Skip to main content
POST
Generate Data Key

Authorizations

Authorization
string
header
required

The Authorization header expects a Bearer token.

Body

application/json
dataKeySpec
enum<string>
default:SYMMETRIC_ALGORITHM_UNSPECIFIED
required

Supported symmetric encryption algorithms.

  • AES_128: Deprecated. It is impossible to create new keys with this algorithm. AES algorithm with 128-bit keys.
  • AES_256: AES algorithm with 256-bit keys.
Available options:
SYMMETRIC_ALGORITHM_UNSPECIFIED,
AES_128,
AES_256
keyId
string
required

ID of the symmetric KMS key that the generated data key should be encrypted with.

aadContext
string<byte>

Additional authenticated data (AAD context), optional. If specified, this data will be required for decryption with the [SymmetricDecryptRequest]. Should be encoded with base64.

skipPlaintext
boolean

If true, the method won't return the data key as plaintext. Default value is false.

Response

200 - application/json

A successful response.

dataKeyCiphertext
string<byte>

The encrypted data key.

dataKeyPlaintext
string<byte>

Generated data key as plaintext. The field is empty, if the [GenerateDataKeyRequest.skip_plaintext] parameter was set to true.

keyId
string

ID of the symmetric KMS key that was used to encrypt the generated data key.