openapi: 3.2.0
info:
  description: 'Use the Key Management API to manage vaults and keys. For more information, see [Managing Vaults](/Content/KeyManagement/Tasks/managingvaults.htm) and [Managing Keys](/Content/KeyManagement/Tasks/managingkeys.htm).

    '
  license:
    name: Oracle Corporation
  title: Vault Key Management Kms Crypto API
  version: release
  x-provenance:
    method: harvested
    first_party: true
    publisher: Oracle
    source: https://docs.oracle.com/en-us/iaas/api/specs/6650b193f50d51919ae1a5f31b525097c777bb9e61575a82b12bf5a5fa5c1dea.yaml
    harvested: '2026-08-04'
    note: Published by Oracle as the contract for the Vault Key Management API OCI service and stored verbatim; API Evangelist added only this provenance block.
  x-evidence:
  - url: https://docs.oracle.com/en-us/iaas/api/specs/index.json
    what: Oracle's own index of every OCI service specification
  - url: https://docs.oracle.com/en-us/iaas/api/specs/6650b193f50d51919ae1a5f31b525097c777bb9e61575a82b12bf5a5fa5c1dea.yaml
    what: the harvested document for Vault Key Management API
servers:
- url: /
tags:
- name: kmsCrypto
paths:
  /20180608/decrypt:
    post:
      description: 'Decrypts data using the given [DecryptDataDetails](/api/#/en/key/latest/datatypes/DecryptDataDetails) resource.

        '
      operationId: Decrypt
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        '200':
          description: 'The decrypted data in plaintext.

            '
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about

                a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DecryptedData'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '404':
          $ref: '#/components/responses/404'
        '429':
          $ref: '#/components/responses/429'
        '500':
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: Decrypt
      tags:
      - kmsCrypto
      x-example: "POST /20180608/decrypt\n<var>&lt;authorization and other headers&gt;</var>\n{\n  \"key-id\": \"ocid1.key.oc1.iad.annnb3f42acuu.abuwcljstscov63fvwp3yrrfepbnqyqlvqso3mfkpqg6aijasggkxglfzjia\",\n  \"key-version-id\": \"ocid1.keyversion.oc1.iad.annnb3f4a2cuu.arcnlvkg4zyaa.abuwcljsemiqtbccvmfppbpua3ll3f5kmfgireh62hfcxgg7tgcs5gwsg5ma\",\n  \"plaintext\": \"abcdefgh\",\n  \"plaintext-checksum\": \"1434553411\"\n}\n"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DecryptDataDetails'
        description: DecryptDataDetails
        required: true
  /20180608/encrypt:
    post:
      description: 'Encrypts data using the given [EncryptDataDetails](/api/#/en/key/latest/datatypes/EncryptDataDetails) resource.

        Plaintext included in the example request is a base64-encoded value of a UTF-8 string.

        '
      operationId: Encrypt
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        '200':
          description: The encrypted data, presented as ciphertext.
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about

                a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EncryptedData'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '404':
          $ref: '#/components/responses/404'
        '429':
          $ref: '#/components/responses/429'
        '500':
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: Encrypt
      tags:
      - kmsCrypto
      x-example: "POST /20180608/encrypt\nHost: <var>&lt;cryptoEndpoint&gt;</var>\n<var>&lt;authorization and other headers&gt;</var>\n{\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"plaintext\": \"aGVsbG8sIHdvcmxk\"\n}\n"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EncryptDataDetails'
        description: EncryptDataDetails
        required: true
  /20180608/exportKey:
    post:
      description: 'Exports a specific version of a master encryption key according to the details of the request. For their protection,

        keys that you create and store on a hardware security module (HSM) can never leave the HSM. You can only export keys

        stored on the server. For export, the key version is encrypted by an RSA public key that you provide.

        This operation is not supported for keys having protection mode `EXTERNAL`.

