Cloud Key Management Service (KMS) API

Manages keys and performs cryptographic operations in a central cloud service, for direct use by other cloud resources and applications.

Service: cloudkms.googleapis.com

To call this service, we recommend that you use the Google-provided client libraries. If your application needs to use your own libraries to call this service, use the following information when you make the API requests.

Discovery document

A Discovery Document is a machine-readable specification for describing and consuming REST APIs. It is used to build client libraries, IDE plugins, and other tools that interact with Google APIs. One service may provide multiple discovery documents. This service provides the following discovery document:

Service endpoint

A service endpoint is a base URL that specifies the network address of an API service. One service might have multiple service endpoints. This service has the following service endpoint and all URIs below are relative to this service endpoint:

  • https://cloudkms.googleapis.com

Regional service endpoint

A regional service endpoint is a base URL that specifies the network address of an API service in a single region. A service that is available in multiple regions might have multiple regional endpoints. Select a location to see its regional service endpoint for this service.


REST Resource: v1.folders

Methods
getAutokeyConfig GET /v1/{name=folders/*/autokeyConfig}
Returns the AutokeyConfig for a folder or project.
getKajPolicyConfig GET /v1/{name=folders/*/kajPolicyConfig}
Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.
updateAutokeyConfig PATCH /v1/{autokeyConfig.name=folders/*/autokeyConfig}
Updates the AutokeyConfig for a folder.
updateKajPolicyConfig PATCH /v1/{keyAccessJustificationsPolicyConfig.name=folders/*/kajPolicyConfig}
Updates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.

REST Resource: v1.organizations

Methods
getKajPolicyConfig GET /v1/{name=organizations/*/kajPolicyConfig}
Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.
updateKajPolicyConfig PATCH /v1/{keyAccessJustificationsPolicyConfig.name=organizations/*/kajPolicyConfig}
Updates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.

REST Resource: v1.projects

Methods
getAutokeyConfig GET /v1/{name=projects/*/autokeyConfig}
Returns the AutokeyConfig for a folder or project.
getKajPolicyConfig GET /v1/{name=projects/*/kajPolicyConfig}
Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.
showEffectiveAutokeyConfig GET /v1/{parent=projects/*}:showEffectiveAutokeyConfig
Returns the effective Cloud KMS Autokey configuration for a given project.
showEffectiveKeyAccessJustificationsEnrollmentConfig GET /v1/{project=projects/*}:showEffectiveKeyAccessJustificationsEnrollmentConfig
Returns the KeyAccessJustificationsEnrollmentConfig of the resource closest to the given project in hierarchy.
showEffectiveKeyAccessJustificationsPolicyConfig GET /v1/{project=projects/*}:showEffectiveKeyAccessJustificationsPolicyConfig
Returns the KeyAccessJustificationsPolicyConfig of the resource closest to the given project in hierarchy.
updateAutokeyConfig PATCH /v1/{autokeyConfig.name=projects/*/autokeyConfig}
Updates the AutokeyConfig for a folder.
updateKajPolicyConfig PATCH /v1/{keyAccessJustificationsPolicyConfig.name=projects/*/kajPolicyConfig}
Updates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.

REST Resource: v1.projects.locations

Methods
generateRandomBytes POST /v1/{location=projects/*/locations/*}:generateRandomBytes
Generate random bytes using the Cloud KMS randomness source in the provided location.
get GET /v1/{name=projects/*/locations/*}
Gets information about a location.
getEkmConfig GET /v1/{name=projects/*/locations/*/ekmConfig}
Returns the EkmConfig singleton resource for a given project and location.
list GET /v1/{name=projects/*}/locations
Lists information about the supported locations for this service.
updateEkmConfig PATCH /v1/{ekmConfig.name=projects/*/locations/*/ekmConfig}
Updates the EkmConfig singleton resource for a given project and location.

REST Resource: v1.projects.locations.ekmConfig

Methods
getIamPolicy GET /v1/{resource=projects/*/locations/*/ekmConfig}:getIamPolicy
Gets the access control policy for a resource.
setIamPolicy POST /v1/{resource=projects/*/locations/*/ekmConfig}:setIamPolicy
Sets the access control policy on the specified resource.
testIamPermissions POST /v1/{resource=projects/*/locations/*/ekmConfig}:testIamPermissions
Returns permissions that a caller has on the specified resource.

REST Resource: v1.projects.locations.ekmConnections

Methods
create POST /v1/{parent=projects/*/locations/*}/ekmConnections
Creates a new EkmConnection in a given Project and Location.
get GET /v1/{name=projects/*/locations/*/ekmConnections/*}
Returns metadata for a given EkmConnection.
getIamPolicy GET /v1/{resource=projects/*/locations/*/ekmConnections/*}:getIamPolicy
Gets the access control policy for a resource.
list GET /v1/{parent=projects/*/locations/*}/ekmConnections
Lists EkmConnections.
patch PATCH /v1/{ekmConnection.name=projects/*/locations/*/ekmConnections/*}
Updates an EkmConnection's metadata.
setIamPolicy POST /v1/{resource=projects/*/locations/*/ekmConnections/*}:setIamPolicy
Sets the access control policy on the specified resource.
testIamPermissions POST /v1/{resource=projects/*/locations/*/ekmConnections/*}:testIamPermissions
Returns permissions that a caller has on the specified resource.
verifyConnectivity GET /v1/{name=projects/*/locations/*/ekmConnections/*}:verifyConnectivity
Verifies that Cloud KMS can successfully connect to the external key manager specified by an EkmConnection.

