openapi: 3.2.0 info: title: Fortanix DSM REST Groups API description: "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients. \n- PATCH requests accept a JSON value describing a partial update to the specified resource. All top-level fields in the PATCH request are optional. If an optional field is omitted, the existing value of that field is preserved. In general, for nested JSON objects, the request must provide the complete object value rather than a partial update." termsOfService: https://fortanix.com/legal/agreements-and-standard-terms contact: name: Fortanix Support url: https://support.fortanix.com/ email: support@fortanix.com license: name: Apache 2.0 url: http://www.apache.org/licenses/LICENSE-2.0.html version: 0.1.0-20260710 servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) tags: - name: Groups paths: /sys/v1/groups/{group_id}/hmg/scans: post: operationId: AsyncScanHmg tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Scan external objects asynchronously. description: 'Scan external objects asynchronously and create corresponding virtual sobjects in the group as needed. If there is already a virtual sobject corresponding to a scanned object, no sobject is created. This is only supported for DSM-backed groups currently.' parameters: - name: group_id in: path required: true schema: type: string format: uuid responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Scan' get: operationId: GetAllHmgScans tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Retrieve the scan status of an external group. description: Retrieve the scan status of an external group. parameters: - name: group_id in: path required: true schema: type: string format: uuid responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/GetAllHmgScansResponse' /sys/v1/groups/{group_id}/hmg/check: post: operationId: CheckHmg tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: 'Check that the HMG configuration for a particular group is valid and reachable.' description: 'Check that the HMG configuration for a particular group is valid and reachable.' parameters: - name: group_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CheckHmgRequest' responses: '204': description: Nothing is returned on success /sys/v1/groups/hmg/check: post: operationId: CheckHmgConfig tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Check that the HMG configuration provided is valid and reachable. description: Check that the HMG configuration provided is valid and reachable. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/HmgConfig' responses: '204': description: Nothing is returned on success /sys/v1/groups: post: operationId: CreateGroup tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Create a new group with the specified properties. description: Create a new group with the specified properties. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/GroupRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Group' get: operationId: ListGroups tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Get all groups accessible to the requester. description: Get all groups accessible to the requester. parameters: - $ref: '#/components/parameters/GetGroupsParams' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/ListGroupsResponse' /sys/v1/groups/{group_id}: delete: operationId: DeleteGroup tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Delete the group. description: Delete the group. parameters: - name: group_id in: path required: true schema: type: string format: uuid responses: '204': description: Nothing is returned on success get: operationId: GetGroup tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Lookup a specific group. description: Lookup a specific group. parameters: - name: group_id in: path required: true schema: type: string format: uuid responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Group' patch: operationId: UpdateGroup tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Change a group's properties. description: Change a group's properties. parameters: - name: group_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/GroupRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Group' /sys/v1/groups/hmg/gcp_key_rings: post: operationId: GetGcpKeyRings tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: 'Given an GCP configuration, fetch a list of available GCP key rings which can be used to back a group.' description: 'Given an GCP configuration, fetch a list of available GCP key rings which can be used to back a group.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/GcpKeyRingConfig' responses: 2XX: description: Success result content: application/json: schema: type: array items: type: string /sys/v1/groups/{group_id}/hmg/scans/{scan_id}: get: operationId: GetScan tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: 'Query the status of a particular scan. Only the last five completed scans,as well as any in-progress scan, is queryable.' description: 'Query the status of a particular scan. Only the last five completed scans,as well as any in-progress scan, is queryable.' parameters: - name: group_id in: path required: true schema: type: string format: uuid - name: scan_id in: path required: true schema: type: string format: uuid responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/Scan' /sys/v1/groups/hmg/azure_vaults: post: operationId: GetVaults tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: 'Given an Azure configuration, fetch a list of available Azure key vaults which can be used to back a group.' description: 'Given an Azure configuration, fetch a list of available Azure key vaults which can be used to back a group.' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/HmgConfig' responses: 2XX: description: Success result content: application/json: schema: type: array items: $ref: '#/components/schemas/KeyVault' /sys/v1/groups/hmg/scan_collections: post: operationId: ListKeyCollections tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Using the chosen credential, list the key collections available. description: Using the chosen credential, list the key collections available. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/HmgListKeyCollectionsRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/HmgListKeyCollectionsResponse' /sys/v1/groups/{group_id}/hmg/scan: post: operationId: ScanHmg tags: - Groups security: - bearerToken: [] - apiKeyAuth: [] summary: Scan external objects. description: 'Scan external objects synchronously and create corresponding virtual sobjects in the group as needed. If there is already a virtual sobject corresponding to a scanned object, no sobject is created (but the existing virtual sobject may be updated). Returns a list of all the newly-created sobjects.' parameters: - name: group_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ScanHmgRequest' responses: 2XX: description: Success result content: application/json: schema: type: array items: $ref: '#/components/schemas/Sobject' components: schemas: HmgConfigFortanixFipsCluster: allOf: - type: object properties: url: type: string tls: $ref: '#/components/schemas/TlsConfig' pin: type: string credentials: type: - array - 'null' items: type: string hsm_order: type: - integer - 'null' format: int32 description: 'The priority of this `HmgConfig`. This is used when a group is configured with an `HmgRedundancyScheme`, and is otherwise unused. (See the docs for `HmgRedundancyScheme` for more information about the interpretation of this field.)' required: - url - tls ClientFileLogging: oneOf: - $ref: '#/components/schemas/ClientFileLoggingVariantEnabled' - $ref: '#/components/schemas/ClientFileLoggingVariantDisabled' discriminator: propertyName: mode mapping: enabled: ClientFileLoggingVariantEnabled disabled: ClientFileLoggingVariantDisabled FpeDate: description: 'A structure for specifying a token part representing a date that occurs after a specified date and/or occurs before a specified date. Depending on the subparts that make up the date, one of the three options is used.' oneOf: - title: FpeDateVariantDayMonthYear type: object properties: dmy_date: $ref: '#/components/schemas/FpeDateDayMonthYear' required: - dmy_date - title: FpeDateVariantMonthDay type: object properties: month_day_date: $ref: '#/components/schemas/FpeDateMonthDay' required: - month_day_date - title: FpeDateVariantMonthYear type: object properties: month_year_date: $ref: '#/components/schemas/FpeDateMonthYear' required: - month_year_date EffectiveKeyOperations: description: "Operations allowed to be performed on a given key by a given User or an app\n\n\n\n SIGN:\n If this is set, the key can be used for signing.\n\n\n VERIFY:\n If this is set, the key can used for verifying a signature.\n\n\n ENCRYPT:\n If this is set, the key can be used for encryption.\n\n\n DECRYPT:\n If this is set, the key can be used for decryption.\n\n\n WRAPKEY:\n If this is set, the key can be used wrapping other keys.\n The key being wrapped must have the EXPORT operation enabled.\n\n\n UNWRAPKEY:\n If this is set, the key can be used to unwrap a wrapped key.\n\n\n DERIVEKEY:\n If this is set, the key can be used to derive another key.\n\n\n TRANSFORM:\n If this is set, the key can be transformed.\n\n\n MACGENERATE:\n If this is set, the key can be used to compute a cryptographic\n Message Authentication Code (MAC) on a message.\n\n\n MACVERIFY:\n If they is set, the key can be used to verify a MAC.\n\n\n EXPORT:\n If this is set, the value of the key can be retrieved\n with an authenticated request. This shouldn't be set unless\n required. It is more secure to keep the key's value inside DSM only.\n\n\n APPMANAGEABLE:\n Without this operation, management operations like delete, destroy,\n rotate, activate, restore, revoke, revert, update, remove_private, etc.\n cannot be performed by a crypto App.\n A user with access or admin app can still perform these operations.\n This option is only relevant for crypto apps.\n\n\n HIGHVOLUME:\n If this is set, audit logs will not be recorded for the key.\n High volume here tries to signify a key that is being used a lot\n and will produce lots of logs. Setting this operation disables\n audit logs for the key.\n\n\n AGREEKEY:\n If this is set, the key can be used for key agreement.\n Both the private and public key should have this option enabled\n to perform an agree operation.\n\n\n ENCAPSULATE:\n If this is set, the key can be used for key encapsulation. The\n result is a new symmetric key and a ciphertext.\n\n\n DECAPSULATE:\n If this is set, the key can be used for key decapsulation. If\n decapsulation succeeds, the result is a new symmetric key.\n\n\n MASKDECRYPT:\n If this is set, the key can be used for masked decryption only.\n\n" type: string enum: - SIGN - VERIFY - ENCRYPT - DECRYPT - WRAPKEY - UNWRAPKEY - DERIVEKEY - TRANSFORM - MACGENERATE - MACVERIFY - EXPORT - APPMANAGEABLE - HIGHVOLUME - AGREEKEY - ENCAPSULATE - DECAPSULATE - MASKDECRYPT GroupApprovalPolicy: allOf: - type: object description: Group approval policy. properties: protect_manage_operations: type: - boolean - 'null' description: 'Deprecated, left this for backward compatibility. When this is true, manage operations on security objects require approval.' protect_permissions: type: - array - 'null' items: $ref: '#/components/schemas/QuorumGroupPermissions' description: Use QuorumGroupPermissions to represent operations that require approval. protect_crypto_operations: type: - boolean - 'null' description: When this is true, cryptographic operations on security objects require approval. - $ref: '#/components/schemas/QuorumPolicy' ExternalKmsInfoVariantOci: allOf: - type: object properties: type: type: string enum: - Oci required: - type - $ref: '#/components/schemas/OciVaultInfo' WrappingKeyName: oneOf: - type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ KeyCreationMethodVariantUnwrap: allOf: - type: object properties: method: type: string enum: - Unwrap required: - method - type: object properties: {} ApiPath: allOf: - type: object properties: api_path: type: string method: type: string context: $ref: '#/components/schemas/TepKeyContext' key_path: type: string required: - api_path - method - context - key_path FpeDataPart: description: Structure for specifying (part of) a complex tokenization data type. oneOf: - $ref: '#/components/schemas/FpeEncryptedPart' - $ref: '#/components/schemas/FpeDataPartLiteral' - $ref: '#/components/schemas/FpeCompoundPart' PublishPublicKeyConfigEnabled: allOf: - type: object properties: list_previous_version: type: boolean description: Additionally list the previous version of the key if not compromised. required: - list_previous_version GoogleAccessReason: description: An access reason provided by Google when making EKMS API calls. type: string enum: - REASON_UNSPECIFIED - CUSTOMER_INITIATED_SUPPORT - GOOGLE_INITIATED_SERVICE - THIRD_PARTY_DATA_REQUEST - GOOGLE_INITIATED_REVIEW - CUSTOMER_INITIATED_ACCESS - GOOGLE_INITIATED_SYSTEM_OPERATION - REASON_NOT_EXPECTED - MODIFIED_CUSTOMER_INITIATED_ACCESS - MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION - GOOGLE_RESPONSE_TO_PRODUCTION_ALERT - CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING Slip10Options: allOf: - type: object properties: derivation_path: type: array items: type: integer minimum: 0 maximum: 4294967295 