        '
      operationId: ExportKey
      responses:
        '200':
          description: The encrypted exported key.
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about

                a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExportedKeyData'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: Exports a master encryption key.
      tags:
      - kmsCrypto
      x-example: "POST /20180608/exportKey\nHost: <var>&lt;cryptoEndpoint&gt;</var>\n<var>&lt;authorization and other headers&gt;</var>\n{\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"keyVersionId\": \"ocid1.keyversion.oc1.iad.examplevriiaa.examples4h2bocax3damnsxw4cvbbndged2gftlho4ufxwa4faux2eiqwija\",\n  \"algorithm\": \"RSA_OAEP_AES_SHA256\",\n  \"publicKey\": \"-----BEGIN PUBLIC KEY----- ..... -----END PUBLIC KEY-----\"\n}\n"
      x-related-resource: '#/definitions/ExportedKeyData'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExportKeyDetails'
        description: ExportKeyDetails
        required: true
  /20180608/generateDataEncryptionKey:
    post:
      description: 'Generates a key that you can use to encrypt or decrypt data.

        '
      operationId: GenerateDataEncryptionKey
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        '200':
          description: The data encryption key.
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about

                a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GeneratedKey'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '404':
          $ref: '#/components/responses/404'
        '429':
          $ref: '#/components/responses/429'
        '500':
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: GenerateDataEncryptionKey
      tags:
      - kmsCrypto
      x-example: "POST /20180608/generateDataEncryptionKey\nHost: <var>&lt;cryptoEndpoint&gt;</var>\n<var>&lt;authorization and other headers&gt;</var>\n{\n  \"includePlaintextKey\": true,\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"keyShape\": {\n    \"algorithm\": \"AES\",\n    \"length\": 16\n  }\n}\n"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GenerateKeyDetails'
        description: GenerateKeyDetails
        required: true
  /20180608/sign:
    post:
      description: 'Creates a digital signature for a message or message digest by using the private key of a public-private key pair,

        also known as an asymmetric key. To verify the generated signature, you can use the [Verify](/api/#/en/key/latest/VerifiedData/Verify)

        operation. Or, if you want to validate the signature outside of the service, you can do so by using the public key of the same asymmetric key.

        This operation is not supported for keys having protection mode `EXTERNAL`.

        '
      operationId: Sign
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        '200':
          description: 'The signed data.

            '
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about

                a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignedData'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '404':
          $ref: '#/components/responses/404'
        '429':
          $ref: '#/components/responses/429'
        '500':
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: Signs data by using the given SignDataDetails resource.
      tags:
      - kmsCrypto
      x-example: "POST /20180608/sign\nHost: <var>&lt;cryptoEndpoint&gt;</var>\n<var>&lt;authorization and other headers&gt;</var>\n{\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"message\": \"aGVsbG8sIHdvcmxk\"\n  \"signingAlgorithm\": \"SHA256_RSA_PKCS_PSS\"\n},\n"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignDataDetails'
        description: SignDataDetails
        required: true
  /20180608/verify:
    post:
      description: 'Verifies a digital signature that was generated by the [Sign](/api/#/en/key/latest/SignedData/Sign) operation

        by using the public key of the same asymmetric key that was used to sign the data. If you want to validate the

        digital signature outside of the service, you can do so by using the public key of the asymmetric key.

        This operation is not supported for keys having protection mode `EXTERNAL`.

        '
      operationId: Verify
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        '200':
          description: 'The verified signed material.

            '
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about

                a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifiedData'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '404':
          $ref: '#/components/responses/404'
        '429':
          $ref: '#/components/responses/429'
        '500':
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/DefaultError'
      summary: Verifies signed data by using the given VerifyDataDetails resource.
      tags:
      - kmsCrypto
      x-example: "POST /20180608/verify\nHost: <var>&lt;cryptoEndpoint&gt;</var>\n<var>&lt;authorization and other headers&gt;</var>\n{\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"keyVersionId\": \"ocid1.keyversion.oc1.iad.exampledaaeug.xd5q23tteidhj4q2c6qfauxm32i577yuamplestkvmbjdnbickxasfaf\",\n  \"signature\": \"dsdfsljfnsjnfsnfdsnf\",\n  \"signingAlgorithm\": \"SHA256_RSA_PKCS_PSS\"\n}\n"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyDataDetails'
        description: VerifyDataDetails
        required: true
components:
  schemas:
    DecryptedData:
      description: The response to a request to decrypt the encrypted data.
      properties:
        encryptionAlgorithm:
          default: AES_256_GCM
          description: 'The encryption algorithm to use to encrypt and decrypt data with a customer-managed key

            `AES_256_GCM` indicates that the key is a symmetric key that uses the Advanced Encryption Standard (AES) algorithm and

            that the mode of encryption is the Galois/Counter Mode (GCM). `RSA_OAEP_SHA_1` indicates that the

            key is an asymmetric key that uses the RSA encryption algorithm and uses Optimal Asymmetric Encryption Padding (OAEP).

