openapi: 3.2.0 info: title: Fortanix DSM REST Crypto API description: "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients. \n- PATCH requests accept a JSON value describing a partial update to the specified resource. All top-level fields in the PATCH request are optional. If an optional field is omitted, the existing value of that field is preserved. In general, for nested JSON objects, the request must provide the complete object value rather than a partial update." termsOfService: https://fortanix.com/legal/agreements-and-standard-terms contact: name: Fortanix Support url: https://support.fortanix.com/ email: support@fortanix.com license: name: Apache 2.0 url: http://www.apache.org/licenses/LICENSE-2.0.html version: 0.1.0-20260710 servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) tags: - name: Crypto paths: /crypto/v1/agree: post: operationId: Agree tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Agree on a key from two other keys. description: 'Perform a cryptographic key agreement operation between a public key and a private key. Both keys must have been generated from the same parameters (e.g. the same elliptic curve). Both keys must allow the AGREEKEY operation. The request body contains the requested properties for the new key as well as the mechanism (e.g. Diffie-Hellman) to be used to produce the key material for the new key. The output of this API should not be used directly as a cryptographic key. The target object type should be HMAC or Secret, and a key derivation procedure should be used to derive the actual key material.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AgreeKeyRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Sobject' /crypto/v1/keys/batch/decrypt: post: operationId: BatchDecrypt tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Batch decrypt with one or more keys. description: 'The order of batch items in the response matches that of the request. returned in the same order. An individual status code is returned for each batch item. **Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.' requestBody: required: true content: application/json: schema: type: array items: $ref: '#/components/schemas/BatchDecryptRequestItem' responses: 2XX: description: Success result content: application/json: schema: type: array items: $ref: '#/components/schemas/BatchDecryptResponseItem' /crypto/v1/keys/batch/encrypt: post: operationId: BatchEncrypt tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Batch encrypt with one or more keys. description: 'The order of batch items in the response matches that of the request. An individual status code is returned for each batch item. **Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.' requestBody: required: true content: application/json: schema: type: array items: $ref: '#/components/schemas/BatchEncryptRequestItem' responses: 2XX: description: Success result content: application/json: schema: type: array items: $ref: '#/components/schemas/BatchEncryptResponseItem' /crypto/v1/keys/batch/sign: post: operationId: BatchSign tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Batch sign with one or more private keys. description: 'The order of batch items in the response matches that of the request. An individual status code is returned for each batch item.' requestBody: required: true content: application/json: schema: type: array items: $ref: '#/components/schemas/SignRequest' responses: 2XX: description: Success result content: application/json: schema: type: array items: $ref: '#/components/schemas/BatchSignResponseItem' /crypto/v1/keys/batch/verify: post: operationId: BatchVerify tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Batch verify with one or more public keys. description: 'The order of batch items in the response matches that of the request. An individual status code is returned for each batch item.' requestBody: required: true content: application/json: schema: type: array items: $ref: '#/components/schemas/VerifyRequest' responses: 2XX: description: Success result content: application/json: schema: type: array items: $ref: '#/components/schemas/BatchVerifyResponseItem' /crypto/v1/digest: post: operationId: CreateDigest tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Compute digest (hash) of data. description: Compute digest (hash) of data. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DigestRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/DigestResponse' /crypto/v1/decapsulate: post: operationId: Decapsulate tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Decrypt an encapsulated key with this Sobject, obtaining a new symmetric key in the target group.' description: 'Decrypt an encapsulated key with this Sobject, obtaining a new symmetric key in the target group.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DecapsulateKeyRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Sobject' /crypto/v1/decrypt: post: operationId: Decrypt tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Decrypt data using a symmetric or asymmetric key. description: 'For symmetric ciphers, `mode` (the block cipher mode) is a required field. For GCM and CCM modes, `tag_len` is a required field. `iv` is required for symmetric ciphers and unused for asymmetric ciphers. If the mode requires one, the request must contain the initialization vector used when the data was encrypted. Objects of type Opaque, EC, or HMAC may not be used with this API.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DecryptRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/DecryptResponse' /crypto/v1/decrypt/final: post: operationId: DecryptFinal tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Conclude multi-part decryption. See `/crypto/v1/decrypt/init` for more details.' description: 'Conclude multi-part decryption. See `/crypto/v1/decrypt/init` for more details.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DecryptFinalRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/DecryptFinalResponse' /crypto/v1/decrypt/init: post: operationId: DecryptInit tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Begin multi-part decryption. description: 'This API is used when decrypting more data than the client wishes to submit in a single request. It supports only symmetric ciphers and CBC, CBCNOPAD, CTR, and GCM modes of operation. To perform multi-part decryption, the client makes one request to the `init` resource, zero or more requests to the `update` resource, followed by one request to the `final` resource. The response to init and update requests includes a `state` field. The `state` is an opaque data blob that must be supplied unmodified by the client with each subsequent request.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DecryptInitRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/DecryptInitResponse' /crypto/v1/decrypt/update: post: operationId: DecryptUpdate tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Continue multi-part decryption. See `/crypto/v1/decrypt/init` for more details.' description: 'Continue multi-part decryption. See `/crypto/v1/decrypt/init` for more details.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DecryptUpdateRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/DecryptUpdateResponse' /crypto/v1/derive: post: operationId: Derive tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Derive a new key from an existing key. description: 'The request body contains the requested properties for the new key as well as the mechanism to be used to produce the key material for the new key.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DeriveKeyRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Sobject' /crypto/v1/encapsulate: post: operationId: Encapsulate tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Obtain a new symmetric key and its encapsulated version from this Sobject. description: 'The resulting symmetric key is created as a new Sobject in the given group. The details of this Sobject along with the ciphertext encapsulating the symmetric key are returned in the response.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EncapsulateKeyRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/EncapsulateKeyResponse' /crypto/v1/encrypt: post: operationId: Encrypt tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Encrypt data using a symmetric or asymmetric key. description: 'For symmetric ciphers, `mode` (the block cipher mode) is a required field. For GCM and CCM modes, `tag_len` is a required field. `iv` is optional for symmetric ciphers and unused for asymmetric ciphers. If provided, it will be used as the cipher initialization vector. The length of `iv` must match the initialization vector size for the cipher and mode. If not provided, a random iv of the correct length is created and returned in the response. Objects of type Opaque, EC, or HMAC may not be used with this API.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EncryptRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/EncryptResponse' /crypto/v1/encrypt/final: post: operationId: EncryptFinal tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Conclude multi-part encryption. See `/crypto/v1/encrypt/init` for more details.' description: 'Conclude multi-part encryption. See `/crypto/v1/encrypt/init` for more details.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EncryptFinalRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/EncryptFinalResponse' /crypto/v1/encrypt/init: post: operationId: EncryptInit tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Begin multi-part encryption. description: 'This API is used when encrypting more data than the client wishes to submit in a single request. It supports only symmetric ciphers and CBC, CBCNOPAD, CTR, and GCM modes of operation. To perform multi-part encryption, the client makes one request to the `init` resource, zero or more requests to the `update` resource, followed by one request to the `final` resource. The response to init and update requests includes a `state` field. The `state` is an opaque data blob that must be supplied unmodified by the client with each subsequent request.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EncryptInitRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/EncryptInitResponse' /crypto/v1/encrypt/update: post: operationId: EncryptUpdate tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Continue multi-part encryption. See `/crypto/v1/encrypt/init` for more details.' description: 'Continue multi-part encryption. See `/crypto/v1/encrypt/init` for more details.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EncryptUpdateRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/EncryptUpdateResponse' /crypto/v1/mac: post: operationId: Mac tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Compute a message authentication code (HMAC or CMAC). The key being used should have the `MACGENERATE` key operation.' description: 'A key of type `HMAC` needs to be used for computing an HMAC, and the hash algorithm should be present in the request. AES, ARIA, DES3, and SEED keys can be used for computing a CMAC. No hash algorithm should be specified for CMAC computation. The digest algorithm shouldn''t be specified in case of CMAC.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/MacRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/MacResponse' /crypto/v1/macverify: post: operationId: MacVerify tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Verify the input MAC. The key used must have the `MACVERIFY` key operation.' description: 'Verify the input MAC. The key used must have the `MACVERIFY` key operation.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyMacRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/VerifyResponse' /crypto/v1/sign: post: operationId: Sign tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Sign with a private key. The key must be asymmetric and have the `SIGN` key operation enabled.' description: 'Note: Signing prehashed data with LMS keys When creating an LMS signature, the first step is to hash the message with a prefix that is unknown to the caller (see RFC8554, algorithm 3). As the caller cannot precompute this value, DSM follows different semantics for prehashed data. Namely, when the hash field is used, DSM will check the length of the digest and then feed it as raw data for the LMS signature generation. Consequently, if you hash your data using an algorithm such as SHA256 and then supply this digest to the LMS signing API (putting prehashed data in the `hash` field), DSM interprets the provided digest as raw data, and verification of the signature should be conducted accordingly.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SignRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/SignResponse' /crypto/v1/transform: post: operationId: Transform tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Transform an existing key into a new one. description: 'Some protocols (such as BIP32) require weak forms of key derivation, where the resulting key can be used to recompute the original key.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/TransformKeyRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Sobject' /crypto/v1/unwrapkey: post: operationId: Unwrap tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Unwrap a security object with another security object. description: 'Unwrap (decrypt) a wrapped key and import it into DSM. This allows one to securely import security objects into DSM that were previously wrapped by DSM or another key management system. A new security object will be created in DSM with the unwrapped data. The wrapping key must have the `UNWRAPKEY` operation enabled. The `obj_type` parameter specifies the object type of the security object being unwrapped.