Revoke a KMS key
Requires kms:revoke on the key. Takes effect across every node at
once. A revoked key cannot encrypt, decrypt or export until it is
restored.
The body is optional; send none to revoke without recording a reason.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The key's key_id.
Body
Optional; omit the body entirely to revoke without a reason.
Recorded on the key and on the audit trail.
"Key compromise"
Response
Revoked.
The compact form returned by the list endpoint.
How every other KMS endpoint names this key.
A caller's own identifier, for reconciling against another system.
AES, RSA The key length, without the cipher mode.
"AES-256"
"RSA-2048"
active, revoked Whether the private half may ever leave this service. Fixed at creation: it can be withdrawn later but never granted, because the guarantee made when the key was generated has to keep holding.
What the key may be used for. Defaults to ["encrypt", "decrypt"] when a key is created without one.
encrypt, decrypt, sign, verify The AES mode. Absent for an RSA key, which has none.
gcm, cbc Present when the key carries a classification. Decrypting through it then requires the matching clearance.
Present only on a revoked key, and only when one was given.
The key this one replaced, when it came from a rotation.
After this, export is refused even for an exportable key. Present only on exportable keys.
How many times the private half has been exported. Present only on exportable keys.
RSA keys only, and always safe to hand out.
Present only in the response to an export, or to a create with
export_on_create. Never returned by a plain fetch.