            `RSA_OAEP_SHA_256` indicates that the key is an asymmetric key that uses the RSA encryption algorithm with a SHA-256 hash

            and uses OAEP.

            '
          enum:
          - AES_256_GCM
          - RSA_OAEP_SHA_1
          - RSA_OAEP_SHA_256
          type: string
        keyId:
          description: The OCID of the key used to encrypt the ciphertext.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: The OCID of the key version used to encrypt the ciphertext.
          maxLength: 255
          minLength: 1
          type: string
        plaintext:
          description: The decrypted data, expressed as a base64-encoded value.
          maxLength: 4096
          minLength: 1
          type: string
        plaintextChecksum:
          description: The checksum of the decrypted data.
          maxLength: 1024
          minLength: 1
          type: string
      required:
      - plaintext
      - plaintextChecksum
      type: object
      x-example: "{\n  \"plaintext\": \"aGVsbG8sIHdvcmxk\",\n  \"plaintextChecksum\": \"4289425978\"\n}\n"
    KeyShape:
      description: The cryptographic properties of a key.
      properties:
        algorithm:
          description: The algorithm used by a key's key versions to encrypt or decrypt. Only AES algorithm is supported for `External` keys.
          enum:
          - AES
          - RSA
          - ECDSA
          type: string
        curveId:
          description: Supported curve IDs for ECDSA keys.
          enum:
          - NIST_P256
          - NIST_P384
          - NIST_P521
          type: string
        length:
          description: "The length of the key in bytes, expressed as an integer. Supported values include the following:\n  - AES: 16, 24, or 32\n  - RSA: 256, 384, or 512\n  - ECDSA: 32, 48, or 66\n"
          type: integer
      required:
      - algorithm
      - length
      type: object
      x-example: "{\n  \"algorithm\": \"AES\",\n  \"length\": 16\n}\n"
    GenerateKeyDetails:
      description: The details of the key that you want to encrypt or decrypt data.
      properties:
        associatedData:
          additionalProperties:
            type: string
          description: 'Information that can be used to provide an encryption context for the encrypted data.

            The length of the string representation of the associated data must be fewer than 4096

            characters.

            '
          type: object
        includePlaintextKey:
          description: If true, the generated key is also returned unencrypted.
          type: boolean
        keyId:
          description: The OCID of the master encryption key to encrypt the generated data encryption key with.
          maxLength: 255
          minLength: 1
          type: string
        keyShape:
          $ref: '#/components/schemas/KeyShape'
        loggingContext:
          additionalProperties:
            type: string
          description: 'Information that provides context for audit logging. You can provide this additional

            data by formatting it as key-value pairs to include in audit logs when audit logging is enabled.

            '
          type: object
      required:
      - keyId
      - keyShape
      - includePlaintextKey
      type: object
      x-example: "{\n  \"includePlaintextKey\": true,\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"keyShape\": {\n    \"algorithm\": \"AES\",\n    \"length\": 16\n  }\n}\n"
    EncryptDataDetails:
      description: The details of the plaintext data that you want to encrypt.
      properties:
        associatedData:
          additionalProperties:
            type: string
          description: 'Information that can be used to provide an encryption context for the

            encrypted data. The length of the string representation of the associated data

            must be fewer than 4096 characters.

            '
          type: object
        encryptionAlgorithm:
          default: AES_256_GCM
          description: 'The encryption algorithm to use to encrypt and decrypt data with a customer-managed key.

            `AES_256_GCM` indicates that the key is a symmetric key that uses the Advanced Encryption Standard (AES) algorithm and

            that the mode of encryption is the Galois/Counter Mode (GCM). `RSA_OAEP_SHA_1` indicates that the

            key is an asymmetric key that uses the RSA encryption algorithm and uses Optimal Asymmetric Encryption Padding (OAEP).

            `RSA_OAEP_SHA_256` indicates that the key is an asymmetric key that uses the RSA encryption algorithm with a SHA-256 hash

            and uses OAEP.