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UnwrapKeyRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Sobject' /crypto/v1/verify: post: operationId: Verify tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: 'Verify a signature with a public key. The verifying key must be an asymmetric key with the `VERIFY` key operation enabled.' description: 'Note on using LMS key: See documentation of the /crypto/v1/sign API.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/VerifyResponse' /crypto/v1/wrapkey: post: operationId: Wrap tags: - Crypto security: - bearerToken: [] - apiKeyAuth: [] summary: Wrap a security object with another security object. description: 'Wrap (encrypt) an existing security object with a key. This allows keys to be securely exported from DSM so they can be later imported into DSM or another key management system. The key being wrapped must have the `EXPORT` operation enabled. The wrapping key must have the `WRAPKEY` operation enabled. The following wrapping operations are supported: * Symmetric keys, HMAC keys, opaque objects, and secret objects may be wrapped with symmetric or asymmetric keys. * Asymmetric keys may be wrapped with symmetric keys. Wrapping an asymmetric key with an asymmetric key is not supported. When wrapping with an asymmetric key, the wrapped object size must fit as plaintext for the wrapping key size and algorithm.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/WrapKeyRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/WrapKeyResponse' components: schemas: FpeDate: description: 'A structure for specifying a token part representing a date that occurs after a specified date and/or occurs before a specified date. Depending on the subparts that make up the date, one of the three options is used.' oneOf: - title: FpeDateVariantDayMonthYear type: object properties: dmy_date: $ref: '#/components/schemas/FpeDateDayMonthYear' required: - dmy_date - title: FpeDateVariantMonthDay type: object properties: month_day_date: $ref: '#/components/schemas/FpeDateMonthDay' required: - month_day_date - title: FpeDateVariantMonthYear type: object properties: month_year_date: $ref: '#/components/schemas/FpeDateMonthYear' required: - month_year_date EffectiveKeyOperations: description: "Operations allowed to be performed on a given key by a given User or an app\n\n\n\n SIGN:\n If this is set, the key can be used for signing.\n\n\n VERIFY:\n If this is set, the key can used for verifying a signature.\n\n\n ENCRYPT:\n If this is set, the key can be used for encryption.\n\n\n DECRYPT:\n If this is set, the key can be used for decryption.\n\n\n WRAPKEY:\n If this is set, the key can be used wrapping other keys.\n The key being wrapped must have the EXPORT operation enabled.\n\n\n UNWRAPKEY:\n If this is set, the key can be used to unwrap a wrapped key.\n\n\n DERIVEKEY:\n If this is set, the key can be used to derive another key.\n\n\n TRANSFORM:\n If this is set, the key can be transformed.\n\n\n MACGENERATE:\n If this is set, the key can be used to compute a cryptographic\n Message Authentication Code (MAC) on a message.\n\n\n MACVERIFY:\n If they is set, the key can be used to verify a MAC.\n\n\n EXPORT:\n If this is set, the value of the key can be retrieved\n with an authenticated request. This shouldn't be set unless\n required. It is more secure to keep the key's value inside DSM only.\n\n\n APPMANAGEABLE:\n Without this operation, management operations like delete, destroy,\n rotate, activate, restore, revoke, revert, update, remove_private, etc.\n cannot be performed by a crypto App.\n A user with access or admin app can still perform these operations.\n This option is only relevant for crypto apps.\n\n\n HIGHVOLUME:\n If this is set, audit logs will not be recorded for the key.\n High volume here tries to signify a key that is being used a lot\n and will produce lots of logs. Setting this operation disables\n audit logs for the key.\n\n\n AGREEKEY:\n If this is set, the key can be used for key agreement.\n Both the private and public key should have this option enabled\n to perform an agree operation.\n\n\n ENCAPSULATE:\n If this is set, the key can be used for key encapsulation. The\n result is a new symmetric key and a ciphertext.\n\n\n DECAPSULATE:\n If this is set, the key can be used for key decapsulation. If\n decapsulation succeeds, the result is a new symmetric key.\n\n\n MASKDECRYPT:\n If this is set, the key can be used for masked decryption only.\n\n" type: string enum: - SIGN - VERIFY - ENCRYPT - DECRYPT - WRAPKEY - UNWRAPKEY - DERIVEKEY - TRANSFORM - MACGENERATE - MACVERIFY - EXPORT - APPMANAGEABLE - HIGHVOLUME - AGREEKEY - ENCAPSULATE - DECAPSULATE - MASKDECRYPT ExternalKmsInfoVariantOci: allOf: - type: object properties: type: type: string enum: - Oci required: - type - $ref: '#/components/schemas/OciVaultInfo' DecryptFinalRequest: allOf: - type: object description: Request body to finalize a multi-part decryption. properties: key: $ref: '#/components/schemas/SobjectDescriptor' state: type: string format: byte description: Current state of the encrypted cipher tag: type: string format: byte description: Tag value of the encrypted cipher. Only applicable when using GCM mode. required: - state Mgf: description: Specifies the Mask Generating Function (MGF) to use. oneOf: - title: MgfVariantMgf1 type: object properties: mgf1: $ref: '#/components/schemas/MgfMgf1' required: - mgf1 KeyCreationMethodVariantUnwrap: allOf: - type: object properties: method: type: string enum: - Unwrap required: - method - type: object properties: {} RsaEncryptionPaddingOaep: allOf: - type: object description: Optimal Asymmetric Encryption Padding (PKCS#1 v2.1). properties: mgf: $ref: '#/components/schemas/Mgf' required: - mgf FpeDataPart: description: Structure for specifying (part of) a complex tokenization data type. oneOf: - $ref: '#/components/schemas/FpeEncryptedPart' - $ref: '#/components/schemas/FpeDataPartLiteral' - $ref: '#/components/schemas/FpeCompoundPart' PublishPublicKeyConfigEnabled: allOf: - type: object properties: list_previous_version: type: boolean description: Additionally list the previous version of the key if not compromised. required: - list_previous_version DecryptInitResponse: allOf: - type: object description: Response body for initializing multi-part decryption. properties: kid: type: - string - 'null' format: uuid description: The key id is returned for non-transient keys. state: type: string format: byte description: Opaque data, not to be interpreted or modified by the client and must be provided with next request. required: - state GoogleAccessReason: description: An access reason provided by Google when making EKMS API calls. type: string enum: - REASON_UNSPECIFIED - CUSTOMER_INITIATED_SUPPORT - GOOGLE_INITIATED_SERVICE - THIRD_PARTY_DATA_REQUEST - GOOGLE_INITIATED_REVIEW - CUSTOMER_INITIATED_ACCESS - GOOGLE_INITIATED_SYSTEM_OPERATION - REASON_NOT_EXPECTED - MODIFIED_CUSTOMER_INITIATED_ACCESS - MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION - GOOGLE_RESPONSE_TO_PRODUCTION_ALERT - CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING BatchDecryptRequestItem: allOf: - type: object description: 'Request body of each item in batch decryption **Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.' properties: kid: type: string format: uuid description: UUID of the sobject request: $ref: '#/components/schemas/DecryptRequest' required: - kid - request Slip10Options: allOf: - type: object properties: derivation_path: type: array items: type: integer minimum: 0 maximum: 4294967295 description: 'The Slip10 path, starting from master. Master key is []. Ex: m/42/42''/0 -> [42, 2**31 + 42, 0]' required: - derivation_path BatchDecryptResponseItem: oneOf: - title: BatchDecryptResponseItemSuccess type: object properties: status: type: integer body: $ref: '#/components/schemas/DecryptResponse' - title: BatchDecryptResponseItemError type: object properties: status: type: integer error: type: string CipherMode: description: Cipher mode used for symmetric key algorithms. type: string enum: - ECB - CBC - CBCNOPAD - CFB - OFB - CTR - GCM - CCM - KW - KWP - FF1 GoogleAccessReasonPolicy: allOf: - type: object description: 'Policy specifying acceptable access reasons by Google Service Account at App or Sobject level.' properties: allow: type: array uniqueItems: true items: $ref: '#/components/schemas/GoogleAccessReason' description: Set of allowed Google Access reasons. allow_missing_reason: type: boolean description: Accept incoming requests which do not specify any access reasons. required: - allow - allow_missing_reason FpeDayMonthDate: allOf: - type: object description: 'A structure for specifying a particular date consisting of a day and a month, for use in an FpeDate structure.' properties: month: type: integer minimum: 0 maximum: 255 description: The month, which should be an integer from 1 to 12. day: type: integer minimum: 0 maximum: 255 description: 'The day, which should be an integer from 1 to either 29, 30, or 31, depending on the month and year. Here, February is treated as having 29 days.' required: - month - day FpeInputProcessing: description: Options to apply some pre- and post-processing to the input. oneOf: - title: FpeInputProcessingVariantStripUnknown type: string enum: - strip_unknown - title: FpeInputProcessingVariantPassthroughUnknown type: string enum: - passthrough_unknown - title: FpeInputProcessingVariantPassthroughSpecific type: object properties: passthrough_specific: $ref: '#/components/schemas/FpeInputProcessingPassthroughSpecific' required: - passthrough_specific DecapsulateKeyRequest: allOf: - type: object description: Request body to perform key decapsulation. properties: key: $ref: '#/components/schemas/SobjectDescriptor' ciphertext: type: string format: byte description: The encapsulated key name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name of the resulting symmetric key group_id: type: - string - 'null' format: uuid description: 'Group ID of the security group that the resulting Sobject should belong to. The application creating the Sobject must be a member of this group. If no group is specified, the default group for the requesting application will be used' key_type: $ref: '#/components/schemas/ObjectType' key_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Key size in bits of the resulting symmetric key key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: Key operations of the decapsulated key transient: type: - boolean - 'null' description: If set to true, the decapsulated key will be transient. required: - key - ciphertext - key_type PublishPublicKeyConfig: description: If enabled, the public key will be available publicly (without authentication) through the GetPublicKey API. oneOf: - $ref: '#/components/schemas/PublishPublicKeyConfigVariantEnabled' - $ref: '#/components/schemas/PublishPublicKeyConfigVariantDisabled' discriminator: propertyName: state mapping: enabled: PublishPublicKeyConfigVariantEnabled disabled: PublishPublicKeyConfigVariantDisabled AgreeKeyMechanism: description: Options to use for key agreement mechanism. type: string enum: - diffie_hellman AriaOptions: allOf: - type: object properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 tag_length: type: - integer - 'null' minimum: 0 maximum: 255 cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' iv_length: type: - integer - 'null' minimum: 0 maximum: 255 KeyCreationMethodVariantImport: allOf: - type: object properties: method: type: string enum: - Import required: - method - type: object properties: {} OciVaultInfo: allOf: - type: object description: 'Any key specific metadata that isn''t already described by an existing security object field.' properties: protection_mode: type: string description: 'Describes the OCI vault protection mode, usually meaning HSM or SOFTWARE.' deletion_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: The scheduled deletion_date of the OCI key version display_name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: 'The name in the OCI Vault (and may differ from what the DSM virtual key shows).' required: - protection_mode - display_name FpeInputProcessingPassthroughSpecific: allOf: - type: object properties: passthrough: type: array uniqueItems: true items: type: string minLength: 1 maxLength: 1 other: $ref: '#/components/schemas/FpeInputDefaultProcessing' required: - passthrough - other PublishPublicKeyConfigVariantEnabled: allOf: - type: object properties: state: type: string enum: - enabled required: - state - $ref: '#/components/schemas/PublishPublicKeyConfigEnabled' EncryptFinalRequest: allOf: - type: object description: Request body to finalize a multi-part encryption. properties: key: $ref: '#/components/schemas/SobjectDescriptor' state: type: string format: byte description: Last state of the encrypted cipher tag_len: type: - integer - 'null' description: 'Size of authentication tag. Tag length is only applicable when using GCM mode.' required: - state RotationPolicy: allOf: - type: object properties: effective_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z deactivate_rotated_key: type: - boolean - 'null' rotate_copied_keys: $ref: '#/components/schemas/RotateCopiedKeys' - $ref: '#/components/schemas/RotationInterval' FpeConstraints: allOf: - type: object description: Constraints on a portion of a complex tokenization data type. properties: luhn_check: type: - boolean - 'null' description: 'Whether the token part contains a checksum that satisfies the Luhn formula. It is an error to apply this constraint