openapi: 3.0.0
info:
  version: '2021-09-14'
  x-release: v4
  title: 'Payment Cryptography Control Plane #X Amz Target=PaymentCryptographyControlPlane.CreateAlias #X Amz Target=PaymentCryptographyControlPlane.CreateAlias #X Amz Target=PaymentCryptographyControlPlane.GetParametersForExport API'
  description: <p>You use the Amazon Web Services Payment Cryptography Control Plane to manage the encryption keys you use for payment-related cryptographic operations. You can create, import, export, share, manage, and delete keys. You can also manage Identity and Access Management (IAM) policies for keys. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/security-iam.html">Identity and access management</a> in the <i>Amazon Web Services Payment Cryptography User Guide.</i> </p> <p>To use encryption keys for payment-related transaction processing and associated cryptographic operations, you use the <a href="https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/Welcome.html">Amazon Web Services Payment Cryptography Data Plane</a>. You can encrypt, decrypt, generate, verify, and translate payment-related cryptographic operations. </p> <p>All Amazon Web Services Payment Cryptography API calls must be signed and transmitted using Transport Layer Security (TLS). We recommend you always use the latest supported TLS version for logging API requests. </p> <p>Amazon Web Services Payment Cryptography supports CloudTrail, a service that logs Amazon Web Services API calls and related events for your Amazon Web Services account and delivers them to an Amazon S3 bucket that you specify. By using the information collected by CloudTrail, you can determine what requests were made to Amazon Web Services Payment Cryptography, who made the request, when it was made, and so on. If you don't configure a trail, you can still view the most recent events in the CloudTrail console. For more information, see the <a href="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/">CloudTrail User Guide</a>.</p>
  x-logo:
    url: https://twitter.com/awscloud/profile_image?size=original
    backgroundColor: '#FFFFFF'
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: payment-cryptography
  x-aws-signingName: payment-cryptography
  x-origin:
  - contentType: application/json
    url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/payment-cryptography-2021-09-14.normal.json
    converter:
      url: https://github.com/mermade/aws2openapi
      version: 1.0.0
    x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
  - cloud
  x-preferred: true
servers:
- url: http://controlplane.payment-cryptography.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Payment Cryptography Control Plane multi-region endpoint
- url: https://controlplane.payment-cryptography.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Payment Cryptography Control Plane multi-region endpoint
- url: http://controlplane.payment-cryptography.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Payment Cryptography Control Plane endpoint for China (Beijing) and China (Ningxia)
- url: https://controlplane.payment-cryptography.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Payment Cryptography Control Plane endpoint for China (Beijing) and China (Ningxia)
security:
- hmac: []
tags:
- name: '#X Amz Target=PaymentCryptographyControlPlane.GetParametersForExport'
paths:
  /#X-Amz-Target=PaymentCryptographyControlPlane.GetParametersForExport:
    parameters:
    - $ref: '#/components/parameters/X-Amz-Content-Sha256'
    - $ref: '#/components/parameters/X-Amz-Date'
    - $ref: '#/components/parameters/X-Amz-Algorithm'
    - $ref: '#/components/parameters/X-Amz-Credential'
    - $ref: '#/components/parameters/X-Amz-Security-Token'
    - $ref: '#/components/parameters/X-Amz-Signature'
    - $ref: '#/components/parameters/X-Amz-SignedHeaders'
    post:
      operationId: GetParametersForExport
      description: <p>Gets the export token and the signing key certificate to initiate a TR-34 key export from Amazon Web Services Payment Cryptography.</p> <p>The signing key certificate signs the wrapped key under export within the TR-34 key payload. The export token and signing key certificate must be in place and operational before calling <a>ExportKey</a>. The export token expires in 7 days. You can use the same export token to export multiple keys from your service account.</p> <p> <b>Cross-account use:</b> This operation can't be used across different Amazon Web Services accounts.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>ExportKey</a> </p> </li> <li> <p> <a>GetParametersForImport</a> </p> </li> </ul>
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetParametersForExportOutput'
              examples:
                GetParametersForExport200Example:
                  summary: Default GetParametersForExport 200 response
                  x-microcks-default: true
                  value:
                    ExportToken: example-string
                    ParametersValidUntilTimestamp: resource-abc123
                    SigningKeyAlgorithm: example-string
                    SigningKeyCertificate: example-string
                    SigningKeyCertificateChain: example-string
        '480':
          description: ServiceQuotaExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceQuotaExceededException'
        '481':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
        '482':
          description: ValidationException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationException'
        '483':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '484':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '485':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '486':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '487':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetParametersForExportInput'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - PaymentCryptographyControlPlane.GetParametersForExport
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      summary: Amazon Payment Cryptography Get Parameters for Export
      tags:
      - '#X Amz Target=PaymentCryptographyControlPlane.GetParametersForExport'
components:
  schemas:
    KeyAlgorithm:
      type: string
      enum:
      - TDES_2KEY
      - TDES_3KEY
      - AES_128
      - AES_192
      - AES_256
      - RSA_2048
      - RSA_3072
      - RSA_4096
    InternalServerException: {}
    ThrottlingException: {}
    ServiceUnavailableException: {}
    ConflictException: {}
    ExportTokenId:
      type: string
      pattern: ^export-token-[0-9a-zA-Z]{16,64}$
    GetParametersForExportInput:
      type: object
      required:
      - KeyMaterialType
      - SigningKeyAlgorithm
      title: GetParametersForExportInput
      properties:
        KeyMaterialType:
          allOf:
          - $ref: '#/components/schemas/KeyMaterialType'
          - description: The key block format type (for example, TR-34 or TR-31) to use during key material export. Export token is only required for a TR-34 key export, <code>TR34_KEY_BLOCK</code>. Export token is not required for TR-31 key export.