description: 'The Slip10 path, starting from master. Master key is []. Ex: m/42/42''/0 -> [42, 2**31 + 42, 0]' required: - derivation_path CipherMode: description: Cipher mode used for symmetric key algorithms. type: string enum: - ECB - CBC - CBCNOPAD - CFB - OFB - CTR - GCM - CCM - KW - KWP - FF1 CountAccuracy: description: An indicator of how accurate a count of objects is. oneOf: - $ref: '#/components/schemas/CountAccuracyVariantExact' - $ref: '#/components/schemas/CountAccuracyVariantApproximate' discriminator: propertyName: $type mapping: Exact: CountAccuracyVariantExact Approximate: CountAccuracyVariantApproximate TlsConfigVariantOpportunistic: allOf: - type: object properties: mode: type: string enum: - opportunistic required: - mode - type: object properties: {} GoogleAccessReasonPolicy: allOf: - type: object description: 'Policy specifying acceptable access reasons by Google Service Account at App or Sobject level.' properties: allow: type: array uniqueItems: true items: $ref: '#/components/schemas/GoogleAccessReason' description: Set of allowed Google Access reasons. allow_missing_reason: type: boolean description: Accept incoming requests which do not specify any access reasons. required: - allow - allow_missing_reason FpeDayMonthDate: allOf: - type: object description: 'A structure for specifying a particular date consisting of a day and a month, for use in an FpeDate structure.' properties: month: type: integer minimum: 0 maximum: 255 description: The month, which should be an integer from 1 to 12. day: type: integer minimum: 0 maximum: 255 description: 'The day, which should be an integer from 1 to either 29, 30, or 31, depending on the month and year. Here, February is treated as having 29 days.' required: - month - day FpeInputProcessing: description: Options to apply some pre- and post-processing to the input. oneOf: - title: FpeInputProcessingVariantStripUnknown type: string enum: - strip_unknown - title: FpeInputProcessingVariantPassthroughUnknown type: string enum: - passthrough_unknown - title: FpeInputProcessingVariantPassthroughSpecific type: object properties: passthrough_specific: $ref: '#/components/schemas/FpeInputProcessingPassthroughSpecific' required: - passthrough_specific CommonClientConfig: allOf: - type: object properties: retry_timeout_millis: type: - integer - 'null' cache_ttl: type: - integer - 'null' log: $ref: '#/components/schemas/ClientLogConfig' h2_num_connections: type: - integer - 'null' quorum_approval: $ref: '#/components/schemas/QuorumApprovalConfig' RemovableKmipClientConfig: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/KmipClientConfig' CertificateOptionsPolicy: allOf: - type: object properties: {} Des3OptionsPolicy: allOf: - type: object description: 'Cryptographic policy for triple DES objects. Setting `key_sizes: [168]` forbids two-key triple DES.' properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 random_iv: type: - boolean - 'null' PublishPublicKeyConfig: description: If enabled, the public key will be available publicly (without authentication) through the GetPublicKey API. oneOf: - $ref: '#/components/schemas/PublishPublicKeyConfigVariantEnabled' - $ref: '#/components/schemas/PublishPublicKeyConfigVariantDisabled' discriminator: propertyName: state mapping: enabled: PublishPublicKeyConfigVariantEnabled disabled: PublishPublicKeyConfigVariantDisabled CheckHmgRequest: allOf: - type: object properties: id: type: - string - 'null' format: uuid description: The ID of the hmg configuration in the group. config: $ref: '#/components/schemas/HmgConfig' AriaOptions: allOf: - type: object properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 tag_length: type: - integer - 'null' minimum: 0 maximum: 255 cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' iv_length: type: - integer - 'null' minimum: 0 maximum: 255 ScanResultVariantFailed: allOf: - type: object properties: $type: type: string enum: - Failed required: - $type - $ref: '#/components/schemas/ScanResultFailed' KeyCreationMethodVariantImport: allOf: - type: object properties: method: type: string enum: - Import required: - method - type: object properties: {} FpeInputProcessingPassthroughSpecific: allOf: - type: object properties: passthrough: type: array uniqueItems: true items: type: string minLength: 1 maxLength: 1 other: $ref: '#/components/schemas/FpeInputDefaultProcessing' required: - passthrough - other OciVaultInfo: allOf: - type: object description: 'Any key specific metadata that isn''t already described by an existing security object field.' properties: protection_mode: type: string description: 'Describes the OCI vault protection mode, usually meaning HSM or SOFTWARE.' deletion_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: The scheduled deletion_date of the OCI key version display_name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: 'The name in the OCI Vault (and may differ from what the DSM virtual key shows).' required: - protection_mode - display_name TepKeyMapList: allOf: - type: array items: $ref: '#/components/schemas/TepKeyMap' HmgConfigVariantFortanix: allOf: - type: object properties: kind: type: string enum: - Fortanix required: - kind - $ref: '#/components/schemas/HmgConfigFortanix' ApprovalAuthConfig: allOf: - type: object description: Authentication requirements for approval request reviewers. properties: require_password: type: - boolean - 'null' require_2fa: type: - boolean - 'null' LmsOptionsPolicy: allOf: - type: object properties: {} HmgConfigVariantFortanixFipsCluster: allOf: - type: object properties: kind: type: string enum: - FortanixFipsCluster required: - kind - $ref: '#/components/schemas/HmgConfigFortanixFipsCluster' PublishPublicKeyConfigVariantEnabled: allOf: - type: object properties: state: type: string enum: - enabled required: - state - $ref: '#/components/schemas/PublishPublicKeyConfigEnabled' AutoScanSettings: allOf: - type: object description: Settings for automatic scanning in DSM-backed groups or replication accounts. properties: scan_interval_hours: type: integer minimum: 0 maximum: 255 description: The number of hours between successive automatic scans. Must be greater than 0. required: - scan_interval_hours RotationPolicy: allOf: - type: object properties: effective_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z deactivate_rotated_key: type: - boolean - 'null' rotate_copied_keys: $ref: '#/components/schemas/RotateCopiedKeys' - $ref: '#/components/schemas/RotationInterval' FpeConstraints: allOf: - type: object description: Constraints on a portion of a complex tokenization data type. properties: luhn_check: type: - boolean - 'null' description: 'Whether the token part contains a checksum that satisfies the Luhn formula. It is an error to apply this constraint to non-numeric parts, or to have an encrypted part be under more than one Luhn check constraint. Also, if an encrypted part has a Luhn check constraint applied to it and may contain at least one digit that is not preserved, it must not specify any other constraints.' num_gt: type: - integer - 'null' description: 'Number that the token part should be greater than. This constraint can only be specified on (non-compound) numeric encrypted parts guaranteed to preserve either everything or nothing at all. (For example, if an encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the first five digits is not guaranteed to preserve everything, because if the input happens to be six or more digits long, there will be at least one digit that remains unpreserved.)' num_lt: type: - integer - 'null' description: 'Number that the token part should be smaller than. This constraint can only be specified on (non-compound) numeric encrypted parts guaranteed to preserve either everything or nothing at all. (For example, if an encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the first five digits is not guaranteed to preserve everything, because if the input happens to be six or more digits long, there will be at least one digit that remains unpreserved.)' num_ne: type: - array - 'null' items: type: integer description: 'Numbers that the token part should not be equal to. It is an error to apply this constraint to non-numeric parts.' date: $ref: '#/components/schemas/FpeDateConstraint' applies_to: $ref: '#/components/schemas/FpeConstraintsApplicability' AwsKeyRotationStatusVariantKeyRotationEnabled: allOf: - type: object properties: type: type: string enum: - KeyRotationEnabled required: - type - $ref: '#/components/schemas/AwsKeyRotationStatusKeyRotationEnabled' AwsKmsInfo: allOf: - type: object description: Information and properties of an AWS KMS key. properties: multi_region: $ref: '#/components/schemas/AwsMultiRegionInfo' aws_key_rotation_status: $ref: '#/components/schemas/AwsKeyRotationStatus' origin: $ref: '#/components/schemas/AwsKeyOrigin' HmgListKeyCollectionsResponseVariantOciKeyVault: allOf: - type: object properties: $type: type: string enum: - OciKeyVault required: - $type - $ref: '#/components/schemas/HmgListKeyCollectionsResponseOciKeyVault' FpeCompoundPartOr: allOf: - type: object description: 'Represents an OR of multiple structures. Implementation note: an OR is _not_ a union of `FpeDataPart`s. Rather, when parsing the input, the backend will simply choose the first subpart that matches the current portion of the input, and tokenize/detokenize accordingly. If that choice results in an invalid parse of the rest of the input, the backend ***will not backtrack*** and will simply return with an error.' properties: or: type: array items: $ref: '#/components/schemas/FpeDataPart' description: The actual subparts that make up this compound part. constraints: $ref: '#/components/schemas/FpeConstraints' preserve: type: - boolean - 'null' description: 'Whether the entire OR should be preserved as-is (i.e., not tokenized). If this is set, any descendant subparts cannot contain any preserve-related fields set.' mask: type: - boolean - 'null' description: 'Whether the entire OR should be masked when doing masked decryption. If this is set, any descendant subparts cannot contain any mask-related fields set.' min_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The minimum allowed length for this part (in chars). max_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The maximum allowed length for this part (in chars). required: - or GetGroupsParams: allOf: - type: object properties: limit: type: integer filter: type: string description: 'If specified, only groups matching this `filter` are returned. The following fields can be referenced in the filter: - `name` - `created_at` - `description` - `wrapping_key_name`' offset: type: integer description: Number of groups to skip continuation_token: type: string description: 'Continuation token to continue getting results. It must be the same token returned from the backend from a previous call, or empty. Existence of this query parameter controls the response (and the backend behavior): - If specified (including an empty value), the backend returns metadata alongside the collection of groups. The metadata will potentially contain a fresh `continuation_token`. Note: If there is a `limit` specified in the request and DSM returns `limit`-many items in the response, it will still include a fresh continuation token if there are more items in the collection. Additionally, unlike other query parameters, `limit` is not required to remain unchanged in a chain of requests with `continuation_token`s. - If omitted, the backend returns just a collection of groups with no metadata.' - $ref: '#/components/schemas/GroupSort' EcKcdsaOptionsPolicy: allOf: - type: object properties: {} LegacyKeyPolicy: type: string enum: - allowed - prohibited - unprotect_only MetadataStringConstraintRequired: allOf: - type: object properties: non_empty_after_trim: type: - boolean - 'null' description: 'If set to `true`, the value must have a length > 0 after trimming leading and trailing whitespace characters.' allowed_values: type: - array - 'null' uniqueItems: true items: type: string description: If not specified or empty, it will not impose any restrictions on the value. TepKeyMap: allOf: - type: object properties: path: $ref: '#/components/schemas/ApiPath' kid: type: string format: uuid mode: $ref: '#/components/schemas/CipherMode' required: - path - kid - mode FpeDayMonthYearDate: allOf: - type: object description: 'A structure for specifying a particular date consisting of a day, month, and year, for use in an FpeDate structure.' properties: year: type: integer minimum: 0 maximum: 4294967295 description: The year, which should be an integer less than 100000. Zero is treated as a leap year. month: type: integer minimum: 0 maximum: 255 description: The month, which should be an integer from 1 to 12. day: type: integer minimum: 0 maximum: 255 description: 'The day, which should be an integer from 1 to either 28, 29, 30, or 31, depending on the month and year.' required: - year - month - day MlDsaOptionsPolicy: allOf: - type: object properties: {} AwsKeyRotationStatus: oneOf: - $ref: '#/components/schemas/AwsKeyRotationStatusVariantKeyRotationDisabled' - $ref: '#/components/schemas/AwsKeyRotationStatusVariantKeyRotationEnabled' discriminator: propertyName: type mapping: KeyRotationDisabled: AwsKeyRotationStatusVariantKeyRotationDisabled KeyRotationEnabled: AwsKeyRotationStatusVariantKeyRotationEnabled FpeOptions: description: 'FPE-specific options (for specifying the format of the data to be encrypted)' oneOf: - $ref: '#/components/schemas/FpeOptionsBasic' - $ref: '#/components/schemas/FpeOptionsAdvanced' - $ref: '#/components/schemas/FpeOptionsV2' MlDsaParamSet: description: ML-DSA parameter sets type: string enum: - MlDsa44 - MlDsa65 - MlDsa87 DsaOptionsPolicy: allOf: - type: object properties: {} HmgListKeyCollectionsResponse: oneOf: - $ref: '#/components/schemas/HmgListKeyCollectionsResponseVariantOciKeyVault' discriminator: propertyName: $type mapping: OciKeyVault: HmgListKeyCollectionsResponseVariantOciKeyVault KeyHistoryPolicy: allOf: - type: object description: Configuration for a key history (aka key undo) policy. properties: undo_time_window: $ref: '#/components/schemas/Secs' required: - undo_time_window ScanWarning: allOf: - type: object description: A warning "thrown" by a scan. properties: source_key_id: type: - string - 'null' format: uuid description: The ID of the source key for which the warning applies to. virtual_key_id: type: - string - 'null' format: uuid description: The ID of the virtual key for which the warning applies to. message: type: string description: The warning message associated with the warning. required: - message ScanHmgRequest: allOf: - type: object properties: {} HmgConfigVariantGcpKeyRing: allOf: - type: object properties: kind: type: string enum: - GcpKeyRing required: - kind - $ref: '#/components/schemas/GcpKeyRingConfig' ExternalKmsInfoVariantAWS: allOf: - type: object properties: type: type: string enum: - AWS required: - type - $ref: '#/components/schemas/AwsKmsInfo' HmgConfigAwsKms: allOf: - type: object properties: url: type: string tls: $ref: '#/components/schemas/TlsConfig' access_key: type: - string - 'null' secret_key: type: string region: type: - string - 'null' service: $ref: '#/components/schemas/AwskmsService' account_id: type: - string - 'null' key_material_mapping: $ref: '#/components/schemas/AwsKmsKeyMaterialMapping' required: - url - tls FpeSection: allOf: - type: object description: A concatenation of groups, optionally including a checksum. properties: groups: type: array items: $ref: '#/components/schemas/FpeGroup' checksum: $ref: '#/components/schemas/FpeChecksum' required: - groups HmgListKeyCollectionsRequest: oneOf: - $ref: '#/components/schemas/HmgListKeyCollectionsRequestVariantOciVault' discriminator: propertyName: $type mapping: OciVault: HmgListKeyCollectionsRequestVariantOciVault EffectiveKeyPolicy: allOf: - type: object description: 'An aggregation of policies and permissions of the session creator for a security object.' properties: key_ops: type: array items: $ref: '#/components/schemas/EffectiveKeyOperations' description: Indicates allowed key operations for the security key. export_policy: $ref: '#/components/schemas/ExportPolicy' required: - key_ops CryptographicPolicy: allOf: - type: object properties: aes: $ref: '#/components/schemas/AesOptionsPolicy' aria: $ref: '#/components/schemas/AriaOptionsPolicy' des3: $ref: '#/components/schemas/Des3OptionsPolicy' rsa: $ref: '#/components/schemas/RsaOptionsPolicy' hmac: $ref: '#/components/schemas/HmacOptionsPolicy' ec: $ref: '#/components/schemas/EcOptionsPolicy' legacy_policy: $ref: '#/components/schemas/LegacyKeyPolicy' key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' des: $ref: '#/components/schemas/DesOptionsPolicy' seed: $ref: '#/components/schemas/SeedOptionsPolicy' dsa: $ref: '#/components/schemas/DsaOptionsPolicy' kcdsa: $ref: '#/components/schemas/KcdsaOptionsPolicy' eckcdsa: $ref: '#/components/schemas/EcKcdsaOptionsPolicy' lms: $ref: '#/components/schemas/LmsOptionsPolicy' xmss: $ref: '#/components/schemas/XmssOptionsPolicy' mldsa: $ref: '#/components/schemas/MlDsaOptionsPolicy' mlkem: $ref: '#/components/schemas/MlKemOptionsPolicy' bip32: $ref: '#/components/schemas/Bip32OptionsPolicy' slip10: $ref: '#/components/schemas/Slip10OptionsPolicy' bls: $ref: '#/components/schemas/BlsOptionsPolicy' opaque: $ref: '#/components/schemas/OpaqueOptionsPolicy' secret: $ref: '#/components/schemas/SecretOptionsPolicy' certificate: $ref: '#/components/schemas/CertificateOptionsPolicy' CaConfig: description: CA settings. oneOf: - title: CaConfigVariantCaSet type: object properties: ca_set: $ref: '#/components/schemas/CaSet' required: - ca_set - title: CaConfigVariantPinned type: object properties: pinned: type: array items: type: string format: byte required: - pinned FpeMonthYearDate: allOf: - type: object description: 'A structure for specifying a particular date consisting of a month and a year, for use in an FpeDate structure.' properties: year: type: integer minimum: 0 maximum: 4294967295 description: The year, which should be an integer less than 100000. Zero is treated as a leap year. month: type: integer minimum: 0 maximum: 255 description: The month, which should be an integer from 1 to 12. required: - year - month ClientConfigurationsRequest: allOf: - type: object properties: common: $ref: '#/components/schemas/RemovableCommonClientConfig' pkcs11: $ref: '#/components/schemas/RemovablePkcs11ClientConfig' kmip: $ref: '#/components/schemas/RemovableKmipClientConfig' tep: $ref: '#/components/schemas/RemovableTepClientConfig' AzureAuthConfigClientSecret: allOf: - type: object properties: client_secret: type: string required: - client_secret FpeVariant: allOf: - type: object description: A concatenation of sections. properties: sections: type: array items: $ref: '#/components/schemas/FpeSection' required: - sections Bip32OptionsPolicy: allOf: - type: object properties: {} KeyCreationMethodVariantGenerate: allOf: - type: object properties: method: type: string enum: - Generate required: - method - type: object properties: {} AwsMultiRegionInfo: allOf: - type: object description: 'This structure mentions various properties of AWS multi region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html' properties: multi_region_key_type: $ref: '#/components/schemas/AwsMultiRegionKeyType' primary_key_arn: type: - string - 'null' description: Specifies a replica key's primary key ARN. replica_key_arns: type: - array - 'null' items: type: string description: Specifies ARNs of a primary key's replicas. required: - multi_region_key_type AwskmsService: description: Specifies the AWS service. Only `kms` is supported for now. type: string enum: - kms - kms-fips WrappingKeys: oneOf: - $ref: '#/components/schemas/WrappingKeysVariantOnly' - $ref: '#/components/schemas/WrappingKeysVariantAny' discriminator: propertyName: $type mapping: Only: WrappingKeysVariantOnly Any: WrappingKeysVariantAny FpeDateDayMonthYear: allOf: - type: object description: 'Represents a date that consists of a Month subpart, a Day subpart, and a Year subpart. The Year part is allowed to be preserved, and the Day and Month parts are allowed to be preserved together. (The Day part cannot be preserved if the Month part is not, and vice versa.)' properties: before: $ref: '#/components/schemas/FpeDayMonthYearDate' after: $ref: '#/components/schemas/FpeDayMonthYearDate' EcKcdsaOptions: allOf: - type: object properties: hash_alg: $ref: '#/components/schemas/DigestAlgorithm' GcpKeyRingConfig: allOf: - type: object properties: service_account_email: type: string description: Email for the service account to be used. project_id: type: string description: The project ID is a unique identifier for a project location: type: string description: 'For a given project in GCP KMS, resources can be created in one of many locations. These represent the geographical regions where a resource is stored and can be accessed. A key''s location impacts the performance of applications using the key. https://cloud.google.com/kms/docs/locations' key_ring: type: - string - 'null' description: 'A key ring organizes keys in a specific GCP location and allows you to manage access control on groups of keys. https://cloud.google.com/kms/docs/resource-hierarchy#key_rings' private_key: type: string format: byte description: 'Private component of the service account key pair that can be obtained from the GCP cloud console. It is used to authenticate the requests made by DSM to the GCP cloud.' required: - service_account_email - project_id - location LmsOptions: allOf: - type: object description: LMS specific options properties: l1_height: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The height of the top level tree. This field will be deprecated in v2. l2_height: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The height of the secondary tree. This field will be deprecated in v2. digest: $ref: '#/components/schemas/DigestAlgorithm' heights: type: - array - 'null' items: type: integer description: Heights of the trees in each level. node_size: type: - integer - 'null' description: Amount of bytes associated to each node (the 'm' parameter) winternitz_width: type: - integer - 'null' description: The width of the Winternitz coefficients. The default value is 8. HmgConfigNcipher: allOf: - type: object properties: url: type: string tls: $ref: '#/components/schemas/TlsConfig' slot: type: integer pin: type: string hsm_order: type: - integer - 'null' format: int32 description: 'The priority of this `HmgConfig`. This is used when a group is configured with an `HmgRedundancyScheme`, and is otherwise unused. (See the docs for `HmgRedundancyScheme` for more information about the interpretation of this field.)' required: - url - tls - slot AzureAuthConfigVariantClientSecret: allOf: - type: object properties: mode: type: string enum: - client_secret required: - mode - $ref: '#/components/schemas/AzureAuthConfigClientSecret' AesOptions: allOf: - type: object properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 fpe: $ref: '#/components/schemas/FpeOptions' tag_length: type: - integer - 'null' format: int32 cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' iv_length: type: - integer - 'null' format: int32 FpeCompoundPartMultiple: allOf: - type: object description: 'Indicates a part that is possibly repeated multiple times. Implementation note: the backend parser is locally "greedy" and will attempt to match as many repetitions as possible. If this later results in an invalid parse of the rest of the input, the backend ***will not backtrack*** and will simply return with an error.' properties: multiple: $ref: '#/components/schemas/FpeDataPart' min_repetitions: type: - integer - 'null' description: 'The minimum number of times the subpart may occur. (A value of 1 marks a single occurrence.)' max_repetitions: type: - integer - 'null' description: 'The maximum number of times the subpart may occur. (A value of 1 marks a single occurrence.)' constraints: $ref: '#/components/schemas/FpeConstraints' preserve: type: - boolean - 'null' description: 'Whether the entire Multiple should be preserved as-is (i.e., not tokenized). If this is set, the `multiple` subpart and its descendants cannot contain any preserve-related fields set.' mask: type: - boolean - 'null' description: 'Whether the entire Multiple should be masked when doing masked decryption. If this is set, the `multiple` subpart and its descendants cannot contain any mask-related fields set.' min_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The minimum allowed length for this part (in chars). max_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The maximum allowed length for this part (in chars). required: - multiple All: description: 'A helper enum with a single variant, All, which indicates that something should apply to an entire part. (This is here mainly to allow other untagged enums to work properly.)' type: string enum: - all HmacOptionsPolicy: allOf: - type: object properties: minimum_key_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 AzureAuthConfigVariantTokenAuthConfig: allOf: - type: object properties: mode: type: string enum: - token_auth_config required: - mode - $ref: '#/components/schemas/AzureAuthConfigTokenAuthConfig' GroupSort: oneOf: - title: GroupSortVariantByGroupId type: object properties: sort_by: type: string pattern: ^group_id:(?:asc|desc)$ example: group_id:asc previous_id: type: string format: uuid required: - previous_id - title: GroupSortVariantByGroupName type: object properties: sort_by: type: string pattern: ^group_name:(?:asc|desc)$ example: group_name:asc previous_sort_value: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ required: - previous_sort_value FpeWords: description: A set of fixed-length strings. oneOf: - title: FpeWordsVariantIntegerRanges type: object properties: integer_ranges: $ref: '#/components/schemas/FpeWordsIntegerRanges' required: - integer_ranges - title: FpeWordsVariantAlphabet type: object properties: alphabet: $ref: '#/components/schemas/FpeCharSet' required: - alphabet - title: FpeWordsVariantCustom type: object properties: custom: $ref: '#/components/schemas/FpeWordsCustom' required: - custom ListGroupsResponse: description: The response of the get all groups API oneOf: - $ref: '#/components/schemas/ListGroupsResponseWithMetadata' - type: array items: $ref: '#/components/schemas/Group' description: A response that omits metadata CountAccuracyVariantExact: allOf: - type: object properties: $type: type: string enum: - Exact required: - $type - type: object properties: {} ScanResult: description: The result of a scan. oneOf: - $ref: '#/components/schemas/ScanResultVariantSuccess' - $ref: '#/components/schemas/ScanResultVariantFailed' discriminator: propertyName: $type mapping: Success: ScanResultVariantSuccess Failed: ScanResultVariantFailed HmgConfigVariantNcipher: allOf: - type: object properties: kind: type: string enum: - Ncipher required: - kind - $ref: '#/components/schemas/HmgConfigNcipher' AzureKeyVaultType: description: Types of Azure Key Vault based on the protection level. type: string enum: - STANDARD - PREMIUM - MANAGED TepSchemaVariantOpenAPI: allOf: - type: object properties: $type: type: string enum: - OpenAPI required: - $type - type: object properties: openapi: type: string KeyOpsOverride: allOf: - type: object properties: add_key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: 'The operations to add to any key creation request (only supported in KMIP). The following operations can be specified: - `EXPORT` - `APPMANAGEABLE` - `HIGHVOLUME` The operations specified cannot conflict with what''s specified in the `key_ops` field of account and/or group policies (where applicable). **Note**: This is only enforced on (KMIP) creation requests since we assume updates removing key operations are intentional.' HistoryItemState: allOf: - type: object description: 'The key metadata of the security object for a given `HistoryItem`. This keeps track of properties such as allowed key operations, key state, and so on.' properties: activation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z activation_undo_window: $ref: '#/components/schemas/Secs' revocation_reason: $ref: '#/components/schemas/RevocationReason' compromise_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z deactivation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z deactivation_undo_window: $ref: '#/components/schemas/Secs' destruction_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z deletion_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z state: $ref: '#/components/schemas/SobjectState' key_ops: type: array items: $ref: '#/components/schemas/KeyOperations' public_only: type: boolean has_key: type: boolean rotation_policy: $ref: '#/components/schemas/RotationPolicy' group_id: type: - string - 'null' format: uuid required: - state - key_ops - public_only - has_key HmgConfigSafenet: allOf: - type: object properties: url: type: string tls: $ref: '#/components/schemas/TlsConfig' slot: type: integer pin: type: string hsm_order: type: - integer - 'null' format: int32 description: 'The priority of this `HmgConfig`. This is used when a group is configured with an `HmgRedundancyScheme`, and is otherwise unused. (See the docs for `HmgRedundancyScheme` for more information about the interpretation of this field.)' required: - url - tls - slot MetadataDurationConstraint: oneOf: - title: MetadataDurationConstraintVariantForbidden type: object properties: forbidden: type: object properties: {} required: - forbidden - title: MetadataDurationConstraintVariantRequired type: object properties: required: $ref: '#/components/schemas/MetadataDurationConstraintRequired' required: - required RestrictedDuration: allOf: - type: object properties: min: $ref: '#/components/schemas/TimeSpan' max: $ref: '#/components/schemas/TimeSpan' default: $ref: '#/components/schemas/TimeSpan' SeedOptionsPolicy: allOf: - type: object properties: random_iv: type: - boolean - 'null' Secs: allOf: - type: integer WrappingKeysOnly: allOf: - type: object description: Only keys in this list can be used to wrap the sobject properties: keys: type: array uniqueItems: true items: $ref: '#/components/schemas/SobjectDescriptorPersisted' required: - keys RsaEncryptionPaddingPolicy: description: RSA encryption padding policy. oneOf: - title: RsaEncryptionPaddingPolicyVariantOaep type: object properties: OAEP: $ref: '#/components/schemas/RsaEncryptionPaddingPolicyOaep' required: - OAEP - title: RsaEncryptionPaddingPolicyVariantPkcs1V15 type: object properties: PKCS1_V15: type: object properties: {} required: - PKCS1_V15 - title: RsaEncryptionPaddingPolicyVariantRawDecrypt type: object properties: RAW_DECRYPT: type: object properties: {} required: - RAW_DECRYPT MgfPolicy: description: MGF policy. oneOf: - title: MgfPolicyVariantMgf1 type: object properties: mgf1: $ref: '#/components/schemas/MgfPolicyMgf1' required: - mgf1 RsaSignaturePaddingPolicyPss: allOf: - type: object properties: mgf: $ref: '#/components/schemas/MgfPolicy' ObjectOrigin: description: The origin of a security object - where it was created / generated. type: string enum: - FortanixHSM - Transient - External Des3Options: allOf: - type: object properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' iv_length: type: - integer - 'null' format: int32 TepSchema: oneOf: - $ref: '#/components/schemas/TepSchemaVariantOpenAPI' discriminator: propertyName: $type mapping: OpenAPI: TepSchemaVariantOpenAPI FpePreserveMask: description: A structure indicating which indices in an encrypted part to mask or preserve. oneOf: - $ref: '#/components/schemas/All' - type: array items: type: integer format: int64 description: 'Indicates that only certain characters are to be preserved or masked. Indices are Python-like; i.e., negative indices index from the end of the token portion, with index -1 denoting the last character. (Indicating that nothing should be preserved or masked can be done via an empty list, which is the default value for this enum.)' RsaEncryptionPaddingPolicyOaep: allOf: - type: object description: 'The Optional Asymmetric Encryption Padding scheme, as defined in RFC 8017 (PKCS #1 version 2.2)' properties: mgf: $ref: '#/components/schemas/MgfPolicy' TepKeyContext: type: string enum: - request - response MlKemOptionsPolicy: allOf: - type: object properties: {} KeyCreationMethod: description: Information about the method by which a key was created oneOf: - $ref: '#/components/schemas/KeyCreationMethodVariantGenerate' - $ref: '#/components/schemas/KeyCreationMethodVariantAgree' - $ref: '#/components/schemas/KeyCreationMethodVariantTransform' - $ref: '#/components/schemas/KeyCreationMethodVariantDerive' - $ref: '#/components/schemas/KeyCreationMethodVariantUnwrap' - $ref: '#/components/schemas/KeyCreationMethodVariantImport' - $ref: '#/components/schemas/KeyCreationMethodVariantEncapsulate' - $ref: '#/components/schemas/KeyCreationMethodVariantDecapsulate' discriminator: propertyName: method mapping: Generate: KeyCreationMethodVariantGenerate Agree: KeyCreationMethodVariantAgree Transform: KeyCreationMethodVariantTransform Derive: KeyCreationMethodVariantDerive Unwrap: KeyCreationMethodVariantUnwrap Import: KeyCreationMethodVariantImport Encapsulate: KeyCreationMethodVariantEncapsulate Decapsulate: KeyCreationMethodVariantDecapsulate HmgRedundancyScheme: description: 'The scheme for determining how multiple `HmgConfig`s on a group should behave. If not specified, the backend will go through the list in random order, and use the first `HmgConfig` that works.' type: string enum: - PriorityFailover HmgConfig: oneOf: - $ref: '#/components/schemas/HmgConfigVariantNcipher' - $ref: '#/components/schemas/HmgConfigVariantSafenet' - $ref: '#/components/schemas/HmgConfigVariantAwsCloudHsm' - $ref: '#/components/schemas/HmgConfigVariantAwsKms' - $ref: '#/components/schemas/HmgConfigVariantFortanix' - $ref: '#/components/schemas/HmgConfigVariantFortanixFipsCluster' - $ref: '#/components/schemas/HmgConfigVariantAzureKeyVault' - $ref: '#/components/schemas/HmgConfigVariantOciVault' - $ref: '#/components/schemas/HmgConfigVariantGcpKeyRing' discriminator: propertyName: kind mapping: Ncipher: HmgConfigVariantNcipher Safenet: HmgConfigVariantSafenet AwsCloudHsm: HmgConfigVariantAwsCloudHsm AwsKms: HmgConfigVariantAwsKms Fortanix: HmgConfigVariantFortanix FortanixFipsCluster: HmgConfigVariantFortanixFipsCluster AzureKeyVault: HmgConfigVariantAzureKeyVault OciVault: HmgConfigVariantOciVault GcpKeyRing: HmgConfigVariantGcpKeyRing OpaqueOptionsPolicy: allOf: - type: object properties: {} ExternalKeyIdAzureKeyVault: allOf: - type: object description: A key in Azure Key Vault. properties: version: type: string format: uuid description: The version of the key. label: type: string description: The name of the key. required: - version - label ExternalKeyIdOciVault: allOf: - type: object description: A key in an OCI key vault. properties: oci_key_id: type: string description: The OCID of the OciKey oci_key_version: type: string description: The OCID of the OciKeyVersion required: - oci_key_id - oci_key_version ObjectTypeFilterSelection: allOf: - type: object properties: selection: type: array items: $ref: '#/components/schemas/ObjectType' required: - selection MgfPolicyMgf1: allOf: - type: object properties: hash: $ref: '#/components/schemas/DigestAlgorithm' ExternalKeyIdAwsKms: allOf: - type: object properties: key_arn: type: string description: The Amazon Resource Name of the key. key_id: type: string description: The key ID assigned to the key. required: - key_arn - key_id - $ref: '#/components/schemas/AwsKeyMaterialId' SobjectExportPolicy: allOf: - type: object properties: allow_weakening: type: boolean description: 'When set to `false`, the `export_policy` for the sobject can never be relaxed, it can only be made more strict. This means that - If the export policy is set to `Wrapped`, it can never be set back to `Unrestricted`. - If the export policy is set to `Wrapped` with a limited set of keys specified, it can never bet set back to `Wrapped` with any key. Additionally, no new keys can be added to the set of wrapping keys. Also note that if all the wrapping keys (specified by key id) in the export policy have been deleted/destroyed/deactivated, the sobject becomes effectively unexportable. Note: these rules may change in the future.' required: - allow_weakening - $ref: '#/components/schemas/ExportPolicy' ExternalKeyIdFortanix: allOf: - type: object description: An sobject in DSM. properties: id: type: string format: uuid description: The UUID assigned to the sobject. required: - id ExportPolicyVariantWrapped: allOf: - type: object properties: $type: type: string enum: - Wrapped required: - $type - $ref: '#/components/schemas/ExportPolicyWrapped' GetAllHmgScansResponse: allOf: - type: object description: Information about a group's recent scans. properties: items: type: array items: $ref: '#/components/schemas/Scan' description: List of all tracked scans, from newest to oldest. required: - items CollectionMetadata: allOf: - type: object properties: continuation_token: type: - string - 'null' description: 'Continuation token to continue getting results. If the response contains a continuation_token, the results returned are partial. In that case, the client can make the same request with this continuation token to continue getting results.' - $ref: '#/components/schemas/ObjectCount' ExportPolicyVariantUnrestricted: allOf: - type: object properties: $type: type: string enum: - Unrestricted required: - $type - type: object properties: {} HmgListKeyCollectionsResponseOciKeyVault: allOf: - type: object description: A list of all the vaults accessible to the user configured properties: items: type: array items: $ref: '#/components/schemas/OciKeyVault' required: - items BlsOptions: allOf: - type: object properties: variant: $ref: '#/components/schemas/BlsVariant' required: - variant RemovablePkcs11ClientConfig: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/Pkcs11ClientConfig' AwsMultiRegionKeyType: description: 'Specifies the type of multi-Region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#multi-region-concepts' type: string enum: - PRIMARY - REPLICA ExternalKeyId: description: 'Identification information for an external key. There are multiple variants of this type to represent the different kinds of keys DSM supports (e.g., AWS, Azure, etc.). This is not to be confused with the UUID assigned to a virtual key in DSM, which is most likely different from the ID that the source key (outside of DSM) has.' oneOf: - $ref: '#/components/schemas/ExternalKeyIdPkcs11' - $ref: '#/components/schemas/ExternalKeyIdFortanix' - $ref: '#/components/schemas/ExternalKeyIdAwsKms' - $ref: '#/components/schemas/ExternalKeyIdAzureKeyVault' - $ref: '#/components/schemas/ExternalKeyIdGcpKeyRing' - $ref: '#/components/schemas/ExternalKeyIdOciVault' - type: object properties: {} MetadataPolicyItem: allOf: - type: object properties: custom_metadata: type: object additionalProperties: $ref: '#/components/schemas/MetadataStringConstraint' description: $ref: '#/components/schemas/MetadataStringConstraint' deactivation_date: $ref: '#/components/schemas/MetadataDurationConstraint' activation_date: $ref: '#/components/schemas/MetadataDurationConstraint' required: - custom_metadata RotateCopiedKeys: oneOf: - title: RotateCopiedKeysVariantAllExternal type: string enum: - all_external - title: RotateCopiedKeysVariantSelect type: object properties: select: type: array items: type: string format: uuid required: - select Bip32Network: description: 'The BIP32 network The Testnet network is usually an actual network with nodes and miners, and free cryptocurrency. This provides a testing environment for developers.' type: string enum: - mainnet - testnet RemovableCommonClientConfig: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/CommonClientConfig' ClientLogConfig: allOf: - type: object properties: system: type: - boolean - 'null' file: $ref: '#/components/schemas/ClientFileLogging' level: type: - string - 'null' FpeChecksum: type: string enum: - luhn FpeGroup: allOf: - type: object description: 'A concatenation of codes, that can be repeated an amount of times. An amount of leading and trailing characters can be preserved, this is, unmodified by tokenization.' properties: codes: type: array items: $ref: '#/components/schemas/FpeCode' min_repetitions: type: - integer - 'null' description: A group cannot be omitted, thus this field must be positive if present. max_repetitions: type: - integer - 'null' preserve: type: - array - 'null' items: type: integer minItems: 2 maxItems: 2 description: 'Amount of leading and trailing characters to preserve in this group. Preserved characters are the leading/trailing characters of the whole group, not individual repetitions.' required: - codes TepClientConfig: allOf: - type: object properties: schema: $ref: '#/components/schemas/TepSchema' key_map: $ref: '#/components/schemas/TepKeyMapList' required: - schema - key_map RemovableAutoScanSettings: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/AutoScanSettings' KeyCreationMethodVariantDerive: allOf: - type: object properties: method: type: string enum: - Derive required: - method - type: object properties: {} FpeCharSet: description: 'The alphabet to use for an encrypted portion of a complex tokenization data type. Characters should be specified as a list of pairs, where each pair [a, b] represents the range of Unicode code points from a to b, with both bounds being inclusive. A single code point can be specified as [c, c]. Normally, each character is assigned a numeric value for FF1. The first character is assigned a value of 0, and subsequent characters are assigned values of 1, 2, and so on, up to the size of the alphabet. Note that the order of the ranges matters; characters appearing in later ranges are assigned higher numerical values compared to earlier characters. For instance, in the FpeCharSet [[''a'', ''z''], [''0'', ''9'']], the digits ''0'' to ''9'' are assigned values from 26 to 35, since they are listed after the ''a'' to ''z'' range. In any case, ranges should not overlap with each other, and should not contain surrogate code points.' allOf: - type: array items: type: array minItems: 2 maxItems: 2 items: type: string minLength: 1 maxLength: 1 EllipticCurve: description: Identifies a standardized elliptic curve. type: string enum: - X25519 - Ed25519 - Ed448 - X448 - SecP192K1 - SecP224K1 - SecP256K1 - NistP192 - NistP224 - NistP256 - NistP384 - NistP521 - Gost256A OciKeyVault: allOf: - type: object properties: vault_name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ vault_type: type: string vault_id: type: string required: - vault_name - vault_type - vault_id ListGroupsResponseWithMetadata: allOf: - type: object description: A response that includes metadata properties: items: type: array items: $ref: '#/components/schemas/Group' description: The list of groups satisfying the request metadata: $ref: '#/components/schemas/CollectionMetadata' required: - items - metadata XmssOptions: allOf: - type: object description: XMSS specific options properties: height: type: - integer - 'null' description: The height of the Merkle tree (10, 16 or 20) digest: $ref: '#/components/schemas/DigestAlgorithm' node_size: type: - integer - 'null' description: Amount of bytes associated to each node (24 or 32) FpeFormatV2: allOf: - type: object description: The second generation of Fortanix Tokenization scheme. properties: variants: type: array items: $ref: '#/components/schemas/FpeVariant' description: 'A token is accepted if it is accepted by any of these variants. Note tokenization results depend on the order of this list.' mode: $ref: '#/components/schemas/FpeTokenizeMode' input_processing: $ref: '#/components/schemas/FpeInputProcessing' required: - variants PrincipalUserViaApp: allOf: - type: object description: UserViaApp signifies a user authorizing some app to act on its behalf through OAuth. properties: user_id: type: string format: uuid scopes: type: array uniqueItems: true items: $ref: '#/components/schemas/OauthScope' required: - user_id - scopes DesOptionsPolicy: allOf: - type: object properties: random_iv: type: - boolean - 'null' RemovableTepClientConfig: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/TepClientConfig' WrappingKeysVariantAny: allOf: - type: object properties: $type: type: string enum: - Any required: - $type - type: object properties: {} ObjectTypeFilter: oneOf: - $ref: '#/components/schemas/ObjectTypeFilterVariantAll' - $ref: '#/components/schemas/ObjectTypeFilterVariantSelection' discriminator: propertyName: $type mapping: All: ObjectTypeFilterVariantAll Selection: ObjectTypeFilterVariantSelection TlsConfigRequired: allOf: - type: object properties: validate_hostname: type: boolean ca: $ref: '#/components/schemas/CaConfig' client_key: type: string format: byte client_cert: type: string format: byte required: - validate_hostname - ca FpeWordsIntegerRanges: allOf: - type: object description: 'A union of positive integer ranges. ```plain Examples: [[0, 400], [402, 1000]] = {0000, 0001, ..., 0400, 0402, ..., 1000} [[1,3], [49, 50]] with optional padding of length 8 = {00000001, 00000002, 00000003, 00000049, 00000050} (accepts 1, 01, 00002, 49, 000050, etc) ```' properties: ranges: type: array items: type: array items: type: integer minItems: 2 maxItems: 2 padding_required: type: boolean description: 'If this field is true, this set accepts only numeric strings padded to the length given by the maximum integer in the range set.' required: - ranges - padding_required DsaOptions: allOf: - type: object properties: subgroup_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 ClientFileLoggingVariantDisabled: allOf: - type: object properties: mode: type: string enum: - disabled required: - mode - type: object properties: {} QuorumPolicy: allOf: - type: object description: Approval policy. properties: quorum: $ref: '#/components/schemas/Quorum' user: type: - string - 'null' format: uuid app: type: - string - 'null' format: uuid RsaSignaturePaddingPolicy: description: RSA signature padding policy. oneOf: - title: RsaSignaturePaddingPolicyVariantPss type: object properties: PSS: $ref: '#/components/schemas/RsaSignaturePaddingPolicyPss' required: - PSS - title: RsaSignaturePaddingPolicyVariantPkcs1V15 type: object properties: PKCS1_V15: type: object properties: {} required: - PKCS1_V15 FpeOptionsV2: allOf: - type: object properties: format_v2: $ref: '#/components/schemas/FpeFormatV2' description: type: - string - 'null' required: - format_v2 SobjectDescriptorPersisted: description: Uniquely identifies a persisted sobject. oneOf: - title: SobjectDescriptorPersistedVariantKid type: object properties: kid: type: string format: uuid required: - kid - title: SobjectDescriptorPersistedVariantName type: object properties: name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ required: - name ClientConfigurations: allOf: - type: object properties: common: $ref: '#/components/schemas/CommonClientConfig' pkcs11: $ref: '#/components/schemas/Pkcs11ClientConfig' kmip: $ref: '#/components/schemas/KmipClientConfig' tep: $ref: '#/components/schemas/TepClientConfig' RsaOptions: allOf: - type: object description: RSA-specific options. properties: key_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Size in bits (not bytes) of the RSA key. Specify on Create only. Returned on Get. public_exponent: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Public exponent to use for generating the RSA key. Specify on Create only. encryption_policy: type: - array - 'null' items: $ref: '#/components/schemas/RsaEncryptionPolicy' description: 'Encryption policy for an RSA key. When doing an encryption or key wrapping operation, the policies are evaluated against the specified parameters one by one. If one matches, the operation is allowed. If none match, including if the policy list is empty, the operation is disallowed. Missing optional parameters will have their defaults specified according to the matched policy. The default for new keys is `[{"padding":{"OAEP":{}}]`. If (part of) a constraint is not specified, anything is allowed for that constraint. To impose no constraints, specify `[{}]`.' signature_policy: type: - array - 'null' items: $ref: '#/components/schemas/RsaSignaturePolicy' description: 'Signature policy for an RSA key. When doing a signature operation, the policies are evaluated against the specified parameters one by one. If one matches, the operation is allowed. If none match, including if the policy list is empty, the operation is disallowed. Missing optional parameters will have their defaults specified according to the matched policy. The default for new keys is `[{}]` (no constraints). If (part of) a constraint is not specified, anything is allowed for that constraint.' minimum_key_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: 'The minimum allowed key length. This is only relevant for group or account cryptographic policies (and hence has no effect in an RSA policy on a specific key).' FpeDatePart: description: 'Possible date-related constraint types that do not form a complete date (by themselves) for a complex tokenization data type.' type: string enum: - month - day - year AwsKeyOrigin: description: 'Origin of the AWS KMS key. See the [AWS documentation](https://docs.aws.amazon.com/kms/latest/APIReference/API_KeyMetadata.html#KMS-Type-KeyMetadata-Origin) for more information.' type: string enum: - AwsKms - External - AwsCloudHsm - ExternalKeyStore KeyCreationMethodVariantEncapsulate: allOf: - type: object properties: method: type: string enum: - Encapsulate required: - method - type: object properties: {} FpeCompoundPartConcat: allOf: - type: object description: Represents a concatenation of multiple structures (in a particular order). properties: concat: type: array items: $ref: '#/components/schemas/FpeDataPart' description: The actual subparts that make up this compound part, in order. constraints: $ref: '#/components/schemas/FpeConstraints' preserve: type: - boolean - 'null' description: 'Whether the entire concat should be preserved as-is (i.e., not tokenized). If this is set, any descendant subparts cannot contain any preserve-related fields set.' mask: type: - boolean - 'null' description: 'Whether the entire concat should be masked when doing masked decryption. If this is set, any descendant subparts cannot contain any mask-related fields set.' min_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The minimum allowed length for this part (in chars). max_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: The maximum allowed length for this part (in chars). required: - concat FpeOptionsBasic: allOf: - type: object description: 'Basic FPE-specific options. This is suitable for simple datatypes that consist of ASCII digits, or ASCII digits and uppercase letters.' properties: radix: type: integer minimum: 0 maximum: 4294967295 description: 'The FPE base for the input data (i.e., the size of the character set of the datatype). This must be an integer from 2 to 36. This also implicitly defines the alphabet of the datatype. A base from 2 to 10 implies ASCII digits (e.g., a radix of 3 can be used to represent a ternary string), and a base from 11 to 36 implies ASCII digits and uppercase letters (e.g., a radix of 16 can be' min_length: type: integer minimum: 0 maximum: 4294967295 description: The minimum allowed length for the input data. max_length: type: integer minimum: 0 maximum: 4294967295 description: The maximum allowed length for the input data. preserve: type: array items: type: integer format: int64 description: 'The list of indices of characters to be preserved while performing encryption/decryption. Indices are Python-like; i.e., nonnegative indices index from the beginning of the input (where 0 is the first character), and negative indices index from the end of the input. (where -1 is the last character, -2 is second to last, and so on). Any preserved characters will be concatenated together and used as an FF1 tweak. For example, if the input data is "abcd", and the first and last characters are to be preserved, the FF1 tweak will be the ASCII bytes of the string "ad".' mask: type: - array - 'null' items: type: integer format: int64 description: 'The list of indices of characters to be masked while performing masked decryption. Indices are Python-like; i.e., nonnegative indices index from the beginning of the input (where 0 is the first character), and negative indices index from the end of the input. (where -1 is the last character, -2 is second to last, and so on).' luhn_check: type: - boolean - 'null' description: 'Whether the encrypted/decrypted data contains a checksum digit that satisfies the Luhn formula. (The output ciphertext/plaintext will also contain a Luhn checksum digit.)' name: type: - string - 'null' description: The user-provided name for the data type that represents the input data. required: - radix - min_length - max_length - preserve ObjectCount: allOf: - type: object properties: count: type: integer description: Count of the items in the collection matching the request count_accuracy: $ref: '#/components/schemas/CountAccuracy' required: - count - count_accuracy HmgConfigVariantAwsKms: allOf: - type: object properties: kind: type: string enum: - AwsKms required: - kind - $ref: '#/components/schemas/HmgConfigAwsKms' KeyOperations: description: "Operations allowed to be performed on a given key.