openapi: 3.0.3 info: title: Infisical Admin KMS Keys API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server tags: - name: KMS Keys paths: /api/v1/kms/keys: post: operationId: createKmsKey tags: - KMS Keys description: Create KMS key requestBody: required: true content: application/json: schema: type: object properties: projectId: type: string description: The ID of the project to create the key in. name: type: string minLength: 1 maxLength: 32 description: The name of the key to be created. Must be slug-friendly. description: type: string maxLength: 500 description: An optional description of the key. keyUsage: type: string enum: - encrypt-decrypt - sign-verify default: encrypt-decrypt description: The type of key to be created, either encrypt-decrypt or sign-verify, based on your intended use for the key. encryptionAlgorithm: type: string enum: - aes-256-gcm - aes-128-gcm - RSA_4096 - ECC_NIST_P256 - ECC_NIST_P384 - ECC_NIST_P521 - ML_DSA_44 - ML_DSA_65 - ML_DSA_87 default: aes-256-gcm description: The algorithm to use when performing cryptographic operations with the key. required: - projectId - name additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: key: type: object properties: id: type: string format: uuid description: type: string nullable: true isDisabled: type: boolean default: false nullable: true orgId: type: string format: uuid name: type: string createdAt: type: string format: date-time updatedAt: type: string format: date-time projectId: type: string nullable: true keyUsage: type: string default: encrypt-decrypt kmipMetadata: nullable: true version: type: number default: 1 encryptionAlgorithm: type: string required: - id - orgId - name - createdAt - updatedAt - encryptionAlgorithm additionalProperties: false required: - key additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false get: operationId: listKmsKeys tags: - KMS Keys description: List KMS keys parameters: - schema: type: string in: query name: projectId required: true description: The ID of the project to list keys from. - schema: type: number minimum: 0 default: 0 in: query name: offset required: false description: The offset to start from. If you enter 10, it will start from the 10th key. - schema: type: number minimum: 1 maximum: 100 default: 100 in: query name: limit required: false description: The number of keys to return. - schema: type: string enum: - name default: name in: query name: orderBy required: false description: The column to order keys by. - schema: type: string enum: - asc - desc default: asc in: query name: orderDirection required: false description: The direction to order keys in. - schema: type: string in: query name: search required: false description: The text string to filter key names by. responses: '200': description: Default Response content: application/json: schema: type: object properties: keys: type: array items: type: object properties: id: type: string format: uuid description: type: string nullable: true isDisabled: type: boolean default: false nullable: true orgId: type: string format: uuid name: type: string createdAt: type: string format: date-time updatedAt: type: string format: date-time projectId: type: string nullable: true keyUsage: type: string default: encrypt-decrypt kmipMetadata: nullable: true version: type: number default: 1 encryptionAlgorithm: type: string required: - id - orgId - name - createdAt - updatedAt - encryptionAlgorithm additionalProperties: false totalCount: type: number required: - keys - totalCount additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/kms/keys/{keyId}: patch: operationId: updateKmsKey tags: - KMS Keys description: Update KMS key requestBody: required: true content: application/json: schema: type: object properties: name: type: string minLength: 1 maxLength: 32 description: The updated name of this key. Must be slug-friendly. isDisabled: type: boolean description: The flag to enable or disable this key. description: type: string maxLength: 500 description: The updated description of this key. additionalProperties: false parameters: - schema: type: string format: uuid in: path name: keyId required: true description: The ID of the key to be updated. responses: '200': description: Default Response content: application/json: schema: type: object properties: key: type: object properties: id: type: string format: uuid description: type: string nullable: true isDisabled: type: boolean default: false nullable: true orgId: type: string format: uuid name: type: string createdAt: type: string format: date-time updatedAt: type: string format: date-time projectId: type: string nullable: true keyUsage: type: string default: encrypt-decrypt kmipMetadata: nullable: true version: type: number default: 1 encryptionAlgorithm: type: string required: - id - orgId - name - createdAt - updatedAt - encryptionAlgorithm additionalProperties: false required: - key additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false delete: operationId: deleteKmsKey tags: - KMS Keys description: Delete KMS key parameters: - schema: type: string format: uuid in: path name: keyId required: true description: The ID of the key to be deleted. responses: '200': description: Default Response content: application/json: schema: type: object properties: key: type: object properties: id: type: string format: uuid description: type: string nullable: true isDisabled: type: boolean default: false nullable: true orgId: type: string format: uuid name: type: string createdAt: type: string format: date-time updatedAt: type: string format: date-time projectId: type: string nullable: true keyUsage: type: string default: encrypt-decrypt kmipMetadata: nullable: true version: type: number default: 1 encryptionAlgorithm: type: string required: - id - orgId - name - createdAt - updatedAt - encryptionAlgorithm additionalProperties: false required: - key additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false get: operationId: getKmsKeyById tags: - KMS Keys description: Get KMS key by ID parameters: - schema: type: string format: uuid in: path name: keyId required: true description: The ID of the KMS key to retrieve. responses: '200': description: Default Response content: application/json: schema: type: object properties: key: type: object properties: id: type: string format: uuid description: type: string nullable: true isDisabled: type: boolean default: false nullable: true orgId: type: string format: uuid name: type: string createdAt: type: string format: date-time updatedAt: type: string format: date-time projectId: type: string nullable: true keyUsage: type: string default: encrypt-decrypt kmipMetadata: nullable: true version: type: number default: 1 encryptionAlgorithm: type: string required: - id - orgId - name - createdAt - updatedAt - encryptionAlgorithm additionalProperties: false required: - key additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/kms/keys/key-name/{keyName}: get: operationId: getKmsKeyByName tags: - KMS Keys description: Get KMS key by name parameters: - schema: type: string minLength: 1 in: query name: projectId required: true description: The ID of the project the key belongs to. - schema: type: string minLength: 1 maxLength: 64 in: path name: keyName required: true description: The name of the KMS key to retrieve. responses: '200': description: Default Response content: application/json: schema: type: object properties: key: type: object properties: id: type: string format: uuid description: type: string nullable: true isDisabled: type: boolean default: false nullable: true orgId: type: string format: uuid name: type: string createdAt: type: string format: date-time updatedAt: type: string format: date-time projectId: type: string nullable: true keyUsage: type: string default: encrypt-decrypt kmipMetadata: nullable: true version: type: number default: 1 encryptionAlgorithm: type: string required: - id - orgId - name - createdAt - updatedAt - encryptionAlgorithm additionalProperties: false required: - key additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/kms/keys/{keyId}/private-key: get: operationId: getKmsKeyPrivateKey tags: - KMS Keys description: Export the private key (or key material) for a KMS key. For asymmetric keys (sign/verify), the private key is returned. For symmetric keys (encrypt/decrypt), the key material is returned. parameters: - schema: type: string format: uuid in: path name: keyId required: true description: The ID of the key to export the private key or key material for. responses: '200': description: Default Response content: application/json: schema: type: object properties: privateKey: type: string required: - privateKey additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/kms/keys/bulk-import: post: operationId: bulkImportKmsKeys tags: - KMS Keys description: Bulk import KMS keys with provided key material into a project. requestBody: required: true content: application/json: schema: type: object properties: projectId: type: string format: uuid keys: type: array items: type: object properties: name: type: string minLength: 1 maxLength: 32 keyUsage: type: string enum: - encrypt-decrypt - sign-verify encryptionAlgorithm: type: string enum: - aes-256-gcm - aes-128-gcm - RSA_4096 - ECC_NIST_P256 - ECC_NIST_P384 - ECC_NIST_P521 - ML_DSA_44 - ML_DSA_65 - ML_DSA_87 keyMaterial: type: string minLength: 1 required: - name - keyUsage - encryptionAlgorithm - keyMaterial additionalProperties: false minItems: 1 maxItems: 100 required: - projectId - keys additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: keys: type: array items: type: object properties: id: type: string name: type: string required: - id - name additionalProperties: false errors: type: array items: type: object properties: name: type: string message: type: string required: - name - message additionalProperties: false required: - keys - errors additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/kms/keys/bulk-export-private-keys: post: operationId: bulkExportKmsKeyPrivateKeys tags: - KMS Keys description: Bulk export multiple KMS keys. For asymmetric keys (sign/verify), both private and public keys are returned. For symmetric keys (encrypt/decrypt), the key material is returned. requestBody: required: true content: application/json: schema: type: object properties: keyIds: type: array items: type: string format: uuid description: An array of KMS key IDs to export. Maximum 100 keys per request. minItems: 1 maxItems: 100 required: - keyIds additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: keys: type: array items: type: object properties: keyId: type: string name: type: string keyUsage: type: string algorithm: type: string privateKey: type: string publicKey: type: string required: - keyId - name - keyUsage - algorithm - privateKey additionalProperties: false required: - keys additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: An access token in Infisical