to non-numeric parts, or to have an encrypted part be under more than one Luhn check constraint. Also, if an encrypted part has a Luhn check constraint applied to it and may contain at least one digit that is not preserved, it must not specify any other constraints.' num_gt: type: - integer - 'null' description: 'Number that the token part should be greater than. This constraint can only be specified on (non-compound) numeric encrypted parts guaranteed to preserve either everything or nothing at all. (For example, if an encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the first five digits is not guaranteed to preserve everything, because if the input happens to be six or more digits long, there will be at least one digit that remains unpreserved.)' num_lt: type: - integer - 'null' description: 'Number that the token part should be smaller than. This constraint can only be specified on (non-compound) numeric encrypted parts guaranteed to preserve either everything or nothing at all. (For example, if an encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the first five digits is not guaranteed to preserve everything, because if the input happens to be six or more digits long, there will be at least one digit that remains unpreserved.)' num_ne: type: - array - 'null' items: type: integer description: 'Numbers that the token part should not be equal to. It is an error to apply this constraint to non-numeric parts.' date: $ref: '#/components/schemas/FpeDateConstraint' applies_to: $ref: '#/components/schemas/FpeConstraintsApplicability' EncryptUpdateRequest: allOf: - type: object description: Request body for continuing multi part encryption properties: key: $ref: '#/components/schemas/SobjectDescriptor' plain: type: string format: byte description: Data bytes to be encrypted state: type: string format: byte description: Last state of the encrypted cipher required: - plain - state AwsKeyRotationStatusVariantKeyRotationEnabled: allOf: - type: object properties: type: type: string enum: - KeyRotationEnabled required: - type - $ref: '#/components/schemas/AwsKeyRotationStatusKeyRotationEnabled' AwsKmsInfo: allOf: - type: object description: Information and properties of an AWS KMS key. properties: multi_region: $ref: '#/components/schemas/AwsMultiRegionInfo' aws_key_rotation_status: $ref: '#/components/schemas/AwsKeyRotationStatus' origin: $ref: '#/components/schemas/AwsKeyOrigin' FpeCompoundPartOr: allOf: - type: object description: 'Represents an OR of multiple structures. Implementation note: an OR is _not_ a union of `FpeDataPart`s. Rather, when parsing the input, the backend will simply choose the first subpart that matches the current portion of the input, and tokenize/detokenize accordingly. If that choice results in an invalid parse of the rest of the input, the backend ***will not backtrack*** and will simply return with an error.' properties: or: type: array items: $ref: '#/components/schemas/FpeDataPart' description: The actual subparts that make up this compound part. constraints: $ref: '#/components/schemas/FpeConstraints' preserve: type: - boolean - 'null' description: 'Whether the entire OR should be preserved as-is (i.e., not tokenized). If this is set, any descendant subparts cannot contain any preserve-related fields set.' mask: type: - boolean - 'null' description: 'Whether the entire OR should be masked when doing masked decryption. If this is set, any descendant subparts cannot contain any mask-related fields set.' min_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The minimum allowed length for this part (in chars). max_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The maximum allowed length for this part (in chars). required: - or VerifyRequest: allOf: - type: object description: Request to verify a signature using an asymmetric key. properties: key: $ref: '#/components/schemas/SobjectDescriptor' hash_alg: $ref: '#/components/schemas/DigestAlgorithm' hash: type: string format: byte description: 'The hash of the data on which the signature is being verified. Either `hash` or `data` should be specified; it is an error to specify both or none. Hash should be base64 encoded.' data: type: string format: byte description: 'The data on which the signature is being verified. Either `hash` or `data` should be specified; it is an error to specify both or none. Data should be base64 encoded.' mode: $ref: '#/components/schemas/SignatureMode' signature: type: string format: byte description: The signature to verify context: type: string format: byte description: 'The context parameter to be provided to the verify algorithm. Currently only ML-DSA keys accept a context parameter; this parameter must not be specified for any other key types.' required: - signature FpeDayMonthYearDate: allOf: - type: object description: 'A structure for specifying a particular date consisting of a day, month, and year, for use in an FpeDate structure.' properties: year: type: integer minimum: 0 maximum: 4294967295 description: The year, which should be an integer less than 100000. Zero is treated as a leap year. month: type: integer minimum: 0 maximum: 255 description: The month, which should be an integer from 1 to 12. day: type: integer minimum: 0 maximum: 255 description: 'The day, which should be an integer from 1 to either 28, 29, 30, or 31, depending on the month and year.' required: - year - month - day EncryptInitResponse: allOf: - type: object description: Response body of initializing multi-part encryption. properties: kid: type: - string - 'null' format: uuid description: Key id is returned for non-transient keys. iv: type: string format: byte description: Initialization vector. Only returned for symmetric encryption. state: type: string format: byte description: 'Current state of the encrypted cipher. Opaque data, not to be interpreted or modified by the client and must be provided with next request.' required: - state AwsKeyRotationStatus: oneOf: - $ref: '#/components/schemas/AwsKeyRotationStatusVariantKeyRotationDisabled' - $ref: '#/components/schemas/AwsKeyRotationStatusVariantKeyRotationEnabled' discriminator: propertyName: type mapping: KeyRotationDisabled: AwsKeyRotationStatusVariantKeyRotationDisabled KeyRotationEnabled: AwsKeyRotationStatusVariantKeyRotationEnabled FpeOptions: description: 'FPE-specific options (for specifying the format of the data to be encrypted)' oneOf: - $ref: '#/components/schemas/FpeOptionsBasic' - $ref: '#/components/schemas/FpeOptionsAdvanced' - $ref: '#/components/schemas/FpeOptionsV2' MlDsaParamSet: description: ML-DSA parameter sets type: string enum: - MlDsa44 - MlDsa65 - MlDsa87 BatchEncryptRequestItem: allOf: - type: object description: 'Request body of each item in batch encryption **Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.' properties: kid: type: string format: uuid description: UUID of the sobject request: $ref: '#/components/schemas/EncryptRequest' required: - kid - request EncryptRequest: allOf: - type: object description: Request to encrypt data. properties: key: $ref: '#/components/schemas/SobjectDescriptor' alg: $ref: '#/components/schemas/Algorithm' plain: type: string format: byte description: 'Plaintext bytes to be encrypted. Note that when performing format-preserving encryption (i.e., tokenization), the plaintext should be encoded as UTF-8 bytes.' mode: $ref: '#/components/schemas/CryptMode' iv: type: string format: byte description: 'The initialization vector to use. This is only applicable to modes that take IVs, and will be randomly generated if not specified.' ad: type: string format: byte description: 'The authenticated data to use. This is only applicable when using authenticated encryption modes (like GCM or CCM).' tag_len: type: - integer - 'null' description: 'The length of the authentication tag, in bits, for authenticated encryption modes (i.e., GCM or CCM). For other modes, this field is irrelevant.' label: type: string format: byte description: 'The optional label to use. Currently this field only serves as the rsa_oaep_label when the encryption algorithm is RSA and the mode is Oaep. For other modes, providing this field causes a bad request error.' required: - alg - plain DeriveKeyMechanismSlip10HardenedChild: allOf: - type: object properties: index: type: integer minimum: 0 maximum: 4294967295 required: - index ExternalKmsInfoVariantAWS: allOf: - type: object properties: type: type: string enum: - AWS required: - type - $ref: '#/components/schemas/AwsKmsInfo' FpeSection: allOf: - type: object description: A concatenation of groups, optionally including a checksum. properties: groups: type: array items: $ref: '#/components/schemas/FpeGroup' checksum: $ref: '#/components/schemas/FpeChecksum' required: - groups KcvMethod: description: Methods for calculating a Key Checksum Value. type: string enum: - Encrypt - Cmac RsaEncryptionPadding: description: 'Type of padding to use for RSA encryption. The use of PKCS#1 v1.5 padding is strongly discouraged, because of its susceptibility to Bleichenbacher''s attack. The padding specified must adhere to the key''s encryption policy. If not specified, the default based on the key''s policy will be used.' oneOf: - title: RsaEncryptionPaddingVariantOaep type: object properties: OAEP: $ref: '#/components/schemas/RsaEncryptionPaddingOaep' required: - OAEP - title: RsaEncryptionPaddingVariantPkcs1V15 type: object properties: PKCS1_V15: type: object properties: {} required: - PKCS1_V15 - title: RsaEncryptionPaddingVariantRawDecrypt type: object properties: RAW_DECRYPT: type: object properties: {} required: - RAW_DECRYPT EffectiveKeyPolicy: allOf: - type: object description: 'An aggregation of policies and permissions of the session creator for a security object.' properties: key_ops: type: array items: $ref: '#/components/schemas/EffectiveKeyOperations' description: Indicates allowed key operations for the security key. export_policy: $ref: '#/components/schemas/ExportPolicy' required: - key_ops FpeMonthYearDate: allOf: - type: object description: 'A structure for specifying a particular date consisting of a month and a year, for use in an FpeDate structure.' properties: year: type: integer minimum: 0 maximum: 4294967295 description: The year, which should be an integer less than 100000. Zero is treated as a leap year. month: type: integer minimum: 0 maximum: 255 description: The month, which should be an integer from 1 to 12. required: - year - month AwsMultiRegionInfo: allOf: - type: object description: 'This structure mentions various properties of AWS multi region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html' properties: multi_region_key_type: $ref: '#/components/schemas/AwsMultiRegionKeyType' primary_key_arn: type: - string - 'null' description: Specifies a replica key's primary key ARN. replica_key_arns: type: - array - 'null' items: type: string description: Specifies ARNs of a primary key's replicas. required: - multi_region_key_type KeyFormat: description: Key Format type: string enum: - Default - Pkcs8 FpeVariant: allOf: - type: object description: A concatenation of sections. properties: sections: type: array items: $ref: '#/components/schemas/FpeSection' required: - sections KeyCreationMethodVariantGenerate: allOf: - type: object properties: method: type: string enum: - Generate required: - method - type: object properties: {} DeriveKeyRequest: allOf: - type: object description: Request body to derive a key. properties: activation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Activation date of the derived key deactivation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Deactivation date of the derived key key: $ref: '#/components/schemas/SobjectDescriptor' name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name of the derived key. Key names must be unique within an account. group_id: type: - string - 'null' format: uuid description: 'Group ID of the security group that this security object should belong to. The user or application creating this security object must be a member of this group. If no group is specified, the default group for the requesting application will be used.' key_type: $ref: '#/components/schemas/ObjectType' key_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Key size of the derived key in bits. mechanism: $ref: '#/components/schemas/DeriveKeyMechanism' enabled: type: - boolean - 'null' description: Whether the derived key should have cryptographic operations enabled. description: type: - string - 'null' description: Description for derived key custom_metadata: type: - object - 'null' additionalProperties: type: string description: User-defined metadata for this key stored as key-value pairs. key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: 'Optional array of key operations to be enabled for this security object. If not provided the service will provide a default set of key operations. Note that if you provide an empty array, all key operations will be disabled.' state: $ref: '#/components/schemas/SobjectState' transient: type: - boolean - 'null' description: If set to true, the derived key will be transient. export_policy: $ref: '#/components/schemas/SobjectExportPolicy' elliptic_curve: $ref: '#/components/schemas/EllipticCurve' required: - key_type - mechanism EcKcdsaOptions: allOf: - type: object properties: hash_alg: $ref: '#/components/schemas/DigestAlgorithm' WrappingKeys: oneOf: - $ref: '#/components/schemas/WrappingKeysVariantOnly' - $ref: '#/components/schemas/WrappingKeysVariantAny' discriminator: propertyName: $type mapping: Only: WrappingKeysVariantOnly Any: WrappingKeysVariantAny FpeDateDayMonthYear: allOf: - type: object description: 'Represents a date that consists