            '
          enum:
          - AES_256_GCM
          - RSA_OAEP_SHA_1
          - RSA_OAEP_SHA_256
          type: string
        keyId:
          description: The OCID of the key to encrypt with.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: The OCID of the key version used to encrypt the ciphertext.
          maxLength: 255
          minLength: 1
          type: string
        loggingContext:
          additionalProperties:
            type: string
          description: 'Information that provides context for audit logging. You can provide this additional

            data as key-value pairs to include in the audit logs when audit logging is enabled.

            '
          type: object
        plaintext:
          description: The plaintext data to encrypt.
          maxLength: 4096
          minLength: 1
          type: string
      required:
      - keyId
      - plaintext
      type: object
      x-example: "{\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxdee23kueidhj4q2c6qfauxm32i577yu5a\",\n  \"plaintext\": \"aGVsbG8sIHdvcmxk\"\n}\n"
    Error:
      description: The desciption of Error message.
      properties:
        code:
          description: 'A short error code that defines the error, meant for programmatic parsing. See

            [API Errors](/Content/API/References/apierrors.htm).

            '
          type: string
        message:
          description: A human-readable error string.
          type: string
      required:
      - code
      - message
    DecryptDataDetails:
      description: The details of the encrypted data that you want to decrypt.
      properties:
        associatedData:
          additionalProperties:
            type: string
          description: 'Information that can be used to provide an encryption context for the encrypted data.

            The length of the string representation of the associated data must be fewer than 4096 characters.

            '
          type: object
        ciphertext:
          description: The encrypted data to decrypt.
          maxLength: 65536
          minLength: 1
          type: string
        encryptionAlgorithm:
          default: AES_256_GCM
          description: 'The encryption algorithm to use to encrypt or decrypt data with a customer-managed key.

            `AES_256_GCM` indicates that the key is a symmetric key that uses the Advanced Encryption Standard (AES) algorithm and

            that the mode of encryption is the Galois/Counter Mode (GCM). `RSA_OAEP_SHA_1` indicates that the

            key is an asymmetric key that uses the RSA encryption algorithm and uses Optimal Asymmetric Encryption Padding (OAEP).

            `RSA_OAEP_SHA_256` indicates that the key is an asymmetric key that uses the RSA encryption algorithm with a SHA-256 hash

            and uses OAEP.

            '
          enum:
          - AES_256_GCM
          - RSA_OAEP_SHA_1
          - RSA_OAEP_SHA_256
          type: string
        keyId:
          description: The OCID of the key used to encrypt the ciphertext.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: The OCID of the key version used to encrypt the ciphertext.
          maxLength: 255
          minLength: 1
          type: string
        loggingContext:
          additionalProperties:
            type: string
          description: 'Information that provides context for audit logging. You can provide this additional

            data as key-value pairs to include in audit logs when audit logging is enabled.

            '
          type: object
      required:
      - ciphertext
      - keyId
      type: object
    VerifyDataDetails:
      description: The details of the message that you want to verify.
      properties:
        keyId:
          description: The OCID of the key used to sign the message.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: The OCID of the key version used to sign the message.
          maxLength: 255
          minLength: 1
          type: string
        message:
          description: The base64-encoded binary data object denoting the message or message digest to sign. You can have a message up to 4096 bytes in size. To sign a larger message, provide the message digest.
          type: string
        messageType:
          default: RAW
          description: 'Denotes whether the value of the message parameter is a raw message or a message digest.

            The default value, `RAW`, indicates a message. To indicate a message digest, use `DIGEST`.

            '
          enum:
          - RAW
          - DIGEST
          type: string
        signature:
          description: 'The base64-encoded binary data object denoting the cryptographic signature generated for the message.

            '
          type: string
        signingAlgorithm:
          description: 'The algorithm to use to sign the message or message digest.

            For RSA keys, supported signature schemes include PKCS #1 and RSASSA-PSS, along with

            different hashing algorithms.

            For ECDSA keys, ECDSA is the supported signature scheme with different hashing algorithms.

            When you pass a message digest for signing, ensure that you specify the same hashing algorithm

            as used when creating the message digest.