\n\n\n\n SIGN:\n If this is set, the key can be used to for signing.\n\n\n VERIFY:\n If this is set, the key can used for verifying a signature.\n\n\n ENCRYPT:\n If this is set, the key can be used for encryption.\n\n\n DECRYPT:\n If this is set, the key can be used for decryption.\n\n\n WRAPKEY:\n If this is set, the key can be used wrapping other keys.\n The key being wrapped must have the EXPORT operation enabled.\n\n\n UNWRAPKEY:\n If this is set, the key can be used to unwrap a wrapped key.\n\n\n DERIVEKEY:\n If this is set, the key can be used to derive another key.\n\n\n TRANSFORM:\n If this is set, the key can be transformed.\n\n\n MACGENERATE:\n If this is set, the key can be used to compute a cryptographic\n Message Authentication Code (MAC) on a message.\n\n\n MACVERIFY:\n If they is set, the key can be used to verify a MAC.\n\n\n EXPORT:\n If this is set, the value of the key can be retrieved\n with an authenticated request. This shouldn't be set unless\n required. It is more secure to keep the key's value inside DSM only.\n\n\n APPMANAGEABLE:\n Without this operation, management operations like delete, destroy,\n rotate, activate, restore, revoke, revert, update, remove_private, etc.\n cannot be performed by a crypto App.\n A user with access or admin app can still perform these operations.\n This option is only relevant for crypto apps.\n\n\n HIGHVOLUME:\n If this is set, audit logs will not be recorded for the key.\n High volume here tries to signify a key that is being used a lot\n and will produce lots of logs. Setting this operation disables\n audit logs for the key.\n\n\n AGREEKEY:\n If this is set, the key can be used for key agreement.\n Both the private and public key should have this option enabled\n to perform an agree operation.\n\n\n ENCAPSULATE:\n If this is set, the key can be used for key encapsulation. The\n result is a new symmetric key and a ciphertext.\n\n\n DECAPSULATE:\n If this is set, the key can be used for key decapsulation. If\n decapsulation succeeds, the result is a new symmetric key.\n\n" type: string enum: - SIGN - VERIFY - ENCRYPT - DECRYPT - WRAPKEY - UNWRAPKEY - DERIVEKEY - TRANSFORM - MACGENERATE - MACVERIFY - EXPORT - APPMANAGEABLE - HIGHVOLUME - AGREEKEY - ENCAPSULATE - DECAPSULATE DesOptions: allOf: - type: object properties: cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' SecretOptionsPolicy: allOf: - type: object properties: {} ExternalKeyIdPkcs11: allOf: - type: object description: 'A key in a legacy HSM. (DSM uses HSM Gateway to interact with such legacy HSMs using PKCS #11.)' properties: id: type: string format: byte description: 'The PKCS #11 ID of the key.' label: type: string format: byte description: 'The PKCS #11 label of the key.' required: - id - label HmgConfigOciVault: allOf: - type: object properties: region: type: string compartment_ocid: type: string credential_id: $ref: '#/components/schemas/CredentialId' vault_id: type: - string - 'null' required: - region - compartment_ocid - credential_id GroupRequest: allOf: - type: object properties: add_hmg: type: - array - 'null' items: $ref: '#/components/schemas/HmgConfig' approval_policy: $ref: '#/components/schemas/GroupApprovalPolicy' auto_scan: $ref: '#/components/schemas/RemovableAutoScanSettings' client_configurations: $ref: '#/components/schemas/ClientConfigurationsRequest' cryptographic_policy: $ref: '#/components/schemas/RemovableCryptographicPolicy' custodian_policy: $ref: '#/components/schemas/QuorumPolicy' custom_metadata: type: - object - 'null' additionalProperties: type: string del_hmg: type: - array - 'null' uniqueItems: true items: type: string format: uuid description: type: - string - 'null' export_policy: $ref: '#/components/schemas/ExportPolicy' google_access_reason_policy: $ref: '#/components/schemas/RemovableGoogleAccessReasonPolicy' hmg_redundancy: $ref: '#/components/schemas/RemovableHmgRedundancyScheme' hmg_segregation: type: - boolean - 'null' hmg_sync: type: - boolean - 'null' key_history_policy: $ref: '#/components/schemas/RemovableKeyHistoryPolicy' key_metadata_policy: $ref: '#/components/schemas/RemovableKeyMetadataPolicy' mod_hmg: type: - object - 'null' additionalProperties: $ref: '#/components/schemas/HmgConfig' name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ wrapping_key_name: $ref: '#/components/schemas/WrappingKeyName' RevocationReasonCode: description: Reasons to revoke a security object. type: string enum: - Unspecified - KeyCompromise - CACompromise - AffiliationChanged - Superseded - CessationOfOperation - PrivilegeWithdrawn AwsKeyRotationStatusKeyRotationEnabled: allOf: - type: object properties: rotation_period_in_days: type: - integer - 'null' minimum: 0 maximum: 65535 KeyMetadataPolicy: allOf: - type: object properties: base: $ref: '#/components/schemas/MetadataPolicyItem' for_obj_type: type: object additionalProperties: $ref: '#/components/schemas/MetadataPolicyItem' description: Each entry in this map fully overrides `base` for a particular object type. legacy_objects: $ref: '#/components/schemas/LegacyKeyPolicy' required: - base - for_obj_type - legacy_objects ExportPolicyWrapped: allOf: - type: object description: 'The sobject can only be exported wrapped by a key as specified by the `WrappingKeys`.' properties: by: $ref: '#/components/schemas/WrappingKeys' required: - by MlDsaOptions: allOf: - type: object description: ML-DSA specific options properties: param_set: $ref: '#/components/schemas/MlDsaParamSet' required: - param_set PublishPublicKeyConfigVariantDisabled: allOf: - type: object properties: state: type: string enum: - disabled required: - state - type: object properties: {} FpeCode: allOf: - type: object description: A set of words, repeated an amount of times. properties: words: $ref: '#/components/schemas/FpeWords' min_repetitions: type: - integer - 'null' max_repetitions: type: - integer - 'null' required: - words KmipClientConfig: allOf: - type: object properties: ignore_unknown_key_ops_for_secrets: type: - boolean - 'null' description: Use `ignore_unknown_key_ops_for` with [SECRET] instead of `ignore_unknown_key_ops_for_secrets`` ignore_unknown_key_ops_for: $ref: '#/components/schemas/ObjectTypeFilter' key_ops_override: $ref: '#/components/schemas/KeyOpsOverride' ApprovalWaitConfig: allOf: - type: object description: Configurations for waiting for quorum approval. properties: enabled: type: boolean description: Indicates whether waiting for quorum approval is activated or disabled poll_interval_secs: type: - integer - 'null' description: Time interval in seconds for client lib to check quorum status. max_wait_for_secs: type: - integer - 'null' description: Maximum time in seconds for client lib to wait for quorum reply. required: - enabled CaSet: description: Predefined CA sets. type: string enum: - global_roots AzureAuthConfigTokenAuthConfig: allOf: - type: object properties: client_cert: type: string format: byte client_key: type: string format: byte required: - client_cert - client_key ObjectTypeFilterVariantAll: allOf: - type: object properties: $type: type: string enum: - All required: - $type - type: object properties: {} KeyCreationMethodVariantTransform: allOf: - type: object properties: method: type: string enum: - Transform required: - method - type: object properties: {} HmgConfigAzureKeyVault: allOf: - type: object properties: url: type: string tls: $ref: '#/components/schemas/TlsConfig' auth_config: $ref: '#/components/schemas/AzureAuthConfig' secret_key: type: string description: Deprecated, left this for backward compatibility. Should use auth_config. tenant_id: type: string format: uuid description: 'A tenant ID is a unique way to identify an Azure AD instance within an Azure subscription.' client_id: type: string format: uuid description: 'The client ID is the unique Application ID assigned to your app by Azure AD when the app was registered.' subscription_id: type: string format: uuid description: 'A subscription ID is a unique alphanumeric string that identifies your Azure subscription.' key_vault_type: $ref: '#/components/schemas/AzureKeyVaultType' endpoints: $ref: '#/components/schemas/AzureServiceEndpoints' required: - url - tls - auth_config - tenant_id - client_id - subscription_id ScanResultVariantSuccess: allOf: - type: object properties: $type: type: string enum: - Success required: - $type - type: object properties: {} KeyVault: allOf: - type: object properties: id: type: string name: type: string vault_type: $ref: '#/components/schemas/AzureKeyVaultType' location: type: string tags: type: - object - 'null' additionalProperties: type: string retention: type: - integer - 'null' minimum: 0 maximum: 4294967295 uri: type: string required: - id - name - vault_type - location - uri TlsConfigVariantDisabled: allOf: - type: object properties: mode: type: string enum: - disabled required: - mode - type: object properties: {} KeyCreationMethodVariantDecapsulate: allOf: - type: object properties: method: type: string enum: - Decapsulate required: - method - type: object properties: {} FpeConstraintsApplicability: description: A structure indicating which subparts to which to apply a set of constraints. oneOf: - $ref: '#/components/schemas/All' - type: object additionalProperties: $ref: '#/components/schemas/FpeConstraintsApplicability' description: 'An object representing the individual subparts that the constraints should apply to. This is a BTreeMap where for each key-value pair, the key represents the "index" of the subpart (with the first subpart having index 0), and the value is an FpeConstraintsApplicability instance. Note that a Multiple part only allows for one possible key-value pair, since it only contains one subpart. For Concat parts, the key is the zero-based index of the subpart in the `concat` field, and for Multiple parts, this is always 0 (due to a Multiple having only one subpart). This cannot be used with OR parts; instead, specify constraints individually on each relevant subpart.' RemovableGoogleAccessReasonPolicy: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/GoogleAccessReasonPolicy' MlKemParamSet: description: ML-KEM parameter sets type: string enum: - MlKem512 - MlKem768 - MlKem1024 WrappingKeysVariantOnly: allOf: - type: object properties: $type: type: string enum: - Only required: - $type - $ref: '#/components/schemas/WrappingKeysOnly' RemovableHmgRedundancyScheme: description: 'The `HmgRedundancyScheme` to set for the group. If unset, the backend will assign no particular meaning to the `hsm_order` fields of the group''s `HmgConfig`s, and may error if it cannot connect to the external HSMs or DSM nodes specified in one of the `HmgConfig`. When creating the group, the value should either be an `HmgRedundancyScheme`, or omitted entirely. When updating the group, there are three choices: - A new value can be set by providing an `HmgRedundancyScheme`. - The string "remove" can be specified to unset the field. - Simply leaving the field blank leaves the field unchanged.' oneOf: - type: string enum: - remove - $ref: '#/components/schemas/HmgRedundancyScheme' ClientFileLoggingConfig: allOf: - type: object properties: path: type: - string - 'null' file_size_kb: type: - integer - 'null' max_files: type: - integer - 'null' minimum: 0 maximum: 4294967295 TimeSpan: oneOf: - title: TimeSpanVariantSeconds type: object properties: seconds: type: integer minimum: 0 maximum: 4294967295 required: - seconds - title: TimeSpanVariantMinutes type: object properties: minutes: type: integer minimum: 0 maximum: 4294967295 required: - minutes - title: TimeSpanVariantHours type: object properties: hours: type: integer minimum: 0 maximum: 4294967295 required: - hours - title: TimeSpanVariantDays type: object properties: days: type: integer minimum: 0 maximum: 4294967295 required: - days AwsKeyRotationStatusVariantKeyRotationDisabled: allOf: - type: object properties: type: type: string enum: - KeyRotationDisabled required: - type - type: object properties: {} ExternalSobjectInfo: allOf: - type: object description: 'This describes an external object -- specifically, information about its source object.' properties: id: $ref: '#/components/schemas/ExternalKeyId' hsm_group_id: type: string format: uuid description: The group which corresponds to the external HSM. external_kms_info: $ref: '#/components/schemas/ExternalKmsInfo' required: - id - hsm_group_id ExternalKeyIdGcpKeyRing: allOf: - type: object description: A key in a GCP key ring. properties: version: type: integer minimum: 0 maximum: 4294967295 description: The version of the key. label: type: string description: The label for the key. required: - version - label QuorumGroupPermissions: description: "Subset of GroupPermissions to represent GroupPermissions flags in use\n\n\n\n GET_SOBJECTS:\n\n\n ROTATE_SOBJECTS:\n\n\n REVOKE_SOBJECTS:\n\n\n REVERT_SOBJECTS:\n\n\n DELETE_KEY_MATERIAL:\n\n\n DELETE_SOBJECTS:\n\n\n DESTROY_SOBJECTS:\n\n\n MOVE_SOBJECTS:\n\n\n CREATE_SOBJECTS:\n\n\n UPDATE_SOBJECTS_PROFILE:\n\n\n UPDATE_SOBJECTS_ENABLED_STATE:\n\n\n UPDATE_SOBJECT_POLICIES:\n\n\n