of a Month subpart, a Day subpart, and a Year subpart. The Year part is allowed to be preserved, and the Day and Month parts are allowed to be preserved together. (The Day part cannot be preserved if the Month part is not, and vice versa.)' properties: before: $ref: '#/components/schemas/FpeDayMonthYearDate' after: $ref: '#/components/schemas/FpeDayMonthYearDate' LmsOptions: allOf: - type: object description: LMS specific options properties: l1_height: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The height of the top level tree. This field will be deprecated in v2. l2_height: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The height of the secondary tree. This field will be deprecated in v2. digest: $ref: '#/components/schemas/DigestAlgorithm' heights: type: - array - 'null' items: type: integer description: Heights of the trees in each level. node_size: type: - integer - 'null' description: Amount of bytes associated to each node (the 'm' parameter) winternitz_width: type: - integer - 'null' description: The width of the Winternitz coefficients. The default value is 8. AesOptions: allOf: - type: object properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 fpe: $ref: '#/components/schemas/FpeOptions' tag_length: type: - integer - 'null' format: int32 cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' iv_length: type: - integer - 'null' format: int32 FpeCompoundPartMultiple: allOf: - type: object description: 'Indicates a part that is possibly repeated multiple times. Implementation note: the backend parser is locally "greedy" and will attempt to match as many repetitions as possible. If this later results in an invalid parse of the rest of the input, the backend ***will not backtrack*** and will simply return with an error.' properties: multiple: $ref: '#/components/schemas/FpeDataPart' min_repetitions: type: - integer - 'null' description: 'The minimum number of times the subpart may occur. (A value of 1 marks a single occurrence.)' max_repetitions: type: - integer - 'null' description: 'The maximum number of times the subpart may occur. (A value of 1 marks a single occurrence.)' constraints: $ref: '#/components/schemas/FpeConstraints' preserve: type: - boolean - 'null' description: 'Whether the entire Multiple should be preserved as-is (i.e., not tokenized). If this is set, the `multiple` subpart and its descendants cannot contain any preserve-related fields set.' mask: type: - boolean - 'null' description: 'Whether the entire Multiple should be masked when doing masked decryption. If this is set, the `multiple` subpart and its descendants cannot contain any mask-related fields set.' min_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The minimum allowed length for this part (in chars). max_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The maximum allowed length for this part (in chars). required: - multiple All: description: 'A helper enum with a single variant, All, which indicates that something should apply to an entire part. (This is here mainly to allow other untagged enums to work properly.)' type: string enum: - all FpeWords: description: A set of fixed-length strings. oneOf: - title: FpeWordsVariantIntegerRanges type: object properties: integer_ranges: $ref: '#/components/schemas/FpeWordsIntegerRanges' required: - integer_ranges - title: FpeWordsVariantAlphabet type: object properties: alphabet: $ref: '#/components/schemas/FpeCharSet' required: - alphabet - title: FpeWordsVariantCustom type: object properties: custom: $ref: '#/components/schemas/FpeWordsCustom' required: - custom TransformKeyMechanismBip32WeakChild: allOf: - type: object properties: index: type: integer minimum: 0 maximum: 4294967295 description: The index of a weak child is an integer between 0 and 2**31 - 1. required: - index DecryptRequest: allOf: - type: object description: Request to decrypt data. properties: key: $ref: '#/components/schemas/SobjectDescriptor' alg: $ref: '#/components/schemas/Algorithm' cipher: type: string format: byte description: 'Ciphertext bytes to be decrypted. Note that when performing format-preserving decryption (i.e., detokenization), the ciphertext should be encoded as UTF-8 bytes.' mode: $ref: '#/components/schemas/CryptMode' iv: type: string format: byte description: 'The initialization vector to use, required for modes that take IVs (and irrelevant otherwise).' ad: type: string format: byte description: 'The authenticated data to use. This is only applicable when using authenticated decryption modes (like GCM or CCM).' tag: type: string format: byte description: 'The authentication tag, relevant for authenticated encryption modes (i.e., GCM or CCM), and otherwise irrelevant.' masked: type: - boolean - 'null' description: 'Whether to returned a masked result when detokenizing (i.e., when decrypting using the FF1/FPE mode). Defaults to false. This field is only useful if the app has the `DECRYPT` permission. In such situations, when this field is `true`, decryption returns masked output. However, with the `MASKDECRYPT` permission, this field is ignored and detokenization will always return the masked output.' label: type: string format: byte description: 'The optional label to use. Currently this field only serves as the rsa_oaep_label when the decryption algorithm is RSA and the mode is Oaep. For other modes, providing this field causes a bad request error.' required: - cipher HistoryItemState: allOf: - type: object description: 'The key metadata of the security object for a given `HistoryItem`. This keeps track of properties such as allowed key operations, key state, and so on.' properties: activation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z activation_undo_window: $ref: '#/components/schemas/Secs' revocation_reason: $ref: '#/components/schemas/RevocationReason' compromise_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z deactivation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z deactivation_undo_window: $ref: '#/components/schemas/Secs' destruction_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z deletion_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z state: $ref: '#/components/schemas/SobjectState' key_ops: type: array items: $ref: '#/components/schemas/KeyOperations' public_only: type: boolean has_key: type: boolean rotation_policy: $ref: '#/components/schemas/RotationPolicy' group_id: type: - string - 'null' format: uuid required: - state - key_ops - public_only - has_key Secs: allOf: - type: integer DecryptFinalResponse: allOf: - type: object description: Final response body of a multi-part decryption. properties: plain: type: string format: byte description: Decrypted bytes required: - plain WrappingKeysOnly: allOf: - type: object description: Only keys in this list can be used to wrap the sobject properties: keys: type: array uniqueItems: true items: $ref: '#/components/schemas/SobjectDescriptorPersisted' required: - keys RsaEncryptionPaddingPolicy: description: RSA encryption padding policy. oneOf: - title: RsaEncryptionPaddingPolicyVariantOaep type: object properties: OAEP: $ref: '#/components/schemas/RsaEncryptionPaddingPolicyOaep' required: - OAEP - title: RsaEncryptionPaddingPolicyVariantPkcs1V15 type: object properties: PKCS1_V15: type: object properties: {} required: - PKCS1_V15 - title: RsaEncryptionPaddingPolicyVariantRawDecrypt type: object properties: RAW_DECRYPT: type: object properties: {} required: - RAW_DECRYPT MgfPolicy: description: MGF policy. oneOf: - title: MgfPolicyVariantMgf1 type: object properties: mgf1: $ref: '#/components/schemas/MgfPolicyMgf1' required: - mgf1 RsaSignaturePaddingPolicyPss: allOf: - type: object properties: mgf: $ref: '#/components/schemas/MgfPolicy' ObjectOrigin: description: The origin of a security object - where it was created / generated. type: string enum: - FortanixHSM - Transient - External Des3Options: allOf: - type: object properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' iv_length: type: - integer - 'null' format: int32 SobjectDescriptorInline: allOf: - type: object properties: value: type: string format: byte obj_type: $ref: '#/components/schemas/ObjectType' required: - value - obj_type DecryptInitRequest: allOf: - type: object description: Request body to initialize multi-part decryption. properties: key: $ref: '#/components/schemas/SobjectDescriptor' alg: $ref: '#/components/schemas/Algorithm' mode: $ref: '#/components/schemas/CipherMode' iv: type: string format: byte description: Initialization vector. Required for symmetric algorithms. ad: type: string format: byte description: Authenticated data. Only applicable when using GCM mode. FpePreserveMask: description: A structure indicating which indices in an encrypted part to mask or preserve. oneOf: - $ref: '#/components/schemas/All' - type: array items: type: integer format: int64 description: 'Indicates that only certain characters are to be preserved or masked. Indices are Python-like; i.e., negative indices index from the end of the token portion, with index -1 denoting the last character. (Indicating that nothing should be preserved or masked can be done via an empty list, which is the default value for this enum.)' RsaEncryptionPaddingPolicyOaep: allOf: - type: object description: 'The Optional Asymmetric Encryption Padding scheme, as defined in RFC 8017 (PKCS #1 version 2.2)' properties: mgf: $ref: '#/components/schemas/MgfPolicy' KeyCreationMethod: description: Information about the method by which a key was created oneOf: - $ref: '#/components/schemas/KeyCreationMethodVariantGenerate' - $ref: '#/components/schemas/KeyCreationMethodVariantAgree' - $ref: '#/components/schemas/KeyCreationMethodVariantTransform' - $ref: '#/components/schemas/KeyCreationMethodVariantDerive' - $ref: '#/components/schemas/KeyCreationMethodVariantUnwrap' - $ref: '#/components/schemas/KeyCreationMethodVariantImport' - $ref: '#/components/schemas/KeyCreationMethodVariantEncapsulate' - $ref: '#/components/schemas/KeyCreationMethodVariantDecapsulate' discriminator: propertyName: method mapping: Generate: KeyCreationMethodVariantGenerate Agree: KeyCreationMethodVariantAgree Transform: KeyCreationMethodVariantTransform Derive: KeyCreationMethodVariantDerive Unwrap: KeyCreationMethodVariantUnwrap Import: KeyCreationMethodVariantImport Encapsulate: KeyCreationMethodVariantEncapsulate Decapsulate: KeyCreationMethodVariantDecapsulate ExternalKeyIdOciVault: allOf: - type: object description: A key in an OCI key vault. properties: oci_key_id: type: string description: The OCID of the OciKey oci_key_version: type: string description: The OCID of the OciKeyVersion required: - oci_key_id - oci_key_version ExternalKeyIdAzureKeyVault: allOf: - type: object description: A key in Azure Key Vault. properties: version: type: string format: uuid description: The version of the key. label: type: string description: The name of the key. required: - version - label ExternalKeyIdAwsKms: allOf: - type: object properties: key_arn: type: string description: The Amazon Resource Name of the key. key_id: type: string description: The key ID assigned to the key. required: - key_arn - key_id - $ref: '#/components/schemas/AwsKeyMaterialId' MgfPolicyMgf1: allOf: - type: object properties: hash: $ref: '#/components/schemas/DigestAlgorithm' SobjectExportPolicy: allOf: - type: object properties: allow_weakening: type: boolean description: 'When set to `false`, the `export_policy` for the sobject can never be relaxed, it can only be made more strict. This means that - If the export policy is set to `Wrapped`, it can never be set back to `Unrestricted`. - If the export policy is set to `Wrapped` with a limited set of keys specified, it can never bet set back to `Wrapped` with any key. Additionally, no new keys can be added to the set of wrapping keys. Also note that if all the wrapping keys (specified by key id) in the export policy have been deleted/destroyed/deactivated, the sobject becomes effectively unexportable. Note: these rules may change in the future.' required: - allow_weakening - $ref: '#/components/schemas/ExportPolicy' DigestRequest: allOf: - type: object description: Request to compute the hash of arbitrary data. properties: alg: $ref: '#/components/schemas/DigestAlgorithm' data: type: string format: byte description: Raw binary data required: - alg - data AgreeKeyRequest: allOf: - type: object description: Request body to perform key agreement. properties: activation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Activation date of the agreed key deactivation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Deactivation date of the agreed key private_key: $ref: '#/components/schemas/SobjectDescriptor' public_key: $ref: '#/components/schemas/SobjectDescriptor' mechanism: $ref: '#/components/schemas/AgreeKeyMechanism' name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: 'Name of the agreed-upon key. Key names must be unique within an account. The name is ignored for transient keys.' group_id: type: - string - 'null' format: uuid description: 'Group ID of the security group that this security object should belong to. The user or application creating this security object must be a member of this group. If no group is specified, the default group for the requesting application will be used.' key_type: $ref: '#/components/schemas/ObjectType' key_size: type: integer minimum: 0 maximum: 4294967295 description: Key size in bits. If less than the output size of the algorithm, the secret's most-significant bits will be truncated. enabled: type: - boolean - 'null' description: Whether the agreed key should have cryptographic operations enabled description: type: - string - 'null' description: Description