# Generated by API Evangelist (build-phrasing.py). Our phrasing, not observed demand.
overlay: 1.0.0
info:
  title: API Evangelist conversational phrasing for Confluent Cloud Key Encryption Keys (v1) API
  version: 1.0.0
extends: openapi/confluent-the-data-streaming-platform-key-encryption-keys-v1-api-openapi.yml
actions:
- target: $.info
  update:
    x-apievangelist-phrasing:
      method: generated
      generated: '2026-09-26'
      generator: build-phrasing.py
      label: Generated by API Evangelist
      operations: 7
- target: $.paths['/dek-registry/v1/keks'].get
  update:
    x-apievangelist-phrasing:
      intent: List key encryption keys
      effect: read
      questions:
      - Which key encryption keys are registered for client-side field encryption?
      - Can I include soft-deleted KEKs when listing them?
      instructions:
      - text: List my key encryption key names.
      - text: 'List KEK names including deleted ones: {deleted}.'
        slots:
          deleted: query.deleted
      method: generated
      generated: '2026-09-26'
- target: $.paths['/dek-registry/v1/keks'].post
  update:
    x-apievangelist-phrasing:
      intent: Register a key encryption key
      effect: write
      questions:
      - How do I register a KMS key as a KEK for field-level encryption?
      - Can I create a shared KEK backed by my cloud KMS key?
      instructions:
      - text: Create KEK {name} using {kmsType} key {kmsKeyId}.
        slots:
          name: requestBody.name
          kmsType: requestBody.kmsType
          kmsKeyId: requestBody.kmsKeyId
      - text: Register shared KEK {name} with KMS key id {kmsKeyId}.
        slots:
          name: requestBody.name
          kmsKeyId: requestBody.kmsKeyId
      method: generated
      generated: '2026-09-26'
- target: $.paths['/dek-registry/v1/keks/{name}'].get
  update:
    x-apievangelist-phrasing:
      intent: Get a key encryption key
      effect: read
      questions:
      - Which KMS key backs a given KEK?
      - Can I look up a KEK even if it was soft-deleted?
      instructions:
      - text: Show KEK {name}.
        slots:
          name: path.name
      - text: Get the details of key encryption key {name}.
        slots:
          name: path.name
      method: generated
      generated: '2026-09-26'
- target: $.paths['/dek-registry/v1/keks/{name}'].put
  update:
    x-apievangelist-phrasing:
      intent: Update a key encryption key
      effect: write
      questions:
      - Can I change the KMS properties or documentation on an existing KEK?
      - Is it possible to turn sharing on for a KEK I already registered?
      instructions:
      - text: Update KEK {name} with KMS properties {kmsProps}.
        slots:
          name: path.name
          kmsProps: requestBody.kmsProps
      - text: Set shared to {shared} on KEK {name}.
        slots:
          name: path.name
          shared: requestBody.shared
      method: generated
      generated: '2026-09-26'
- target: $.paths['/dek-registry/v1/keks/{name}'].delete
  update:
    x-apievangelist-phrasing:
      intent: Delete a key encryption key
      effect: destructive
      questions:
      - How do I delete a KEK, and can I delete it permanently?
      - What's the difference between soft and permanent KEK deletion?
      instructions:
      - text: Delete KEK {name}.
        slots:
          name: path.name
      - text: 'Permanently delete key encryption key {name}: {permanent}.'
        slots:
          name: path.name
          permanent: query.permanent
      method: generated
      generated: '2026-09-26'
- target: $.paths['/dek-registry/v1/keks/{name}/undelete'].post
  update:
    x-apievangelist-phrasing:
      intent: Restore a deleted key encryption key
      effect: write
      questions:
      - Can I bring back a KEK I soft-deleted?
      - Is there an undo for deleting a key encryption key?
      instructions:
      - text: Undelete KEK {name}.
        slots:
          name: path.name
      - text: Restore the soft-deleted key encryption key {name}.
        slots:
          name: path.name
      method: generated
      generated: '2026-09-26'
- target: $.paths['/dek-registry/v1/keks/{name}/test'].post
  update:
    x-apievangelist-phrasing:
      intent: Test a key encryption key
      effect: read
      questions:
      - How can I verify a KEK can actually reach its KMS key?
      - Is there a way to test that a key encryption key works?
      instructions:
      - text: Test KEK {name}.
        slots:
          name: path.name
      - text: Check that key encryption key {name} is usable.
        slots:
          name: path.name
      method: generated
      generated: '2026-09-26'