REST Resource: v1.projects.locations.keyHandles

Methods
create POST /v1/{parent=projects/*/locations/*}/keyHandles
Creates a new KeyHandle, triggering the provisioning of a new CryptoKey for CMEK use with the given resource type in the configured key project and the same location.
get GET /v1/{name=projects/*/locations/*/keyHandles/*}
Returns the KeyHandle.
list GET /v1/{parent=projects/*/locations/*}/keyHandles
Lists KeyHandles.

REST Resource: v1.projects.locations.keyRings

Methods
create POST /v1/{parent=projects/*/locations/*}/keyRings
Create a new KeyRing in a given Project and Location.
get GET /v1/{name=projects/*/locations/*/keyRings/*}
Returns metadata for a given KeyRing.
getIamPolicy GET /v1/{resource=projects/*/locations/*/keyRings/*}:getIamPolicy
Gets the access control policy for a resource.
list GET /v1/{parent=projects/*/locations/*}/keyRings
Lists KeyRings.
setIamPolicy POST /v1/{resource=projects/*/locations/*/keyRings/*}:setIamPolicy
Sets the access control policy on the specified resource.
testIamPermissions POST /v1/{resource=projects/*/locations/*/keyRings/*}:testIamPermissions
Returns permissions that a caller has on the specified resource.

REST Resource: v1.projects.locations.keyRings.cryptoKeys

Methods
create POST /v1/{parent=projects/*/locations/*/keyRings/*}/cryptoKeys
Create a new CryptoKey within a KeyRing.
decrypt POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:decrypt
Decrypts data that was protected by Encrypt.
encrypt POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/**}:encrypt
Encrypts data, so that it can only be recovered by a call to Decrypt.
get GET /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}
Returns metadata for a given CryptoKey, as well as its primary CryptoKeyVersion.
getIamPolicy GET /v1/{resource=projects/*/locations/*/keyRings/*/cryptoKeys/*}:getIamPolicy
Gets the access control policy for a resource.
list GET /v1/{parent=projects/*/locations/*/keyRings/*}/cryptoKeys
Lists CryptoKeys.
patch PATCH /v1/{cryptoKey.name=projects/*/locations/*/keyRings/*/cryptoKeys/*}
Update a CryptoKey.
setIamPolicy POST /v1/{resource=projects/*/locations/*/keyRings/*/cryptoKeys/*}:setIamPolicy
Sets the access control policy on the specified resource.
testIamPermissions POST /v1/{resource=projects/*/locations/*/keyRings/*/cryptoKeys/*}:testIamPermissions
Returns permissions that a caller has on the specified resource.
updatePrimaryVersion POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:updatePrimaryVersion
Update the version of a CryptoKey that will be used in Encrypt.

REST Resource: v1.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions

Methods
asymmetricDecrypt POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricDecrypt
Decrypts data that was encrypted with a public key retrieved from GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_DECRYPT.
asymmetricSign POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricSign
Signs data using a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_SIGN, producing a signature that can be verified with the public key retrieved from GetPublicKey.
create POST /v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions
Create a new CryptoKeyVersion in a CryptoKey.
decapsulate POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:decapsulate
Decapsulates data that was encapsulated with a public key retrieved from GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose KEY_ENCAPSULATION.
destroy POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:destroy
Schedule a CryptoKeyVersion for destruction.
get GET /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}
Returns metadata for a given CryptoKeyVersion.
getPublicKey GET /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}/publicKey
Returns the public key for the given CryptoKeyVersion.
import POST /v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions:import
Import wrapped key material into a CryptoKeyVersion.
list GET /v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions
Lists CryptoKeyVersions.
macSign POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:macSign
Signs data using a CryptoKeyVersion with CryptoKey.purpose MAC, producing a tag that can be verified by another source with the same key.
macVerify POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:macVerify
Verifies MAC tag using a CryptoKeyVersion with CryptoKey.purpose MAC, and returns a response that indicates whether or not the verification was successful.
patch PATCH /v1/{cryptoKeyVersion.name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}
Update a CryptoKeyVersion's metadata.
rawDecrypt POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:rawDecrypt
Decrypts data that was originally encrypted using a raw cryptographic mechanism.
rawEncrypt POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:rawEncrypt
Encrypts data using portable cryptographic primitives.
restore POST /v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:restore
Restore a CryptoKeyVersion in the DESTROY_SCHEDULED state.

REST Resource: v1.projects.locations.keyRings.importJobs

Methods
create POST /v1/{parent=projects/*/locations/*/keyRings/*}/importJobs
Create a new ImportJob within a KeyRing.
get GET /v1/{name=projects/*/locations/*/keyRings/*/importJobs/*}
Returns metadata for a given ImportJob.
getIamPolicy GET /v1/{resource=projects/*/locations/*/keyRings/*/importJobs/*}:getIamPolicy
Gets the access control policy for a resource.
list GET /v1/{parent=projects/*/locations/*/keyRings/*}/importJobs
Lists ImportJobs.
setIamPolicy POST /v1/{resource=projects/*/locations/*/keyRings/*/importJobs/*}:setIamPolicy
Sets the access control policy on the specified resource.
testIamPermissions POST /v1/{resource=projects/*/locations/*/keyRings/*/importJobs/*}:testIamPermissions
Returns permissions that a caller has on the specified resource.

REST Resource: v1.projects.locations.operations

Methods
get GET /v1/{name=projects/*/locations/*/operations/*}
Gets the latest state of a long-running operation.