of the agreed key custom_metadata: type: - object - 'null' additionalProperties: type: string description: User-defined metadata for this key stored as key-value pairs. key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: 'Optional array of key operations to be enabled for this security object. If not provided the service will provide a default set of key operations. Note that if you provide an empty array, all key operations will be disabled.' state: $ref: '#/components/schemas/SobjectState' transient: type: - boolean - 'null' description: If set to true, the resulting key will be transient. export_policy: $ref: '#/components/schemas/SobjectExportPolicy' required: - private_key - public_key - mechanism - key_type - key_size ExternalKeyIdFortanix: allOf: - type: object description: An sobject in DSM. properties: id: type: string format: uuid description: The UUID assigned to the sobject. required: - id ExportPolicyVariantWrapped: allOf: - type: object properties: $type: type: string enum: - Wrapped required: - $type - $ref: '#/components/schemas/ExportPolicyWrapped' DeriveKeyMechanismBip32HardenedChild: allOf: - type: object properties: index: type: integer minimum: 0 maximum: 4294967295 required: - index ExportPolicyVariantUnrestricted: allOf: - type: object properties: $type: type: string enum: - Unrestricted required: - $type - type: object properties: {} BlsOptions: allOf: - type: object properties: variant: $ref: '#/components/schemas/BlsVariant' required: - variant TransformKeyMechanismSlip10WeakChild: allOf: - type: object properties: index: type: integer minimum: 0 maximum: 4294967295 description: The index of a weak child is an integer between 0 and 2**31 - 1. required: - index MlDsaMode: oneOf: - $ref: '#/components/schemas/MlDsaModeVariantPure' - $ref: '#/components/schemas/MlDsaModeVariantPreHash' - $ref: '#/components/schemas/MlDsaModeVariantExternalMu' discriminator: propertyName: variant mapping: PURE: MlDsaModeVariantPure PRE_HASH: MlDsaModeVariantPreHash EXTERNAL_MU: MlDsaModeVariantExternalMu AwsMultiRegionKeyType: description: 'Specifies the type of multi-Region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#multi-region-concepts' type: string enum: - PRIMARY - REPLICA ExternalKeyId: description: 'Identification information for an external key. There are multiple variants of this type to represent the different kinds of keys DSM supports (e.g., AWS, Azure, etc.). This is not to be confused with the UUID assigned to a virtual key in DSM, which is most likely different from the ID that the source key (outside of DSM) has.' oneOf: - $ref: '#/components/schemas/ExternalKeyIdPkcs11' - $ref: '#/components/schemas/ExternalKeyIdFortanix' - $ref: '#/components/schemas/ExternalKeyIdAwsKms' - $ref: '#/components/schemas/ExternalKeyIdAzureKeyVault' - $ref: '#/components/schemas/ExternalKeyIdGcpKeyRing' - $ref: '#/components/schemas/ExternalKeyIdOciVault' - type: object properties: {} RotateCopiedKeys: oneOf: - title: RotateCopiedKeysVariantAllExternal type: string enum: - all_external - title: RotateCopiedKeysVariantSelect type: object properties: select: type: array items: type: string format: uuid required: - select Bip32Network: description: 'The BIP32 network The Testnet network is usually an actual network with nodes and miners, and free cryptocurrency. This provides a testing environment for developers.' type: string enum: - mainnet - testnet FpeChecksum: type: string enum: - luhn FpeGroup: allOf: - type: object description: 'A concatenation of codes, that can be repeated an amount of times. An amount of leading and trailing characters can be preserved, this is, unmodified by tokenization.' properties: codes: type: array items: $ref: '#/components/schemas/FpeCode' min_repetitions: type: - integer - 'null' description: A group cannot be omitted, thus this field must be positive if present. max_repetitions: type: - integer - 'null' preserve: type: - array - 'null' items: type: integer minItems: 2 maxItems: 2 description: 'Amount of leading and trailing characters to preserve in this group. Preserved characters are the leading/trailing characters of the whole group, not individual repetitions.' required: - codes KeyCreationMethodVariantDerive: allOf: - type: object properties: method: type: string enum: - Derive required: - method - type: object properties: {} CryptMode: description: '`CipherMode` or `RsaEncryptionPadding`, depending on the encryption algorithm.' oneOf: - $ref: '#/components/schemas/CipherMode' - $ref: '#/components/schemas/RsaEncryptionPadding' FpeCharSet: description: 'The alphabet to use for an encrypted portion of a complex tokenization data type. Characters should be specified as a list of pairs, where each pair [a, b] represents the range of Unicode code points from a to b, with both bounds being inclusive. A single code point can be specified as [c, c]. Normally, each character is assigned a numeric value for FF1. The first character is assigned a value of 0, and subsequent characters are assigned values of 1, 2, and so on, up to the size of the alphabet. Note that the order of the ranges matters; characters appearing in later ranges are assigned higher numerical values compared to earlier characters. For instance, in the FpeCharSet [[''a'', ''z''], [''0'', ''9'']], the digits ''0'' to ''9'' are assigned values from 26 to 35, since they are listed after the ''a'' to ''z'' range. In any case, ranges should not overlap with each other, and should not contain surrogate code points.' allOf: - type: array items: type: array minItems: 2 maxItems: 2 items: type: string minLength: 1 maxLength: 1 MgfMgf1: allOf: - type: object description: MGF1 algorithm properties: hash: $ref: '#/components/schemas/DigestAlgorithm' required: - hash EllipticCurve: description: Identifies a standardized elliptic curve. type: string enum: - X25519 - Ed25519 - Ed448 - X448 - SecP192K1 - SecP224K1 - SecP256K1 - NistP192 - NistP224 - NistP256 - NistP384 - NistP521 - Gost256A EncryptInitRequest: allOf: - type: object description: Request body to initialize multi-part encryption. properties: key: $ref: '#/components/schemas/SobjectDescriptor' alg: $ref: '#/components/schemas/Algorithm' mode: $ref: '#/components/schemas/CipherMode' iv: type: string format: byte description: Initialization vector ad: type: string format: byte description: Authenticated data, required for AEAD algorithms required: - alg XmssOptions: allOf: - type: object description: XMSS specific options properties: height: type: - integer - 'null' description: The height of the Merkle tree (10, 16 or 20) digest: $ref: '#/components/schemas/DigestAlgorithm' node_size: type: - integer - 'null' description: Amount of bytes associated to each node (24 or 32) DigestResponse: allOf: - type: object description: Response body of a hash operation. properties: digest: type: string format: byte description: Hashed binary output required: - digest SignRequest: allOf: - type: object description: Request to sign data (or hashed data) using an asymmetric key. properties: key: $ref: '#/components/schemas/SobjectDescriptor' hash_alg: $ref: '#/components/schemas/DigestAlgorithm' hash: type: string format: byte description: 'Hashed data to be signed. Either `hash` or `data` should be specified; it is an error to specify both or none. Hash should be base64 encoded.' data: type: string format: byte description: 'Data to be signed. Either `hash` or `data` should be specified; it is an error to specify both or none. Data should be base64 encoded.' mode: $ref: '#/components/schemas/SignatureMode' deterministic_signature: type: - boolean - 'null' description: 'Whether signatures should be deterministic. Defaults to false. If specified, the value must be compatible with the key''s settings.' context: type: string format: byte description: 'The context parameter to be provided to the sign algorithm. Currently only ML-DSA keys accept a context parameter; this parameter must not be specified for any other key types.' FpeFormatV2: allOf: - type: object description: The second generation of Fortanix Tokenization scheme. properties: variants: type: array items: $ref: '#/components/schemas/FpeVariant' description: 'A token is accepted if it is accepted by any of these variants. Note tokenization results depend on the order of this list.' mode: $ref: '#/components/schemas/FpeTokenizeMode' input_processing: $ref: '#/components/schemas/FpeInputProcessing' required: - variants PrincipalUserViaApp: allOf: - type: object description: UserViaApp signifies a user authorizing some app to act on its behalf through OAuth. properties: user_id: type: string format: uuid scopes: type: array uniqueItems: true items: $ref: '#/components/schemas/OauthScope' required: - user_id - scopes WrappingKeysVariantAny: allOf: - type: object properties: $type: type: string enum: - Any required: - $type - type: object properties: {} FpeWordsIntegerRanges: allOf: - type: object description: 'A union of positive integer ranges. ```plain Examples: [[0, 400], [402, 1000]] = {0000, 0001, ..., 0400, 0402, ..., 1000} [[1,3], [49, 50]] with optional padding of length 8 = {00000001, 00000002, 00000003, 00000049, 00000050} (accepts 1, 01, 00002, 49, 000050, etc) ```' properties: ranges: type: array items: type: array items: type: integer minItems: 2 maxItems: 2 padding_required: type: boolean description: 'If this field is true, this set accepts only numeric strings padded to the length given by the maximum integer in the range set.' required: - ranges - padding_required DsaOptions: allOf: - type: object properties: subgroup_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 RsaSignaturePaddingPolicy: description: RSA signature padding policy. oneOf: - title: RsaSignaturePaddingPolicyVariantPss type: object properties: PSS: $ref: '#/components/schemas/RsaSignaturePaddingPolicyPss' required: - PSS - title: RsaSignaturePaddingPolicyVariantPkcs1V15 type: object properties: PKCS1_V15: type: object properties: {} required: - PKCS1_V15 SobjectDescriptorPersisted: description: Uniquely identifies a persisted sobject. oneOf: - title: SobjectDescriptorPersistedVariantKid type: object properties: kid: type: string format: uuid required: - kid - title: SobjectDescriptorPersistedVariantName type: object properties: name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ required: - name RsaOptions: allOf: - type: object description: RSA-specific options. properties: key_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Size in bits (not bytes) of the RSA key. Specify on Create only. Returned on Get. public_exponent: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Public exponent to use for generating the RSA key. Specify on Create only. encryption_policy: type: - array - 'null' items: $ref: '#/components/schemas/RsaEncryptionPolicy' description: 'Encryption policy for an RSA key. When doing an encryption or key wrapping operation, the policies are evaluated against the specified parameters one by one. If one matches, the operation is allowed. If none match, including if the policy list is empty, the operation is disallowed. Missing optional parameters will have their defaults specified according to the matched policy. The default for new keys is `[{"padding":{"OAEP":{}}]`. If (part of) a constraint is not specified, anything is allowed for that constraint. To impose no constraints, specify `[{}]`.' signature_policy: type: - array - 'null' items: $ref: '#/components/schemas/RsaSignaturePolicy' description: 'Signature policy for an RSA key. When doing a signature operation, the policies are evaluated against the specified parameters one by one. If one matches, the operation is allowed. If none match, including if the policy list is empty, the operation is disallowed. Missing optional parameters will have their defaults specified according to the matched policy. The default for new keys is `[{}]` (no constraints). If (part of) a constraint is not specified, anything is allowed for that constraint.' minimum_key_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: 'The minimum allowed key length. This is only relevant for group or account cryptographic policies (and hence has no effect in an RSA policy on a specific key).' FpeOptionsV2: allOf: - type: object properties: format_v2: $ref: '#/components/schemas/FpeFormatV2' description: type: - string - 'null' required: - format_v2 SignatureMode: description: Signature mechanism oneOf: - $ref: '#/components/schemas/RsaSignaturePadding' - $ref: '#/components/schemas/MlDsaMode' VerifyResponse: allOf: - type: object description: Result of verifying a signature or MAC. properties: kid: type: - string - 'null' format: uuid description: The ID of the key used for verification. Returned for non-transient keys. result: type: boolean description: True if the signature verified and false if it did not. required: - result FpeDatePart: description: 'Possible date-related constraint types that do not form a complete date (by themselves) for a complex tokenization data type.' type: string enum: - month - day - year BatchEncryptResponseItem: oneOf: - title: BatchEncryptResponseItemSuccess type: object properties: status: type: integer body: $ref: '#/components/schemas/EncryptResponse' - title: BatchEncryptResponseItemError type: object properties: status: type: integer error: type: string VerifyMacRequest: allOf: - type: object description: Request to verify a MAC. properties: key: $ref: '#/components/schemas/SobjectDescriptor' alg: $ref: '#/components/schemas/DigestAlgorithm' data: type: string format: byte description: The data over which the MAC needs to be verified mac: type: string format: byte description: 'The MAC to verify. Note