Skip to main content
GET
List KMS keys

Authorizations

X-Qanapi-Authorization
string
header
required

A machine credential, qk_ followed by its secret. Only a hash of the secret is stored, so a key is displayed exactly once, when it is created or rotated. A key reaches only the configurations it is linked to.

It may also be sent as Authorization: Bearer qk_..., which is recognised by the prefix.

Query Parameters

proxy_slug
string

Restrict to keys owned by the configuration with this proxy slug. The caller must be able to reach that configuration.

Example:

"952zpx6vyig3sdyp"

state
enum<string>

Restrict to keys in this lifecycle state.

Available options:
active,
revoked
page
integer
default:1

1-based page number. A missing, zero or unparseable value is the first page.

Required range: x >= 1
per_page
integer
default:25

Rows per page. A larger figure is reduced to the maximum rather than refused. Note the default differs from the one on GET /api/v3/classifications.

Required range: 1 <= x <= 200

Response

Matching keys, without their material.

key_id
string<uuid>
required

How every other KMS endpoint names this key.

name
string | null
required
external_id
string | null
required

A caller's own identifier, for reconciling against another system.

type
enum<string>
required
Available options:
AES,
RSA
algorithm
string
required

The key length, without the cipher mode.

Examples:

"AES-256"

"RSA-2048"

state
enum<string>
required
Available options:
active,
revoked
created_at
string<date-time>
required
cipher_mode
enum<string>

The AES mode. Absent for an RSA key, which has none.

Available options:
gcm,
cbc