            '
          enum:
          - SHA_224_RSA_PKCS_PSS
          - SHA_256_RSA_PKCS_PSS
          - SHA_384_RSA_PKCS_PSS
          - SHA_512_RSA_PKCS_PSS
          - SHA_224_RSA_PKCS1_V1_5
          - SHA_256_RSA_PKCS1_V1_5
          - SHA_384_RSA_PKCS1_V1_5
          - SHA_512_RSA_PKCS1_V1_5
          - ECDSA_SHA_256
          - ECDSA_SHA_384
          - ECDSA_SHA_512
          type: string
      required:
      - signature
      - message
      - keyId
      - keyVersionId
      - signingAlgorithm
      type: object
    GeneratedKey:
      description: The reponse to the regeuest to generate the key to encrypt or decrypt the data.
      properties:
        ciphertext:
          description: The encrypted data encryption key generated from a master encryption key.
          maxLength: 65536
          minLength: 1
          type: string
        plaintext:
          description: 'The plaintext data encryption key, a base64-encoded sequence of random bytes, which is

            included if the [GenerateDataEncryptionKey](/api/#/en/key/latest/GeneratedKey/GenerateDataEncryptionKey)

            request includes the `includePlaintextKey` parameter and sets its value to "true".

            '
          maxLength: 65536
          minLength: 1
          type: string
        plaintextChecksum:
          description: 'The checksum of the plaintext data encryption key, which is included if the

            [GenerateDataEncryptionKey](/api/#/en/key/latest/GeneratedKey/GenerateDataEncryptionKey)

            request includes the `includePlaintextKey` parameter and sets its value to "true".

            '
          maxLength: 1024
          minLength: 1
          type: string
      required:
      - ciphertext
      type: object
      x-example: "{\n  \"ciphertext\": \"AAwRhavVBkAAAJNF0nE7tBz/CQDanO33toIAWpw/lCn9GuadiyNNZ2QCmeUksvor8HD00o0TiUHzj6IsDJ5z1j/AEXZrhBtEcz4=\",\n  \"plaintext\": \"lqGERnQJYzljUfMITDub/uV5ZbQkvCE906Wg/mflz2s=\",\n  \"plaintextChecksum\": \"1140988275\"\n}\n"
    VerifiedData:
      description: The response to a request to verify the message.
      properties:
        isSignatureValid:
          description: A Boolean value that indicates whether the signature was verified.
          type: boolean
      required:
      - isSignatureValid
      type: object
      x-example: "{\n  \"isSignatureValid\": true\n}\n"
    SignedData:
      description: The response to a request to sign the message.
      properties:
        keyId:
          description: The OCID of the key used to sign the message.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: The OCID of the key version used to sign the message.
          maxLength: 255
          minLength: 1
          type: string
        signature:
          description: 'The base64-encoded binary data object denoting the cryptographic signature generated for the message or message digest.

            '
          type: string
        signingAlgorithm:
          description: 'The algorithm to use to sign the message or message digest.

            For RSA keys, supported signature schemes include PKCS #1 and RSASSA-PSS, along with

            different hashing algorithms.

            For ECDSA keys, ECDSA is the supported signature scheme with different hashing algorithms.

            When you pass a message digest for signing, ensure that you specify the same hashing algorithm

            as used when creating the message digest.

            '
          enum:
          - SHA_224_RSA_PKCS_PSS
          - SHA_256_RSA_PKCS_PSS
          - SHA_384_RSA_PKCS_PSS
          - SHA_512_RSA_PKCS_PSS
          - SHA_224_RSA_PKCS1_V1_5
          - SHA_256_RSA_PKCS1_V1_5
          - SHA_384_RSA_PKCS1_V1_5
          - SHA_512_RSA_PKCS1_V1_5
          - ECDSA_SHA_256
          - ECDSA_SHA_384
          - ECDSA_SHA_512
          type: string
      required:
      - keyId
      - keyVersionId
      - signature
      - signingAlgorithm
      type: object
      x-example: "{\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"keyVersionId\": \"ocid1.keyversion.oc1.iad.exampledaaeug.xd5q23tteidhj4q2c6qfauxm32i577yuamplestkvmbjdnbickxasfaf\",\n  \"signature\": \"\",\n  \"signingAlgorithm\": \"SHA256_RSA_PKCS_PSS\"\n}\n"
    ExportKeyDetails:
      description: The details of the key that you want to wrap and export.
      properties:
        algorithm:
          description: 'The encryption algorithm to use to encrypt exportable key material from a software-backed key. Specifying `RSA_OAEP_AES_SHA256`

            invokes the RSA AES key wrap mechanism, which generates a temporary AES key. The temporary AES key is wrapped by the RSA public

            wrapping key provided along with the request, creating a wrapped temporary AES key. The temporary AES key is also used to wrap

            the exportable key material. The wrapped temporary AES key and the wrapped exportable key material are concatenated, producing

            concatenated blob output that jointly represents them. Specifying `RSA_OAEP_SHA256` means that the software key is wrapped by

            the RSA public wrapping key provided along with the request.