that the previously available field `digest` is deprecated; this field should be used instead.' required: - data AwsKeyOrigin: description: 'Origin of the AWS KMS key. See the [AWS documentation](https://docs.aws.amazon.com/kms/latest/APIReference/API_KeyMetadata.html#KMS-Type-KeyMetadata-Origin) for more information.' type: string enum: - AwsKms - External - AwsCloudHsm - ExternalKeyStore KeyCreationMethodVariantEncapsulate: allOf: - type: object properties: method: type: string enum: - Encapsulate required: - method - type: object properties: {} FpeCompoundPartConcat: allOf: - type: object description: Represents a concatenation of multiple structures (in a particular order). properties: concat: type: array items: $ref: '#/components/schemas/FpeDataPart' description: The actual subparts that make up this compound part, in order. constraints: $ref: '#/components/schemas/FpeConstraints' preserve: type: - boolean - 'null' description: 'Whether the entire concat should be preserved as-is (i.e., not tokenized). If this is set, any descendant subparts cannot contain any preserve-related fields set.' mask: type: - boolean - 'null' description: 'Whether the entire concat should be masked when doing masked decryption. If this is set, any descendant subparts cannot contain any mask-related fields set.' min_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The minimum allowed length for this part (in chars). max_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The maximum allowed length for this part (in chars). required: - concat TransformKeyRequest: allOf: - type: object description: Request body to transform a key. properties: activation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Activation date of the transformed key deactivation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Deactivation date of the transformed key key: $ref: '#/components/schemas/SobjectDescriptor' name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name of the transformed key. Key names must be unique within an account. group_id: type: - string - 'null' format: uuid description: 'Group ID of the group that this security object should belong to. The user or application creating this security object must be a member of this group. If no group is specified, the default group for the requesting application will be used.' key_type: $ref: '#/components/schemas/ObjectType' mechanism: $ref: '#/components/schemas/TransformKeyMechanism' enabled: type: - boolean - 'null' description: Whether the transformed key should have cryptographic operations enabled. description: type: - string - 'null' description: Description of the transformed key custom_metadata: type: - object - 'null' additionalProperties: type: string description: User-defined metadata for this key stored as key-value pairs. key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: 'Optional array of key operations to be enabled for this security object. If not provided the service will provide a default set of key operations. Note that if you provide an empty array, all key operations will be disabled.' state: $ref: '#/components/schemas/SobjectState' transient: type: - boolean - 'null' description: If set to true, the transformed key will be transient. export_policy: $ref: '#/components/schemas/SobjectExportPolicy' required: - key_type - mechanism FpeOptionsBasic: allOf: - type: object description: 'Basic FPE-specific options. This is suitable for simple datatypes that consist of ASCII digits, or ASCII digits and uppercase letters.' properties: radix: type: integer minimum: 0 maximum: 4294967295 description: 'The FPE base for the input data (i.e., the size of the character set of the datatype). This must be an integer from 2 to 36. This also implicitly defines the alphabet of the datatype. A base from 2 to 10 implies ASCII digits (e.g., a radix of 3 can be used to represent a ternary string), and a base from 11 to 36 implies ASCII digits and uppercase letters (e.g., a radix of 16 can be' min_length: type: integer minimum: 0 maximum: 4294967295 description: The minimum allowed length for the input data. max_length: type: integer minimum: 0 maximum: 4294967295 description: The maximum allowed length for the input data. preserve: type: array items: type: integer format: int64 description: 'The list of indices of characters to be preserved while performing encryption/decryption. Indices are Python-like; i.e., nonnegative indices index from the beginning of the input (where 0 is the first character), and negative indices index from the end of the input. (where -1 is the last character, -2 is second to last, and so on). Any preserved characters will be concatenated together and used as an FF1 tweak. For example, if the input data is "abcd", and the first and last characters are to be preserved, the FF1 tweak will be the ASCII bytes of the string "ad".' mask: type: - array - 'null' items: type: integer format: int64 description: 'The list of indices of characters to be masked while performing masked decryption. Indices are Python-like; i.e., nonnegative indices index from the beginning of the input (where 0 is the first character), and negative indices index from the end of the input. (where -1 is the last character, -2 is second to last, and so on).' luhn_check: type: - boolean - 'null' description: 'Whether the encrypted/decrypted data contains a checksum digit that satisfies the Luhn formula. (The output ciphertext/plaintext will also contain a Luhn checksum digit.)' name: type: - string - 'null' description: The user-provided name for the data type that represents the input data. required: - radix - min_length - max_length - preserve EncapsulateKeyResponse: allOf: - type: object description: Result of an encapsulation request. properties: key: $ref: '#/components/schemas/Sobject' ciphertext: type: string format: byte description: The encapsulated key required: - key - ciphertext KeyOperations: description: "Operations allowed to be performed on a given key.\n\n\n\n SIGN:\n If this is set, the key can be used to for signing.\n\n\n VERIFY:\n If this is set, the key can used for verifying a signature.\n\n\n ENCRYPT:\n If this is set, the key can be used for encryption.\n\n\n DECRYPT:\n If this is set, the key can be used for decryption.\n\n\n WRAPKEY:\n If this is set, the key can be used wrapping other keys.\n The key being wrapped must have the EXPORT operation enabled.\n\n\n UNWRAPKEY:\n If this is set, the key can be used to unwrap a wrapped key.\n\n\n DERIVEKEY:\n If this is set, the key can be used to derive another key.\n\n\n TRANSFORM:\n If this is set, the key can be transformed.\n\n\n MACGENERATE:\n If this is set, the key can be used to compute a cryptographic\n Message Authentication Code (MAC) on a message.\n\n\n MACVERIFY:\n If they is set, the key can be used to verify a MAC.\n\n\n EXPORT:\n If this is set, the value of the key can be retrieved\n with an authenticated request. This shouldn't be set unless\n required. It is more secure to keep the key's value inside DSM only.\n\n\n APPMANAGEABLE:\n Without this operation, management operations like delete, destroy,\n rotate, activate, restore, revoke, revert, update, remove_private, etc.\n cannot be performed by a crypto App.\n A user with access or admin app can still perform these operations.\n This option is only relevant for crypto apps.\n\n\n HIGHVOLUME:\n If this is set, audit logs will not be recorded for the key.\n High volume here tries to signify a key that is being used a lot\n and will produce lots of logs. Setting this operation disables\n audit logs for the key.\n\n\n AGREEKEY:\n If this is set, the key can be used for key agreement.\n Both the private and public key should have this option enabled\n to perform an agree operation.\n\n\n ENCAPSULATE:\n If this is set, the key can be used for key encapsulation. The\n result is a new symmetric key and a ciphertext.\n\n\n DECAPSULATE:\n If this is set, the key can be used for key decapsulation. If\n decapsulation succeeds, the result is a new symmetric key.\n\n" type: string enum: - SIGN - VERIFY - ENCRYPT - DECRYPT - WRAPKEY - UNWRAPKEY - DERIVEKEY - TRANSFORM - MACGENERATE - MACVERIFY - EXPORT - APPMANAGEABLE - HIGHVOLUME - AGREEKEY - ENCAPSULATE - DECAPSULATE DesOptions: allOf: - type: object properties: cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' ExternalKeyIdPkcs11: allOf: - type: object description: 'A key in a legacy HSM. (DSM uses HSM Gateway to interact with such legacy HSMs using PKCS #11.)' properties: id: type: string format: byte description: 'The PKCS #11 ID of the key.' label: type: string format: byte description: 'The PKCS #11 label of the key.' required: - id - label SobjectDescriptor: description: Uniquely identifies a persisted or transient sobject. oneOf: - title: SobjectDescriptorVariantKid type: object properties: kid: type: string format: uuid required: - kid - title: SobjectDescriptorVariantName type: object properties: name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ required: - name - title: SobjectDescriptorVariantTransientKey type: object properties: transient_key: type: string format: byte required: - transient_key - title: SobjectDescriptorVariantInline type: object properties: inline: $ref: '#/components/schemas/SobjectDescriptorInline' required: - inline MlDsaModeVariantExternalMu: allOf: - type: object properties: variant: type: string enum: - EXTERNAL_MU required: - variant - type: object properties: {} DeriveKeyMechanismHkdf: allOf: - type: object properties: hash_alg: $ref: '#/components/schemas/DigestAlgorithm' info: type: string format: byte salt: type: string format: byte required: - hash_alg RevocationReasonCode: description: Reasons to revoke a security object. type: string enum: - Unspecified - KeyCompromise - CACompromise - AffiliationChanged - Superseded - CessationOfOperation - PrivilegeWithdrawn AwsKeyRotationStatusKeyRotationEnabled: allOf: - type: object properties: rotation_period_in_days: type: - integer - 'null' minimum: 0 maximum: 65535 ExportPolicyWrapped: allOf: - type: object description: 'The sobject can only be exported wrapped by a key as specified by the `WrappingKeys`.' properties: by: $ref: '#/components/schemas/WrappingKeys' required: - by RsaSignaturePaddingPss: allOf: - type: object description: Probabilistic Signature Scheme (PKCS#1 v2.1). properties: mgf: $ref: '#/components/schemas/Mgf' required: - mgf MlDsaOptions: allOf: - type: object description: ML-DSA specific options properties: param_set: $ref: '#/components/schemas/MlDsaParamSet' required: - param_set PublishPublicKeyConfigVariantDisabled: allOf: - type: object properties: state: type: string enum: - disabled required: - state - type: object properties: {} FpeCode: allOf: - type: object description: A set of words, repeated an amount of times. properties: words: $ref: '#/components/schemas/FpeWords' min_repetitions: type: - integer - 'null' max_repetitions: type: - integer - 'null' required: - words KeyCreationMethodVariantTransform: allOf: - type: object properties: method: type: string enum: - Transform required: - method - type: object properties: {} EncryptResponse: allOf: - type: object description: Response of an encryption request. properties: kid: type: - string - 'null' format: uuid description: The ID of the key used for encryption. Returned for non-transient keys. cipher: type: string format: byte description: 'Encrypted ciphertext bytes. Note that when performing format-preserving encryption (i.e., tokenization), the ciphertext is encoded as UTF-8 bytes.' iv: type: string format: byte description: 'The initialization vector used during encryption. This is only applicable for certain symmetric encryption modes.' tag: type: string format: byte description: 'When using the GCM or CCM modes, the tag is returned from authenticated encryption.' required: - cipher MacRequest: allOf: - type: object description: Request to compute a MAC. properties: key: $ref: '#/components/schemas/SobjectDescriptor' alg: $ref: '#/components/schemas/DigestAlgorithm' data: type: string format: byte description: The data for which to generate a MAC required: - data KeyCreationMethodVariantDecapsulate: allOf: - type: object properties: method: type: string enum: - Decapsulate required: - method - type: object properties: {} FpeConstraintsApplicability: description: A structure indicating which subparts to which to apply a set of constraints. oneOf: - $ref: '#/components/schemas/All' - type: object additionalProperties: $ref: '#/components/schemas/FpeConstraintsApplicability' description: 'An object representing the individual subparts that the constraints should apply to. This is a BTreeMap where for each key-value pair, the key represents the "index" of the subpart (with the first subpart having index 0), and the value is an FpeConstraintsApplicability instance. Note that a Multiple part only allows for one possible key-value pair, since it only contains one subpart. For Concat parts, the key is the zero-based index of the subpart in the `concat` field, and for Multiple parts, this is always 0 (due to a Multiple having only one subpart). This cannot be used with OR parts; instead, specify constraints individually on each relevant subpart.' BatchSignResponseItem: oneOf: - title: BatchSignResponseItemSuccess type: object properties: status: type: integer body: $ref: '#/components/schemas/SignResponse' - title: BatchSignResponseItemError type: object properties: status: type: integer error: type: string MlKemParamSet: description: ML-KEM parameter sets type: string enum: - MlKem512 - MlKem768 - MlKem1024 DecryptUpdateResponse: allOf: - type: object description: Response body of