for reconciling against another system.
AES, RSA The key length, without the cipher mode.
"AES-256"
"RSA-2048"
active, revoked Whether the private half may ever leave this service. Fixed at creation: it can be withdrawn later but never granted, because the guarantee made when the key was generated has to keep holding.
What the key may be used for. Defaults to ["encrypt", "decrypt"] when a key is created without one.
encrypt, decrypt, sign, verify The AES mode. Absent for an RSA key, which has none.
gcm, cbc Present when the key carries a classification. Decrypting through it then requires the matching clearance.
Present only on a revoked key, and only when one was given.
The key this one replaced, when it came from a rotation.
After this, export is refused even for an exportable key. Present only on exportable keys.
How many times the private half has been exported. Present only on exportable keys.
RSA keys only, and always safe to hand out.
Present only in the response to an export, or to a create with
export_on_create. Never returned by a plain fetch.