        SigningKeyAlgorithm:
          allOf:
          - $ref: '#/components/schemas/KeyAlgorithm'
          - description: The signing key algorithm to generate a signing key certificate. This certificate signs the wrapped key under export within the TR-34 key block cryptogram. <code>RSA_2048</code> is the only signing key algorithm allowed.
    GetParametersForExportOutput:
      type: object
      required:
      - ExportToken
      - ParametersValidUntilTimestamp
      - SigningKeyAlgorithm
      - SigningKeyCertificate
      - SigningKeyCertificateChain
      properties:
        ExportToken:
          allOf:
          - $ref: '#/components/schemas/ExportTokenId'
          - description: The export token to initiate key export from Amazon Web Services Payment Cryptography. The export token expires after 7 days. You can use the same export token to export multiple keys from the same service account.
        ParametersValidUntilTimestamp:
          allOf:
          - $ref: '#/components/schemas/Timestamp'
          - description: The validity period of the export token.
        SigningKeyAlgorithm:
          allOf:
          - $ref: '#/components/schemas/KeyAlgorithm'
          - description: The algorithm of the signing key certificate for use in TR-34 key block generation. <code>RSA_2048</code> is the only signing key algorithm allowed.
        SigningKeyCertificate:
          allOf:
          - $ref: '#/components/schemas/CertificateType'
          - description: The signing key certificate of the public key for signature within the TR-34 key block cryptogram. The certificate expires after 7 days.
        SigningKeyCertificateChain:
          allOf:
          - $ref: '#/components/schemas/CertificateType'
          - description: The certificate chain that signed the signing key certificate. This is the root certificate authority (CA) within your service account.
    ServiceQuotaExceededException: {}
    KeyMaterialType:
      type: string
      enum:
      - TR34_KEY_BLOCK
      - TR31_KEY_BLOCK
      - ROOT_PUBLIC_KEY_CERTIFICATE
      - TRUSTED_PUBLIC_KEY_CERTIFICATE
    CertificateType:
      type: string
      pattern: ^[^\[;\]<>]+$
      minLength: 1
      maxLength: 32768
      format: password
    ResourceNotFoundException: {}
    AccessDeniedException: {}
    Timestamp:
      type: string
      format: date-time
    ValidationException: {}
  parameters:
    X-Amz-Algorithm:
      name: X-Amz-Algorithm
      in: header
      schema:
        type: string
      required: false
    X-Amz-Credential:
      name: X-Amz-Credential
      in: header
      schema:
        type: string
      required: false
    X-Amz-Content-Sha256:
      name: X-Amz-Content-Sha256
      in: header
      schema:
        type: string
      required: false
    X-Amz-Security-Token:
      name: X-Amz-Security-Token
      in: header
      schema:
        type: string
      required: false
    X-Amz-SignedHeaders:
      name: X-Amz-SignedHeaders
      in: header
      schema:
        type: string
      required: false
    X-Amz-Date:
      name: X-Amz-Date
      in: header
      schema:
        type: string
      required: false
    X-Amz-Signature:
      name: X-Amz-Signature
      in: header
      schema:
        type: string
      required: false
  securitySchemes:
    hmac:
      type: apiKey
      name: Authorization
      in: header
      description: Amazon Signature authorization v4
      x-amazon-apigateway-authtype: awsSigv4
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/payment-cryptography/
x-hasEquivalentPaths: true