multi-part decryption. properties: plain: type: string format: byte description: Decrypted bytes state: type: string format: byte description: 'Current state of the multi part decrypted object. Opaque data, not to be interpreted or modified by the client and must be provided with next request.' required: - plain - state TransformKeyMechanism: description: Options for mechanism to be used when transforming a key oneOf: - title: TransformKeyMechanismVariantBip32WeakChild type: object properties: bip32_weak_child: $ref: '#/components/schemas/TransformKeyMechanismBip32WeakChild' required: - bip32_weak_child - title: TransformKeyMechanismVariantSlip10WeakChild type: object properties: slip10_weak_child: $ref: '#/components/schemas/TransformKeyMechanismSlip10WeakChild' required: - slip10_weak_child WrappingKeysVariantOnly: allOf: - type: object properties: $type: type: string enum: - Only required: - $type - $ref: '#/components/schemas/WrappingKeysOnly' AwsKeyRotationStatusVariantKeyRotationDisabled: allOf: - type: object properties: type: type: string enum: - KeyRotationDisabled required: - type - type: object properties: {} ExternalSobjectInfo: allOf: - type: object description: 'This describes an external object -- specifically, information about its source object.' properties: id: $ref: '#/components/schemas/ExternalKeyId' hsm_group_id: type: string format: uuid description: The group which corresponds to the external HSM. external_kms_info: $ref: '#/components/schemas/ExternalKmsInfo' required: - id - hsm_group_id ExternalKeyIdGcpKeyRing: allOf: - type: object description: A key in a GCP key ring. properties: version: type: integer minimum: 0 maximum: 4294967295 description: The version of the key. label: type: string description: The label for the key. required: - version - label MlKemOptions: allOf: - type: object description: ML-KEM specific options properties: param_set: $ref: '#/components/schemas/MlKemParamSet' Sobject: allOf: - type: object properties: acct_id: type: string format: uuid description: UUID of the account which the security object belongs to. activation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Activation date of security object in seconds since EPOCH. aes: $ref: '#/components/schemas/AesOptions' allow_credential_use: type: - boolean - 'null' description: Whether this security object can be used/referenced by a credential object. allow_sign_hash: type: - boolean - 'null' description: Whether the sign operation response contains hash or data as output. aria: $ref: '#/components/schemas/AriaOptions' bip32: $ref: '#/components/schemas/Bip32Options' bls: $ref: '#/components/schemas/BlsOptions' compliant_with_policies: type: - boolean - 'null' description: Whether this security object is compliant with cryptographic policies or not. compromise_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Compromise date of security object in seconds since EPOCH. created_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Timestamp at which the security object was created. creator: $ref: '#/components/schemas/Principal' custom_metadata: type: - object - 'null' additionalProperties: type: string description: User managed field for adding custom metadata to the security object. deactivation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Deactivation date of security object in seconds since EPOCH. deletion_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Deletion date of security object in seconds since EPOCH. des: $ref: '#/components/schemas/DesOptions' des3: $ref: '#/components/schemas/Des3Options' description: type: - string - 'null' description: Description of the security object. destruction_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Destruction date of security object in seconds since EPOCH. deterministic_signatures: type: - boolean - 'null' description: Optionally get deterministic signatures, if algorithm is EC or RSA. dsa: $ref: '#/components/schemas/DsaOptions' eckcdsa: $ref: '#/components/schemas/EcKcdsaOptions' effective_key_policy: $ref: '#/components/schemas/EffectiveKeyPolicy' elliptic_curve: $ref: '#/components/schemas/EllipticCurve' enabled: type: boolean description: Whether this security object has cryptographic operations enabled. export_policy: $ref: '#/components/schemas/SobjectExportPolicy' external: $ref: '#/components/schemas/ExternalSobjectInfo' fpe: $ref: '#/components/schemas/FpeOptions' google_access_reason_policy: $ref: '#/components/schemas/GoogleAccessReasonPolicy' history: type: - array - 'null' items: $ref: '#/components/schemas/HistoryItem' description: 'When a Key Undo Policy is in place, a list of (non-expired) history items is returned. Each history item represents a past key state that can be reverted to.' kcdsa: $ref: '#/components/schemas/KcdsaOptions' kcv: type: string description: Key Checksum Value of the security object. kcv_cmac: type: string description: Cmac Key Checksum Value of the security object. key_creation_method: $ref: '#/components/schemas/KeyCreationMethod' key_ops: type: array items: $ref: '#/components/schemas/KeyOperations' description: Operations allowed to be performed by a given key. key_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Key size of the security object in bits. kid: type: - string - 'null' format: uuid description: Unique identifier of the security object. links: $ref: '#/components/schemas/KeyLinks' lms: $ref: '#/components/schemas/LmsOptions' mldsa: $ref: '#/components/schemas/MlDsaOptions' mlkem: $ref: '#/components/schemas/MlKemOptions' name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name of the security object. never_exportable: type: - boolean - 'null' description: Whether the security object was exportable at some point in its lifetime. obj_type: $ref: '#/components/schemas/ObjectType' origin: $ref: '#/components/schemas/ObjectOrigin' original_key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: Key operations with which the key was created. This information is available for newly created DSM keys starting with version 5.1 pub_key: type: string format: byte description: 'Public key material of the security object, if it exists. For virtual keys, this field may not be available if the key is not backed by DSM.' public_only: type: boolean description: Whether the security object only consists of public material. publish_public_key: $ref: '#/components/schemas/PublishPublicKeyConfig' revocation_reason: $ref: '#/components/schemas/RevocationReason' rotation_policy: $ref: '#/components/schemas/RotationPolicy' rsa: $ref: '#/components/schemas/RsaOptions' scheduled_rotation: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: 'Timestamp at which security object will be rotated, if rotation policy exists. This time will be clamped at 31 December 9999 11:59:59 pm UTC if the calculated rotation time would exceed that date.' seed: $ref: '#/components/schemas/SeedOptions' slip10: $ref: '#/components/schemas/Slip10Options' state: $ref: '#/components/schemas/SobjectState' transient_key: type: string format: byte description: Transient key material. value: type: string format: byte description: Security object stored as byte array. virtual_key_info: $ref: '#/components/schemas/VirtualSobjectInfo' wrapping_key_group_ids: type: - array - 'null' uniqueItems: true items: type: string format: uuid description: Group ids of groups that use this security object to encrypt the key material of their security objects xmss: $ref: '#/components/schemas/XmssOptions' group_id: type: - string - 'null' format: uuid description: UUID of the group which the security object belongs to. required: - acct_id - created_at - creator - enabled - key_ops - obj_type - origin - public_only EncryptUpdateResponse: allOf: - type: object description: Response body of multi-part encryption. properties: cipher: type: string format: byte description: Encrypted bytes object from multi-part flow state: type: string format: byte description: 'Current state of the encrypted cipher Opaque data, not to be interpreted or modified by the client and must be provided with next request.' required: - cipher - state FpeDateConstraint: description: Possible date-related constraint types for a portion of a complex tokenization data type. oneOf: - $ref: '#/components/schemas/FpeDate' - $ref: '#/components/schemas/FpeDatePart' DeriveKeyMechanism: description: Mechanism to be used when deriving a new key from an existing key. oneOf: - title: DeriveKeyMechanismVariantEncryptData type: object properties: encrypt_data: $ref: '#/components/schemas/EncryptRequest' required: - encrypt_data - title: DeriveKeyMechanismVariantBip32MasterKey type: object properties: bip32_master_key: $ref: '#/components/schemas/DeriveKeyMechanismBip32MasterKey' required: - bip32_master_key - title: DeriveKeyMechanismVariantBip32HardenedChild type: object properties: bip32_hardened_child: $ref: '#/components/schemas/DeriveKeyMechanismBip32HardenedChild' required: - bip32_hardened_child - title: DeriveKeyMechanismVariantSlip10MasterKey type: object properties: slip10_master_key: type: object properties: {} required: - slip10_master_key - title: DeriveKeyMechanismVariantSlip10HardenedChild type: object properties: slip10_hardened_child: $ref: '#/components/schemas/DeriveKeyMechanismSlip10HardenedChild' required: - slip10_hardened_child - title: DeriveKeyMechanismVariantHkdf type: object properties: hkdf: $ref: '#/components/schemas/DeriveKeyMechanismHkdf' required: - hkdf MacResponse: allOf: - type: object description: Response of a MAC computation request. properties: kid: type: - string - 'null' format: uuid description: 'The ID of the key used to compute the MAC. Returned for non-transient keys' mac: type: string format: byte description: MAC generated for the input data required: - mac FpeDataPartLiteral: allOf: - type: object description: 'A section of the data type that is not to be tokenized (e.g., a delimiter). Unlike preserved characters, literal characters are not used for FF1 tweaks.' properties: literal: type: array items: type: string description: 'The list of possible strings that make up this literal portion of the token. For example, if a delimiter can either be a space or a dash, the list would be `[" ", "-"]`. Implementation note: the backend will pick the first choice that matches when when parsing the input. If this results in an invalid parse of the rest of the input, the backend ***will not backtrack*** and will simply return with an error.' required: - literal BlsVariant: description: Signature/public-key size trade-off for BLS. type: string enum: - small_signatures - small_public_keys OauthScope: description: OAuth scope. type: string enum: - app - openid - email - profile RevocationReason: allOf: - type: object description: Reason for revoking a key. properties: code: $ref: '#/components/schemas/RevocationReasonCode' message: type: - string - 'null' description: 'Message is used exclusively for audit trail/logging purposes and MAY contain additional information about why the object was revoked.' compromise_occurance_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z required: - code ExportPolicy: oneOf: - $ref: '#/components/schemas/ExportPolicyVariantWrapped' - $ref: '#/components/schemas/ExportPolicyVariantUnrestricted' discriminator: propertyName: $type mapping: Wrapped: ExportPolicyVariantWrapped Unrestricted: ExportPolicyVariantUnrestricted HistoryItem: allOf: - type: object description: 'A particular entry in a security object''s history. These entries are maintained as part of the key history (aka key undo) policy feature, which allows otherwise- irreversible operations on security objects to be reversible. Each entry represents a particular "snapshot in time" to which a security object can be reverted. Such entries are only recorded when key history is disabled.' properties: id: type: string format: uuid description: The ID identifying this particular entry. state: $ref: '#/components/schemas/HistoryItemState' created_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: The time when this history entry was created. expiry: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: 'The time when this entry is no longer available for undo purposes.' required: - id - state - created_at - expiry RotationInterval: oneOf: - title: RotationIntervalVariantIntervalDays type: object properties: interval_days: type: integer minimum: 0 maximum: 4294967295 required: - interval_days - title: RotationIntervalVariantIntervalMonths type: object properties: interval_months: type: integer minimum: 0 maximum: 4294967295 required: - interval_months ExternalKmsInfo: description: Information about a specific external KMS key object. oneOf: - $ref: '#/components/schemas/ExternalKmsInfoVariantAWS' - $ref: '#/components/schemas/ExternalKmsInfoVariantOci' discriminator: propertyName: type mapping: AWS: ExternalKmsInfoVariantAWS Oci: ExternalKmsInfoVariantOci WrapKeyResponse: allOf: - type: object description: Result of a key wrapping request. properties: wrapped_key: type: string format: byte description: The wrapped key blob iv: type: string format: byte description: 'The initialization vector used during encryption. This is only applicable for certain symmetric encryption modes.' tag: type: string format: byte description: 'The authenticated tag returned from authenticated encryption (i.e., using GCM or CCM mode). For other modes, this field is not applicable.' required: - wrapped_key Bip32Options: allOf: - type: object properties: derivation_path: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 description: 'The BIP32 path, starting from master. Master key is Some([]). Ex: m/42/42''/0 -> Some([42, 2**31 + 42, 0])' network: $ref: '#/components/schemas/Bip32Network' FpeDateMonthDay: allOf: - type: object description: 'Represents a date that consists of a Month subpart and a Day subpart. It is an error to preserve only the Month part or the Day part.' properties: before: $ref: '#/components/schemas/FpeDayMonthDate' after: $ref: '#/components/schemas/FpeDayMonthDate' FpeWordsCustom: allOf: - type: object properties: list: type: array items: type: string description: 'Examples: {"john", "jane"}, {".", "-", "_", "@", " "}' required: - list AwsKeyMaterialId: allOf: - type: object properties: key_material_id: type: string description: key material ID reported by AWS KMS key_material_index: type: integer description: The index of the key material in the AWS ListKeyRotations response required: - key_material_id - key_material_index RsaEncryptionPolicy: allOf: - type: object description: Constraints on RSA encryption parameters. In general, if a constraint is not specified, anything is allowed. properties: padding: $ref: '#/components/schemas/RsaEncryptionPaddingPolicy' MlDsaModeVariantPure: allOf: - type: object properties: variant: type: string enum: - PURE required: - variant - type: object properties: {} FpeCompoundPart: description: 'Structure of a compound portion of a complex tokenization data type, itself composed of smaller parts.' oneOf: - $ref: '#/components/schemas/FpeCompoundPartOr' - $ref: '#/components/schemas/FpeCompoundPartConcat' - $ref: '#/components/schemas/FpeCompoundPartMultiple' SeedOptions: allOf: - type: object properties: cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' FpeDateMonthYear: allOf: - type: object description: 'Represents a date that consists of a Month subpart and a Year subpart. The Year part is allowed to be preserved; however, the Month part cannot be preserved by itself.' properties: before: $ref: '#/components/schemas/FpeMonthYearDate' after: $ref: '#/components/schemas/FpeMonthYearDate' FpeOptionsAdvanced: allOf: - type: object description: 'Advanced FPE options. It is recommended to use this for specifying any FPE options, as it is more expressive than FpeOptionsBasic.' properties: format: $ref: '#/components/schemas/FpeDataPart' description: type: - string - 'null' description: The user-provided name for the data type. required: - format Principal: description: A security principal. oneOf: - title: PrincipalVariantApp type: object properties: app: type: string format: uuid required: - app - title: PrincipalVariantUser type: object properties: user: type: string format: uuid required: - user - title: PrincipalVariantPlugin type: object properties: plugin: type: string format: uuid required: - plugin - title: PrincipalVariantUserViaApp type: object properties: userviaapp: $ref: '#/components/schemas/PrincipalUserViaApp' required: - userviaapp - title: PrincipalVariantSystem type: string enum: - system - title: PrincipalVariantUnregisteredUser type: string enum: - unregistereduser SobjectState: description: Security object operational state. type: string enum: - PreActive - Active - Deactivated - Compromised - Destroyed - Deleted SignResponse: allOf: - type: object description: Response of a signing request. properties: kid: type: - string - 'null' format: uuid description: The ID of the key used for signing. Returned for non-transient keys signature: type: string format: byte description: Signed data required: - signature Algorithm: description: A cryptographic algorithm. type: string enum: - AES - ARIA - DES - DES3 - SEED - RSA - DSA - KCDSA - EC - ECKCDSA - BIP32 - SLIP10 - BLS - LMS - XMSS - MLDSA - MLDSABETA - MLKEM - MLKEMBETA - HMAC - LEDABETA - ROUND5BETA - PBE EncryptFinalResponse: allOf: - type: object description: Final response body of a multi-part encryption. properties: cipher: type: string format: byte description: Final encrypted bytes tag: type: string format: byte description: Tag is only returned for symmetric encryption with GCM mode. required: - cipher ObjectType: description: Type of security object. type: string enum: - AES - ARIA - DES - DES3 - SEED - RSA - DSA - EC - KCDSA - ECKCDSA - BIP32 - SLIP10 - BLS - OPAQUE - HMAC - LEDABETA - ROUND5BETA - SECRET - LMS - XMSS - MLDSA - MLDSABETA - MLKEM - MLKEMBETA - CERTIFICATE - PBE RsaSignaturePolicy: allOf: - type: object description: Constraints on RSA signature parameters. In general, if a constraint is not specified, anything is allowed. properties: padding: $ref: '#/components/schemas/RsaSignaturePaddingPolicy' DigestAlgorithm: description: A hash algorithm. type: string enum: - BLAKE2B256 - BLAKE2B384 - BLAKE2B512 - BLAKE2S256 - RIPEMD160 - SSL3 - SHA1 - SHA224 - SHA256 - SHA384 - SHA512 - STREEBOG256 - STREEBOG512 - SHA3_224 - SHA3_256 - SHA3_384 - SHA3_512 KcdsaOptions: allOf: - type: object properties: subgroup_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 hash_alg: $ref: '#/components/schemas/DigestAlgorithm' DecryptResponse: allOf: - type: object description: Response of a decryption request. properties: kid: type: - string - 'null' format: uuid description: The ID of the key used for decryption. Returned for non-transient keys. plain: type: string format: byte description: 'Decrypted plaintext bytes. Note that when performing format-preserving decryption (i.e., detokenization), the plaintext is encoded as UTF-8 bytes.' required: - plain WrapKeyRequest: allOf: - type: object description: Request to wrap an sobject with another sobject. properties: key: $ref: '#/components/schemas/SobjectDescriptor' subject: $ref: '#/components/schemas/SobjectDescriptor' kid: type: - string - 'null' format: uuid description: 'ID of the sobject to be wrapped. (This is a legacy field, mutually exclusive with `subject`).' alg: $ref: '#/components/schemas/Algorithm' mode: $ref: '#/components/schemas/CryptMode' iv: type: string format: byte description: 'The initialization vector to use. This is only applicable to modes that take IVs, and will be randomly generated if not specified.' ad: type: string format: byte description: 'The authenticated data to use. This is only applicable when using authenticated encryption modes (i.e., GCM or CCM).' tag_len: type: - integer - 'null' description: 'The length of the authentication tag, in bits, for authenticated encryption modes (i.e., GCM or CCM). For other modes, this field is irrelevant.' key_format: $ref: '#/components/schemas/KeyFormat' required: - alg KeyCreationMethodVariantAgree: allOf: - type: object properties: method: type: string enum: - Agree required: - method - type: object properties: {} FpeTokenizeMode: description: How to tokenize a given input. The most secure option is "PreserveFormat". type: string enum: - preserve_format - preserve_variant - preserve_length EncapsulateKeyRequest: allOf: - type: object description: Request body to perform key encapsulation. properties: key: $ref: '#/components/schemas/SobjectDescriptor' name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name of the resulting symmetric key group_id: type: - string - 'null' format: uuid description: 'Group ID of the security group that the resulting Sobject should belong to. The application creating this Sobject must be a member of this group. If no group is specified, the default group for the requesting application will be used.' key_type: $ref: '#/components/schemas/ObjectType' key_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Key size in bits of the resulting key key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: Key operations of the resulting key transient: type: - boolean - 'null' description: If set to true, the resulting key will be transient. required: - key - key_type FpeInputDefaultProcessing: type: string enum: - strip - reject RsaSignaturePadding: description: 'Type of padding to use for RSA signatures. The padding specified must adhere to the key''s signature policy. If not specified, the default based on the key''s policy will be used.' oneOf: - title: RsaSignaturePaddingVariantPss type: object properties: PSS: $ref: '#/components/schemas/RsaSignaturePaddingPss' required: - PSS - title: RsaSignaturePaddingVariantPkcs1V15 type: object properties: PKCS1_V15: type: object properties: {} required: - PKCS1_V15 DecryptUpdateRequest: allOf: - type: object description: Request body for multi-part decryption. properties: key: $ref: '#/components/schemas/SobjectDescriptor' cipher: type: string format: byte description: Encrypted bytes state: type: string format: byte description: Current state of the encrypted cipher required: - cipher - state VirtualSobjectInfo: allOf: - type: object description: 'Information specific to a virtual key. Currently, this is only relevant for virtual keys backed by DSM.' properties: cached_key_material: type: boolean description: Whether or not the source key material is cached within the key. required: - cached_key_material DeriveKeyMechanismBip32MasterKey: allOf: - type: object properties: network: $ref: '#/components/schemas/Bip32Network' required: - network BatchVerifyResponseItem: oneOf: - title: BatchVerifyResponseItemSuccess type: object properties: status: type: integer body: $ref: '#/components/schemas/VerifyResponse' - title: BatchVerifyResponseItemError type: object properties: status: type: integer error: type: string KeyLinks: allOf: - type: object description: Linked security objects. properties: replacement: type: - string - 'null' format: uuid description: key id of the key that replaced this key (i.e., this key was rotated to the `replacement` key) replaced: type: - string - 'null' format: uuid description: key id of the key that was replaced by this key (i.e., the `replaced` key was rotated to this key) copiedFrom: type: - string - 'null' format: uuid copiedTo: type: - array - 'null' items: type: string format: uuid subkeys: type: - array - 'null' items: type: string format: uuid parent: type: - string - 'null' format: uuid wrappingKey: type: - string - 'null' format: uuid description: Wrapping key used to wrap this security object MlDsaModeVariantPreHash: allOf: - type: object properties: variant: type: string enum: - PRE_HASH required: - variant - type: object properties: {} FpeEncryptedPart: allOf: - type: object description: 'Structure of a tokenized portion of a complex tokenization data type. Implementation note: the backend parser is locally "greedy" and will attempt to match as many characters as possible. If this later results in an invalid parse of the rest of the input, the backend ***will not backtrack*** and will simply return with an error.' properties: min_length: type: integer minimum: 0 maximum: 4294967295 description: The minimum allowed length for this part (in chars). max_length: type: integer minimum: 0 maximum: 4294967295 description: The maximum allowed length for this part (in chars). char_set: $ref: '#/components/schemas/FpeCharSet' cipher_char_set: $ref: '#/components/schemas/FpeCharSet' constraints: $ref: '#/components/schemas/FpeConstraints' preserve: $ref: '#/components/schemas/FpePreserveMask' mask: $ref: '#/components/schemas/FpePreserveMask' required: - min_length - max_length - char_set UnwrapKeyRequest: allOf: - type: object description: Request to unwrap an sobject with another sobject. properties: key: $ref: '#/components/schemas/SobjectDescriptor' alg: $ref: '#/components/schemas/Algorithm' obj_type: $ref: '#/components/schemas/ObjectType' rsa: $ref: '#/components/schemas/RsaOptions' wrapped_key: type: string format: byte description: A security object previously wrapped with another key mode: $ref: '#/components/schemas/CryptMode' iv: type: string format: byte description: 'The initialization vector to use, required for modes that take IVs (and irrelevant otherwise).' ad: type: string format: byte description: 'The authenticated data to use. This is only applicable when using authenticated decryption modes (i.e., GCM or CCM).' tag: type: string format: byte description: 'The authentication tag, relevant for authenticated encryption modes (i.e., GCM or CCM), and otherwise irrelevant.' name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name to be given to the resulting security object, if persisted group_id: type: - string - 'null' format: uuid description: 'ID of the group that the unwrapped security object should belong to (if persisted). The user or application creating this security object must be a member of this group. If no group is specified, and the requester is an app, the app''s default group will be used.' enabled: type: - boolean - 'null' description: 'Whether the unwrapped key should have cryptographic operations enabled. Defaults to true.' description: type: - string - 'null' description: User-defined description of the unwrapped key custom_metadata: type: - object - 'null' additionalProperties: type: string description: User-defined metadata for the resulting key, stored as key-value pairs. key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: 'Optional array of key operations to be enabled for the resulting security object. If not provided, DSM will provide a default set of key operations. Note that an empty array will result in all key operations being disabled.' transient: type: - boolean - 'null' description: Whether the unwrapped key should be a transient key kcv: type: string description: Checksum value of the wrapped key kcv_method: $ref: '#/components/schemas/KcvMethod' export_policy: $ref: '#/components/schemas/SobjectExportPolicy' required: - alg - obj_type - wrapped_key securitySchemes: basicAuth: type: http scheme: basic apiKeyAuth: type: apiKey name: Authorization in: header description: Please enter your token prefixed with 'Basic ' (e.g., 'Basic your_token_here') bearerToken: type: http scheme: bearer bearerFormat: JWT