openapi: 3.0.3 info: title: Infisical Admin KMS Signing API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server tags: - name: KMS Signing paths: /api/v1/kms/keys/{keyId}/public-key: get: operationId: getKmsKeyPublicKey tags: - KMS Signing description: Get the public key for a KMS key that is used for signing and verifying data. This endpoint is only available for asymmetric keys. parameters: - schema: type: string format: uuid in: path name: keyId required: true description: The ID of the key to get the public key for. The key must be for signing and verifying. responses: '200': description: Default Response content: application/json: schema: type: object properties: publicKey: type: string required: - publicKey additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/kms/keys/{keyId}/signing-algorithms: get: operationId: listKmsKeySigningAlgorithms tags: - KMS Signing description: List all available signing algorithms for a KMS key parameters: - schema: type: string format: uuid in: path name: keyId required: true description: The ID of the key to list the signing algorithms for. The key must be for signing and verifying. responses: '200': description: Default Response content: application/json: schema: type: object properties: signingAlgorithms: type: array items: type: string enum: - RSASSA_PSS_SHA_512 - RSASSA_PSS_SHA_384 - RSASSA_PSS_SHA_256 - RSASSA_PKCS1_V1_5_SHA_512 - RSASSA_PKCS1_V1_5_SHA_384 - RSASSA_PKCS1_V1_5_SHA_256 - ECDSA_SHA_512 - ECDSA_SHA_384 - ECDSA_SHA_256 - ML_DSA_44 - ML_DSA_65 - ML_DSA_87 required: - signingAlgorithms additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/kms/keys/{keyId}/sign: post: operationId: signWithKmsKey tags: - KMS Signing description: Sign data with a KMS key. requestBody: required: true content: application/json: schema: type: object properties: signingAlgorithm: type: string enum: - RSASSA_PSS_SHA_512 - RSASSA_PSS_SHA_384 - RSASSA_PSS_SHA_256 - RSASSA_PKCS1_V1_5_SHA_512 - RSASSA_PKCS1_V1_5_SHA_384 - RSASSA_PKCS1_V1_5_SHA_256 - ECDSA_SHA_512 - ECDSA_SHA_384 - ECDSA_SHA_256 - ML_DSA_44 - ML_DSA_65 - ML_DSA_87 isDigest: type: boolean default: false description: Whether the data is already digested or not. Please be aware that if you are passing a digest the algorithm used to create the digest must match the signing algorithm used to sign the digest. data: type: string description: The data in string format to be signed (base64 encoded). required: - signingAlgorithm - data additionalProperties: false parameters: - schema: type: string format: uuid in: path name: keyId required: true description: The ID of the key to sign the data with. responses: '200': description: Default Response content: application/json: schema: type: object properties: signature: type: string keyId: type: string format: uuid signingAlgorithm: type: string enum: - RSASSA_PSS_SHA_512 - RSASSA_PSS_SHA_384 - RSASSA_PSS_SHA_256 - RSASSA_PKCS1_V1_5_SHA_512 - RSASSA_PKCS1_V1_5_SHA_384 - RSASSA_PKCS1_V1_5_SHA_256 - ECDSA_SHA_512 - ECDSA_SHA_384 - ECDSA_SHA_256 - ML_DSA_44 - ML_DSA_65 - ML_DSA_87 required: - signature - keyId - signingAlgorithm additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/kms/keys/{keyId}/verify: post: operationId: verifyWithKmsKey tags: - KMS Signing description: Verify data signatures with a KMS key. requestBody: required: true content: application/json: schema: type: object properties: isDigest: type: boolean default: false description: Whether the data is already digested or not. data: type: string description: The data in string format to be verified (base64 encoded). For data larger than 1MB you must first create a digest of the data and then pass the digest in the data parameter. signature: type: string description: The signature to be verified (base64 encoded). signingAlgorithm: type: string enum: - RSASSA_PSS_SHA_512 - RSASSA_PSS_SHA_384 - RSASSA_PSS_SHA_256 - RSASSA_PKCS1_V1_5_SHA_512 - RSASSA_PKCS1_V1_5_SHA_384 - RSASSA_PKCS1_V1_5_SHA_256 - ECDSA_SHA_512 - ECDSA_SHA_384 - ECDSA_SHA_256 - ML_DSA_44 - ML_DSA_65 - ML_DSA_87 required: - data - signature - signingAlgorithm additionalProperties: false parameters: - schema: type: string format: uuid in: path name: keyId required: true description: The ID of the key to verify the data with. responses: '200': description: Default Response content: application/json: schema: type: object properties: signatureValid: type: boolean keyId: type: string format: uuid signingAlgorithm: type: string enum: - RSASSA_PSS_SHA_512 - RSASSA_PSS_SHA_384 - RSASSA_PSS_SHA_256 - RSASSA_PKCS1_V1_5_SHA_512 - RSASSA_PKCS1_V1_5_SHA_384 - RSASSA_PKCS1_V1_5_SHA_256 - ECDSA_SHA_512 - ECDSA_SHA_384 - ECDSA_SHA_256 - ML_DSA_44 - ML_DSA_65 - ML_DSA_87 required: - signatureValid - keyId - signingAlgorithm additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: An access token in Infisical