ACTIVATE_SOBJECTS:\n\n\n UPDATE_KEY_OPS:\n\n" type: string enum: - GET_SOBJECTS - ROTATE_SOBJECTS - REVOKE_SOBJECTS - REVERT_SOBJECTS - DELETE_KEY_MATERIAL - DELETE_SOBJECTS - DESTROY_SOBJECTS - MOVE_SOBJECTS - CREATE_SOBJECTS - UPDATE_SOBJECTS_PROFILE - UPDATE_SOBJECTS_ENABLED_STATE - UPDATE_SOBJECT_POLICIES - ACTIVATE_SOBJECTS - UPDATE_KEY_OPS MlKemOptions: allOf: - type: object description: ML-KEM specific options properties: param_set: $ref: '#/components/schemas/MlKemParamSet' Sobject: allOf: - type: object properties: acct_id: type: string format: uuid description: UUID of the account which the security object belongs to. activation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Activation date of security object in seconds since EPOCH. aes: $ref: '#/components/schemas/AesOptions' allow_credential_use: type: - boolean - 'null' description: Whether this security object can be used/referenced by a credential object. allow_sign_hash: type: - boolean - 'null' description: Whether the sign operation response contains hash or data as output. aria: $ref: '#/components/schemas/AriaOptions' bip32: $ref: '#/components/schemas/Bip32Options' bls: $ref: '#/components/schemas/BlsOptions' compliant_with_policies: type: - boolean - 'null' description: Whether this security object is compliant with cryptographic policies or not. compromise_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Compromise date of security object in seconds since EPOCH. created_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Timestamp at which the security object was created. creator: $ref: '#/components/schemas/Principal' custom_metadata: type: - object - 'null' additionalProperties: type: string description: User managed field for adding custom metadata to the security object. deactivation_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Deactivation date of security object in seconds since EPOCH. deletion_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Deletion date of security object in seconds since EPOCH. des: $ref: '#/components/schemas/DesOptions' des3: $ref: '#/components/schemas/Des3Options' description: type: - string - 'null' description: Description of the security object. destruction_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: Destruction date of security object in seconds since EPOCH. deterministic_signatures: type: - boolean - 'null' description: Optionally get deterministic signatures, if algorithm is EC or RSA. dsa: $ref: '#/components/schemas/DsaOptions' eckcdsa: $ref: '#/components/schemas/EcKcdsaOptions' effective_key_policy: $ref: '#/components/schemas/EffectiveKeyPolicy' elliptic_curve: $ref: '#/components/schemas/EllipticCurve' enabled: type: boolean description: Whether this security object has cryptographic operations enabled. export_policy: $ref: '#/components/schemas/SobjectExportPolicy' external: $ref: '#/components/schemas/ExternalSobjectInfo' fpe: $ref: '#/components/schemas/FpeOptions' google_access_reason_policy: $ref: '#/components/schemas/GoogleAccessReasonPolicy' history: type: - array - 'null' items: $ref: '#/components/schemas/HistoryItem' description: 'When a Key Undo Policy is in place, a list of (non-expired) history items is returned. Each history item represents a past key state that can be reverted to.' kcdsa: $ref: '#/components/schemas/KcdsaOptions' kcv: type: string description: Key Checksum Value of the security object. kcv_cmac: type: string description: Cmac Key Checksum Value of the security object. key_creation_method: $ref: '#/components/schemas/KeyCreationMethod' key_ops: type: array items: $ref: '#/components/schemas/KeyOperations' description: Operations allowed to be performed by a given key. key_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: Key size of the security object in bits. kid: type: - string - 'null' format: uuid description: Unique identifier of the security object. links: $ref: '#/components/schemas/KeyLinks' lms: $ref: '#/components/schemas/LmsOptions' mldsa: $ref: '#/components/schemas/MlDsaOptions' mlkem: $ref: '#/components/schemas/MlKemOptions' name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name of the security object. never_exportable: type: - boolean - 'null' description: Whether the security object was exportable at some point in its lifetime. obj_type: $ref: '#/components/schemas/ObjectType' origin: $ref: '#/components/schemas/ObjectOrigin' original_key_ops: type: - array - 'null' items: $ref: '#/components/schemas/KeyOperations' description: Key operations with which the key was created. This information is available for newly created DSM keys starting with version 5.1 pub_key: type: string format: byte description: 'Public key material of the security object, if it exists. For virtual keys, this field may not be available if the key is not backed by DSM.' public_only: type: boolean description: Whether the security object only consists of public material. publish_public_key: $ref: '#/components/schemas/PublishPublicKeyConfig' revocation_reason: $ref: '#/components/schemas/RevocationReason' rotation_policy: $ref: '#/components/schemas/RotationPolicy' rsa: $ref: '#/components/schemas/RsaOptions' scheduled_rotation: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: 'Timestamp at which security object will be rotated, if rotation policy exists. This time will be clamped at 31 December 9999 11:59:59 pm UTC if the calculated rotation time would exceed that date.' seed: $ref: '#/components/schemas/SeedOptions' slip10: $ref: '#/components/schemas/Slip10Options' state: $ref: '#/components/schemas/SobjectState' transient_key: type: string format: byte description: Transient key material. value: type: string format: byte description: Security object stored as byte array. virtual_key_info: $ref: '#/components/schemas/VirtualSobjectInfo' wrapping_key_group_ids: type: - array - 'null' uniqueItems: true items: type: string format: uuid description: Group ids of groups that use this security object to encrypt the key material of their security objects xmss: $ref: '#/components/schemas/XmssOptions' group_id: type: - string - 'null' format: uuid description: UUID of the group which the security object belongs to. required: - acct_id - created_at - creator - enabled - key_ops - obj_type - origin - public_only FpeDateConstraint: description: Possible date-related constraint types for a portion of a complex tokenization data type. oneOf: - $ref: '#/components/schemas/FpeDate' - $ref: '#/components/schemas/FpeDatePart' HmgConfigVariantSafenet: allOf: - type: object properties: kind: type: string enum: - Safenet required: - kind - $ref: '#/components/schemas/HmgConfigSafenet' RemovableCryptographicPolicy: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/CryptographicPolicy' AriaOptionsPolicy: allOf: - type: object properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 random_iv: type: - boolean - 'null' ListOciVaultsRequest: allOf: - type: object properties: region: type: string compartment_ocid: type: string credential_id: $ref: '#/components/schemas/CredentialId' required: - region - compartment_ocid - credential_id AzureServiceEndpoints: allOf: - type: object description: 'The set of endpoints to use when connecting with Azure cloud. Today, only Azure global and Azure Government cloud endpoints are supported, and they cannot be mixed together. The Azure global endpoints are - `management`: management.azure.com - `key_vault`: vault.azure.net - `key_vault_managed_hsm`: managedhsm.azure.net - `iam`: login.microsoftonline.com and the Azure Government endpoints are - `management`: management.usgovcloudapi.net - `key_vault`: vault.usgovcloudapi.net - `key_vault_managed_hsm`: managedhsm.usgovcloudapi.net - `iam`: login.microsoftonline.us (In the future, this restriction may be relaxed to support custom clouds.)' properties: management: type: string description: The API endpoint for managing Azure APIs and resources. key_vault: type: string description: The API endpoint for Azure Key Vault (for Standard and Premium SKUs). key_vault_managed_hsm: type: string description: The API endpoint for Azure Key Vault Managed HSM. iam: type: string description: The API endpoint for Azure AD (and authentication). required: - management - key_vault - key_vault_managed_hsm - iam FpeDataPartLiteral: allOf: - type: object description: 'A section of the data type that is not to be tokenized (e.g., a delimiter). Unlike preserved characters, literal characters are not used for FF1 tweaks.' properties: literal: type: array items: type: string description: 'The list of possible strings that make up this literal portion of the token. For example, if a delimiter can either be a space or a dash, the list would be `[" ", "-"]`. Implementation note: the backend will pick the first choice that matches when when parsing the input. If this results in an invalid parse of the rest of the input, the backend ***will not backtrack*** and will simply return with an error.' required: - literal BlsVariant: description: Signature/public-key size trade-off for BLS. type: string enum: - small_signatures - small_public_keys Quorum: allOf: - type: object description: Quorum approval policy. properties: n: type: integer members: type: array items: $ref: '#/components/schemas/QuorumPolicy' required: - n - members - $ref: '#/components/schemas/ApprovalAuthConfig' OauthScope: description: OAuth scope. type: string enum: - app - openid - email - profile RevocationReason: allOf: - type: object description: Reason for revoking a key. properties: code: $ref: '#/components/schemas/RevocationReasonCode' message: type: - string - 'null' description: 'Message is used exclusively for audit trail/logging purposes and MAY contain additional information about why the object was revoked.' compromise_occurance_date: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z required: - code ExportPolicy: oneOf: - $ref: '#/components/schemas/ExportPolicyVariantWrapped' - $ref: '#/components/schemas/ExportPolicyVariantUnrestricted' discriminator: propertyName: $type mapping: Wrapped: ExportPolicyVariantWrapped Unrestricted: ExportPolicyVariantUnrestricted HistoryItem: allOf: - type: object description: 'A particular entry in a security object''s history. These entries are maintained as part of the key history (aka key undo) policy feature, which allows otherwise- irreversible operations on security objects to be reversible. Each entry represents a particular "snapshot in time" to which a security object can be reverted. Such entries are only recorded when key history is disabled.' properties: id: type: string format: uuid description: The ID identifying this particular entry. state: $ref: '#/components/schemas/HistoryItemState' created_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: The time when this history entry was created. expiry: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: 'The time when this entry is no longer available for undo purposes.' required: - id - state - created_at - expiry RotationInterval: oneOf: - title: RotationIntervalVariantIntervalDays type: object properties: interval_days: type: integer minimum: 0 maximum: 4294967295 required: - interval_days - title: RotationIntervalVariantIntervalMonths type: object properties: interval_months: type: integer minimum: 0 maximum: 4294967295 required: - interval_months HmgConfigVariantAzureKeyVault: allOf: - type: object properties: kind: type: string enum: - AzureKeyVault required: - kind - $ref: '#/components/schemas/HmgConfigAzureKeyVault' ExternalKmsInfo: description: Information about a specific external KMS key object. oneOf: - $ref: '#/components/schemas/ExternalKmsInfoVariantAWS' - $ref: '#/components/schemas/ExternalKmsInfoVariantOci' discriminator: propertyName: type mapping: AWS: ExternalKmsInfoVariantAWS Oci: ExternalKmsInfoVariantOci AzureAuthConfig: oneOf: - $ref: '#/components/schemas/AzureAuthConfigVariantClientSecret' - $ref: '#/components/schemas/AzureAuthConfigVariantTokenAuthConfig' discriminator: propertyName: mode mapping: client_secret: AzureAuthConfigVariantClientSecret token_auth_config: AzureAuthConfigVariantTokenAuthConfig Pkcs11ClientConfig: allOf: - type: object properties: fake_rsa_x9_31_keygen_support: type: - boolean - 'null' signing_aes_key_as_hmac: type: - boolean - 'null' exact_key_ops: type: - boolean - 'null' prevent_duplicate_opaque_objects: type: - boolean - 'null' opaque_objects_are_not_certificates: type: - boolean - 'null' max_concurrent_requests_per_slot: type: - integer - 'null' QuorumApprovalConfig: allOf: - type: object description: Quorum Policy Configurations in clients properties: wait_for_quorum_approval: $ref: '#/components/schemas/ApprovalWaitConfig' HmgConfigVariantAwsCloudHsm: allOf: - type: object properties: kind: type: string enum: - AwsCloudHsm required: - kind - $ref: '#/components/schemas/HmgConfigAwsCloudHsm' Bip32Options: allOf: - type: object properties: derivation_path: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 description: 'The BIP32 path, starting from master. Master key is Some([]). Ex: m/42/42''/0 -> Some([42, 2**31 + 42, 0])' network: $ref: '#/components/schemas/Bip32Network' FpeDateMonthDay: allOf: - type: object description: 'Represents a date that consists of a Month subpart and a Day subpart. It is an error to preserve only the Month part or the Day part.' properties: before: $ref: '#/components/schemas/FpeDayMonthDate' after: $ref: '#/components/schemas/FpeDayMonthDate' FpeWordsCustom: allOf: - type: object properties: list: type: array items: type: string description: 'Examples: {"john", "jane"}, {".", "-", "_", "@", " "}' required: - list ClientFileLoggingVariantEnabled: allOf: - type: object properties: mode: type: string enum: - enabled required: - mode - $ref: '#/components/schemas/ClientFileLoggingConfig' KcdsaOptionsPolicy: allOf: - type: object properties: {} AwsKeyMaterialId: allOf: - type: object properties: key_material_id: type: string description: key material ID reported by AWS KMS key_material_index: type: integer description: The index of the key material in the AWS ListKeyRotations response required: - key_material_id - key_material_index RsaEncryptionPolicy: allOf: - type: object description: Constraints on RSA encryption parameters. In general, if a constraint is not specified, anything is allowed. properties: padding: $ref: '#/components/schemas/RsaEncryptionPaddingPolicy' CountAccuracyVariantApproximate: allOf: - type: object properties: $type: type: string enum: - Approximate required: - $type - type: object properties: {} FpeCompoundPart: description: 'Structure of a compound portion of a complex tokenization data type, itself composed of smaller parts.' oneOf: - $ref: '#/components/schemas/FpeCompoundPartOr' - $ref: '#/components/schemas/FpeCompoundPartConcat' - $ref: '#/components/schemas/FpeCompoundPartMultiple' BlsOptionsPolicy: allOf: - type: object properties: {} SeedOptions: allOf: - type: object properties: cipher_mode: $ref: '#/components/schemas/CipherMode' random_iv: type: - boolean - 'null' Group: allOf: - type: object properties: acct_id: type: string format: uuid approval_policy: $ref: '#/components/schemas/GroupApprovalPolicy' auto_scan: $ref: '#/components/schemas/AutoScanSettings' client_configurations: $ref: '#/components/schemas/ClientConfigurations' created_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z creator: $ref: '#/components/schemas/Principal' cryptographic_policy: $ref: '#/components/schemas/CryptographicPolicy' custodian_policy: $ref: '#/components/schemas/QuorumPolicy' custom_metadata: type: - object - 'null' additionalProperties: type: string description: type: - string - 'null' export_policy: $ref: '#/components/schemas/ExportPolicy' google_access_reason_policy: $ref: '#/components/schemas/GoogleAccessReasonPolicy' group_id: type: string format: uuid hmg: type: - object - 'null' additionalProperties: $ref: '#/components/schemas/HmgConfig' hmg_redundancy: $ref: '#/components/schemas/HmgRedundancyScheme' hmg_segregation: type: - boolean - 'null' hmg_sync: type: - boolean - 'null' key_history_policy: $ref: '#/components/schemas/KeyHistoryPolicy' key_metadata_policy: $ref: '#/components/schemas/KeyMetadataPolicy' name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ wrapping_key_name: $ref: '#/components/schemas/WrappingKeyName' required: - acct_id - client_configurations - created_at - creator - group_id - name FpeDateMonthYear: allOf: - type: object description: 'Represents a date that consists of a Month subpart and a Year subpart. The Year part is allowed to be preserved; however, the Month part cannot be preserved by itself.' properties: before: $ref: '#/components/schemas/FpeMonthYearDate' after: $ref: '#/components/schemas/FpeMonthYearDate' FpeOptionsAdvanced: allOf: - type: object description: 'Advanced FPE options. It is recommended to use this for specifying any FPE options, as it is more expressive than FpeOptionsBasic.' properties: format: $ref: '#/components/schemas/FpeDataPart' description: type: - string - 'null' description: The user-provided name for the data type. required: - format Principal: description: A security principal. oneOf: - title: PrincipalVariantApp type: object properties: app: type: string format: uuid required: - app - title: PrincipalVariantUser type: object properties: user: type: string format: uuid required: - user - title: PrincipalVariantPlugin type: object properties: plugin: type: string format: uuid required: - plugin - title: PrincipalVariantUserViaApp type: object properties: userviaapp: $ref: '#/components/schemas/PrincipalUserViaApp' required: - userviaapp - title: PrincipalVariantSystem type: string enum: - system - title: PrincipalVariantUnregisteredUser type: string enum: - unregistereduser Scan: allOf: - type: object description: 'An object for representing a scan of objects from a source HSM, DSM cluster, or cloud KMS.' properties: scan_id: type: string format: uuid description: The ID of the scan. is_async: type: boolean description: Whether the scan is async or not. started_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: The time the scan began. finished_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z description: The time the scan finished. scan_result: $ref: '#/components/schemas/ScanResult' warnings: type: - array - 'null' items: $ref: '#/components/schemas/ScanWarning' description: Any warnings thrown during the scan. required: - scan_id - is_async - started_at AwsKmsKeyMaterialMapping: type: string enum: - aws_key_container_maps_to_sobject - aws_key_material_maps_to_sobject SobjectState: description: Security object operational state. type: string enum: - PreActive - Active - Deactivated - Compromised - Destroyed - Deleted RsaOptionsPolicy: allOf: - type: object properties: encryption_policy: type: - array - 'null' items: $ref: '#/components/schemas/RsaEncryptionPolicy' signature_policy: type: - array - 'null' items: $ref: '#/components/schemas/RsaSignaturePolicy' description: 'Signature policy for an RSA key. When doing a signature operation, the policies are evaluated against the specified parameters one by one. If one matches, the operation is allowed. If none match, including if the policy list is empty, the operation is disallowed. Missing optional parameters will have their defaults specified according to the matched policy. The default for new keys is `[{}]` (no constraints). If (part of) a constraint is not specified, anything is allowed for that constraint.' minimum_key_length: type: - integer - 'null' minimum: 0 maximum: 4294967295 description: 'The minimum allowed key length. This is only relevant for group or account cryptographic policies (and hence has no effect in an RSA policy on a specific key).' CredentialId: description: 'A wrapper type to provide better clarity that the id referenced is an integration credential object.' allOf: - type: string format: uuid MetadataStringConstraint: oneOf: - title: MetadataStringConstraintVariantForbidden type: object properties: forbidden: type: object properties: {} required: - forbidden - title: MetadataStringConstraintVariantRequired type: object properties: required: $ref: '#/components/schemas/MetadataStringConstraintRequired' required: - required RsaSignaturePolicy: allOf: - type: object description: Constraints on RSA signature parameters. In general, if a constraint is not specified, anything is allowed. properties: padding: $ref: '#/components/schemas/RsaSignaturePaddingPolicy' DigestAlgorithm: description: A hash algorithm. type: string enum: - BLAKE2B256 - BLAKE2B384 - BLAKE2B512 - BLAKE2S256 - RIPEMD160 - SSL3 - SHA1 - SHA224 - SHA256 - SHA384 - SHA512 - STREEBOG256 - STREEBOG512 - SHA3_224 - SHA3_256 - SHA3_384 - SHA3_512 TlsConfigVariantRequired: allOf: - type: object properties: mode: type: string enum: - required required: - mode - $ref: '#/components/schemas/TlsConfigRequired' ObjectType: description: Type of security object. type: string enum: - AES - ARIA - DES - DES3 - SEED - RSA - DSA - EC - KCDSA - ECKCDSA - BIP32 - SLIP10 - BLS - OPAQUE - HMAC - LEDABETA - ROUND5BETA - SECRET - LMS - XMSS - MLDSA - MLDSABETA - MLKEM - MLKEMBETA - CERTIFICATE - PBE KcdsaOptions: allOf: - type: object properties: subgroup_size: type: - integer - 'null' minimum: 0 maximum: 4294967295 hash_alg: $ref: '#/components/schemas/DigestAlgorithm' ObjectTypeFilterVariantSelection: allOf: - type: object properties: $type: type: string enum: - Selection required: - $type - $ref: '#/components/schemas/ObjectTypeFilterSelection' EcOptionsPolicy: allOf: - type: object properties: elliptic_curves: type: - array - 'null' items: $ref: '#/components/schemas/EllipticCurve' KeyCreationMethodVariantAgree: allOf: - type: object properties: method: type: string enum: - Agree required: - method - type: object properties: {} HmgConfigVariantOciVault: allOf: - type: object properties: kind: type: string enum: - OciVault required: - kind - $ref: '#/components/schemas/HmgConfigOciVault' HmgConfigFortanix: allOf: - type: object properties: url: type: string tls: $ref: '#/components/schemas/TlsConfig' pin: type: string required: - url - tls FpeTokenizeMode: description: How to tokenize a given input. The most secure option is "PreserveFormat". type: string enum: - preserve_format - preserve_variant - preserve_length FpeInputDefaultProcessing: type: string enum: - strip - reject TlsConfig: description: TLS client settings. oneOf: - $ref: '#/components/schemas/TlsConfigVariantDisabled' - $ref: '#/components/schemas/TlsConfigVariantOpportunistic' - $ref: '#/components/schemas/TlsConfigVariantRequired' discriminator: propertyName: mode mapping: disabled: TlsConfigVariantDisabled opportunistic: TlsConfigVariantOpportunistic required: TlsConfigVariantRequired RemovableKeyHistoryPolicy: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/KeyHistoryPolicy' VirtualSobjectInfo: allOf: - type: object description: 'Information specific to a virtual key. Currently, this is only relevant for virtual keys backed by DSM.' properties: cached_key_material: type: boolean description: Whether or not the source key material is cached within the key. required: - cached_key_material AesOptionsPolicy: allOf: - type: object properties: key_sizes: type: - array - 'null' items: type: integer minimum: 0 maximum: 4294967295 random_iv: type: - boolean - 'null' fpe: $ref: '#/components/schemas/FpeOptions' MetadataDurationConstraintRequired: allOf: - type: object properties: allowed_values: $ref: '#/components/schemas/RestrictedDuration' Slip10OptionsPolicy: allOf: - type: object properties: {} XmssOptionsPolicy: allOf: - type: object properties: {} ScanResultFailed: allOf: - type: object description: 'Indicates that a scan has failed. The most recent error is included (taken from the last retry).' properties: message: type: string required: - message KeyLinks: allOf: - type: object description: Linked security objects. properties: replacement: type: - string - 'null' format: uuid description: key id of the key that replaced this key (i.e., this key was rotated to the `replacement` key) replaced: type: - string - 'null' format: uuid description: key id of the key that was replaced by this key (i.e., the `replaced` key was rotated to this key) copiedFrom: type: - string - 'null' format: uuid copiedTo: type: - array - 'null' items: type: string format: uuid subkeys: type: - array - 'null' items: type: string format: uuid parent: type: - string - 'null' format: uuid wrappingKey: type: - string - 'null' format: uuid description: Wrapping key used to wrap this security object HmgListKeyCollectionsRequestVariantOciVault: allOf: - type: object properties: $type: type: string enum: - OciVault required: - $type - $ref: '#/components/schemas/ListOciVaultsRequest' HmgConfigAwsCloudHsm: allOf: - type: object properties: url: type: string tls: $ref: '#/components/schemas/TlsConfig' slot: type: integer pin: type: string hsm_order: type: - integer - 'null' format: int32 description: 'The priority of this `HmgConfig`. This is used when a group is configured with an `HmgRedundancyScheme`, and is otherwise unused. (See the docs for `HmgRedundancyScheme` for more information about the interpretation of this field.)' required: - url - tls - slot RemovableKeyMetadataPolicy: oneOf: - type: string enum: - remove - $ref: '#/components/schemas/KeyMetadataPolicy' FpeEncryptedPart: allOf: - type: object description: 'Structure of a tokenized portion of a complex tokenization data type. Implementation note: the backend parser is locally "greedy" and will attempt to match as many characters as possible. If this later results in an invalid parse of the rest of the input, the backend ***will not backtrack*** and will simply return with an error.' properties: min_length: type: integer minimum: 0 maximum: 4294967295 description: The minimum allowed length for this part (in chars). max_length: type: integer minimum: 0 maximum: 4294967295 description: The maximum allowed length for this part (in chars). char_set: $ref: '#/components/schemas/FpeCharSet' cipher_char_set: $ref: '#/components/schemas/FpeCharSet' constraints: $ref: '#/components/schemas/FpeConstraints' preserve: $ref: '#/components/schemas/FpePreserveMask' mask: $ref: '#/components/schemas/FpePreserveMask' required: - min_length - max_length - char_set parameters: GetGroupsParams: in: query name: GetGroupsParams schema: $ref: '#/components/schemas/GetGroupsParams' explode: true securitySchemes: basicAuth: type: http scheme: basic apiKeyAuth: type: apiKey name: Authorization in: header description: Please enter your token prefixed with 'Basic ' (e.g., 'Basic your_token_here') bearerToken: type: http scheme: bearer bearerFormat: JWT