            '
          enum:
          - RSA_OAEP_AES_SHA256
          - RSA_OAEP_SHA256
          type: string
        keyId:
          description: The OCID of the master encryption key associated with the key version you want to export.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: 'The OCID of the specific key version to export. If not specified, the service exports the current key version.

            '
          maxLength: 255
          minLength: 1
          type: string
        loggingContext:
          additionalProperties:
            type: string
          description: 'Information that provides context for audit logging. You can provide this additional

            data as key-value pairs to include in the audit logs when audit logging is enabled.

            '
          type: object
        publicKey:
          description: 'The PEM format of the 2048-bit, 3072-bit, or 4096-bit RSA wrapping key in your possession that you want to use to encrypt the key.

            '
          maxLength: 810
          minLength: 390
          type: string
      required:
      - keyId
      - algorithm
      - publicKey
      type: object
      x-example: "{\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"keyVersionId\": \"ocid1.keyversion.oc1.iad.examplevriiaa.examples4h2bocax3damnsxw4cvbbndged2gftlho4ufxwa4faux2eiqwija\",\n  \"algorithm\": \"RSA_OAEP_AES_SHA256\",\n  \"publicKey\": \"-----BEGIN PUBLIC KEY----- ..... -----END PUBLIC KEY-----\"\n}\n"
    EncryptedData:
      description: The response to a request to encrypt the plaintext data.
      properties:
        ciphertext:
          description: The encrypted data.
          maxLength: 65536
          minLength: 1
          type: string
        encryptionAlgorithm:
          default: AES_256_GCM
          description: 'The encryption algorithm to use to encrypt and decrypt data with a customer-managed key.

            `AES_256_GCM` indicates that the key is a symmetric key that uses the Advanced Encryption Standard (AES) algorithm and

            that the mode of encryption is the Galois/Counter Mode (GCM). `RSA_OAEP_SHA_1` indicates that the

            key is an asymmetric key that uses the RSA encryption algorithm and uses Optimal Asymmetric Encryption Padding (OAEP).

            `RSA_OAEP_SHA_256` indicates that the key is an asymmetric key that uses the RSA encryption algorithm with a SHA-256 hash

            and uses OAEP.

            '
          enum:
          - AES_256_GCM
          - RSA_OAEP_SHA_1
          - RSA_OAEP_SHA_256
          type: string
        keyId:
          description: The OCID of the key used to encrypt the ciphertext.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: The OCID of the key version used to encrypt the ciphertext.
          maxLength: 255
          minLength: 1
          type: string
      required:
      - ciphertext
      type: object
      x-example: "{\n  \"ciphertext\": \"AAwgpauIe9AAAM6dU7pS7AKwmDFyXOqNh0uAvNY9a3E95rw7Ae3LZNBnDtHWdkB1l/pIDBfg\"\n}\n"
    ExportedKeyData:
      description: The response to a request to export key material.
      properties:
        algorithm:
          description: 'The encryption algorithm to use to encrypt exportable key material from a key that persists on the server (as opposed to a key that

            persists on a hardware security module and, therefore, cannot be exported). Specifying RSA_OAEP_AES_SHA256 invokes the RSA AES key

            wrap mechanism, which generates a temporary AES key. The temporary AES key is wrapped by the RSA public wrapping key provided along

            with the request, creating a wrapped temporary AES key. The temporary AES key is also used to wrap the exportable key material. The

            wrapped temporary AES key and the wrapped exportable key material are concatenated, producing concatenated blob output that jointly

            represents them. Specifying RSA_OAEP_SHA256 means that the exportable key material is wrapped by the RSA public wrapping key provided

            along with the request.

            '
          enum:
          - RSA_OAEP_AES_SHA256
          - RSA_OAEP_SHA256
          type: string
        encryptedKey:
          description: 'The base64-encoded exported key material, which is encrypted by using the public RSA wrapping key specified in the export request.

            '
          type: string
        keyId:
          description: The OCID of the master encryption key associated with this key version.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: The OCID of the key version.
          maxLength: 255
          minLength: 1
          type: string
        timeCreated:
          description: 'The date and time this key version was created, expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339) timestamp format.

            '
          example: '2018-04-03T21:10:29.600Z'
          format: date-time
          type: string
        vaultId:
          description: The OCID of the vault that contains this key version.
          maxLength: 255
          minLength: 1
          type: string
      required:
      - keyVersionId
      - timeCreated
      - vaultId
      - encryptedKey
      - keyId
      - algorithm
      type: object
      x-example: "{\n  \"KeyVersionId\": \"ocid1.keyversion.oc1.iad.examplevriiaa.examples4h2bocax3damnsxw4cvbbndged2gftlho4ufxwa4faux2eiqwija\",\n  \"keyId\": \"ocid1.key.oc1.iad.exampledaaeug.examplestkvmbjdnbickxcvbotxd5q23tteidhj4q2c6qfauxm32i577yu5a\",\n  \"timeCreated\": \"2018-04-04T00:33:59.874Z\",\n  \"vaultId\": \"ocid1.vault.oc1.iad.examplevaaeuk.examplettv5i3qbkp22g3cvbjqy7c7sqlywv25eajvnvcfauxpdgga6gct4a\",\n  \"encryptedKey\": \"089d08927390280802d0987c09e7798h09f879870909c098709a709870970987b09709870c987098d70e==\",\n  \"algorithm\": \"RSA_OAEP_AES_SHA256\"\n}\n"
    SignDataDetails:
      description: The details of the message that you want to sign.
      properties:
        keyId:
          description: The OCID of the key used to sign the message.
          maxLength: 255
          minLength: 1
          type: string
        keyVersionId:
          description: The OCID of the key version used to sign the message.
          maxLength: 255
          minLength: 1
          type: string
        loggingContext:
          additionalProperties:
            type: string
          description: 'Information that can be used to provide context for audit logging. It is a map that contains any additional

            data that you provide to include with audit logs, if audit logging is enabled.

            '
          type: object
        message:
          description: The base64-encoded binary data object denoting the message or message digest to sign. You can have a message up to 4096 bytes in size. To sign a larger message, provide the message digest.
          maxLength: 4096
          minLength: 1
          type: string
        messageType:
          default: RAW
          description: 'Denotes whether the value of the message parameter is a raw message or a message digest.

            The default value, `RAW`, indicates a message. To indicate a message digest, use `DIGEST`.

            '
          enum:
          - RAW
          - DIGEST
          type: string
        signingAlgorithm:
          description: 'The algorithm to use to sign the message or message digest.

            For RSA keys, supported signature schemes include PKCS #1 and RSASSA-PSS, along with

            different hashing algorithms.

            For ECDSA keys, ECDSA is the supported signature scheme with different hashing algorithms.

            When you pass a message digest for signing, ensure that you specify the same hashing algorithm

            as used when creating the message digest.

            '
          enum:
          - SHA_224_RSA_PKCS_PSS
          - SHA_256_RSA_PKCS_PSS
          - SHA_384_RSA_PKCS_PSS
          - SHA_512_RSA_PKCS_PSS
          - SHA_224_RSA_PKCS1_V1_5
          - SHA_256_RSA_PKCS1_V1_5
          - SHA_384_RSA_PKCS1_V1_5
          - SHA_512_RSA_PKCS1_V1_5
          - ECDSA_SHA_256
          - ECDSA_SHA_384
          - ECDSA_SHA_512
          type: string
      required:
      - message
      - keyId
      - signingAlgorithm
      type: object
  responses:
    DefaultError:
      description: An error has occurred.
      headers:
        opc-request-id:
          description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about

            a particular request, please provide the request ID.

            '
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  parameters:
    RequestIdHeader:
      description: 'Unique identifier for the request. If provided, the returned request ID

        will include this value. Otherwise, a random request ID will be

        generated by the service.

        '
      in: header
      name: opc-request-id
      required: false
      schema:
        type: string