Cloud Key Management Service (KMS) API API

by googleapis.com

Overview

Manages keys and performs cryptographic operations in a central cloud service, for direct use by other cloud resources and applications.

Cloud Key Management Service (KMS) API is an analytics API from googleapis.com. Requests are authenticated with OAuth. It is served over HTTPS. Its OpenAPI description documents 29 endpoints.

At a glance

Authentication: OAuth
HTTPS: Yes
CORS: Unknown
Category: Analytics
Base URL: https://cloudkms.googleapis.com/
Version: v1
Endpoints: 29
OpenAPI: Specification ↗
Spec updated: 2023-04-21

Make a first request

Replace the placeholders; the documentation says exactly where credentials go.

cURL

curl -X GET "https://cloudkms.googleapis.com/v1/NAME" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN"

JavaScript

const response = await fetch("https://cloudkms.googleapis.com/v1/NAME", {
  method: "GET",
  headers: {
    "Accept": "application/json",
    "Authorization": "Bearer YOUR_TOKEN",
  },
});
const data = await response.json();
console.log(data);

Python

import requests

response = requests.request(
    "GET",
    "https://cloudkms.googleapis.com/v1/NAME",
    headers={
    "Accept": "application/json",
    "Authorization": "Bearer YOUR_TOKEN",
    },
    timeout=30,
)
print(response.json())

Endpoints

Method	Path	What it does
POST	`/v1/{location}:generateRandomBytes`	Generate random bytes using the Cloud KMS randomness source in the provided location.
GET	`/v1/{name}`	Returns metadata for a given ImportJob.
PATCH	`/v1/{name}`	Update a CryptoKeyVersion's metadata. state may be changed between ENABLED and DISABLED using this method. See DestroyCryptoKeyVersion and RestoreCryptoKeyVersi
GET	`/v1/{name}/locations`	Lists information about the supported locations for this service.
GET	`/v1/{name}/publicKey`	Returns the public key for the given CryptoKeyVersion. The CryptoKey.purpose must be ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT.
POST	`/v1/{name}:asymmetricDecrypt`	Decrypts data that was encrypted with a public key retrieved from GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_DECRYPT.
POST	`/v1/{name}:asymmetricSign`	Signs data using a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_SIGN, producing a signature that can be verified with the public key retrieved from GetPub
POST	`/v1/{name}:decrypt`	Decrypts data that was protected by Encrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.
POST	`/v1/{name}:destroy`	Schedule a CryptoKeyVersion for destruction. Upon calling this method, CryptoKeyVersion.state will be set to DESTROY_SCHEDULED, and destroy_time will be set to
POST	`/v1/{name}:encrypt`	Encrypts data, so that it can only be recovered by a call to Decrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.
POST	`/v1/{name}:macSign`	Signs data using a CryptoKeyVersion with CryptoKey.purpose MAC, producing a tag that can be verified by another source with the same key.
POST	`/v1/{name}:macVerify`	Verifies MAC tag using a CryptoKeyVersion with CryptoKey.purpose MAC, and returns a response that indicates whether or not the verification was successful.
POST	`/v1/{name}:restore`	Restore a CryptoKeyVersion in the DESTROY_SCHEDULED state. Upon restoration of the CryptoKeyVersion, state will be set to DISABLED, and destroy_time will be cle
POST	`/v1/{name}:updatePrimaryVersion`	Update the version of a CryptoKey that will be used in Encrypt. Returns an error if called on a key whose purpose is not ENCRYPT_DECRYPT.
GET	`/v1/{name}:verifyConnectivity`	Verifies that Cloud KMS can successfully connect to the external key manager specified by an EkmConnection. If there is an error connecting to the EKM, this met
GET	`/v1/{parent}/cryptoKeyVersions`	Lists CryptoKeyVersions.
POST	`/v1/{parent}/cryptoKeyVersions`	Create a new CryptoKeyVersion in a CryptoKey. The server will assign the next sequential id. If unset, state will be set to ENABLED.
POST	`/v1/{parent}/cryptoKeyVersions:import`	Import wrapped key material into a CryptoKeyVersion. All requests must specify a CryptoKey. If a CryptoKeyVersion is additionally specified in the request, key
GET	`/v1/{parent}/cryptoKeys`	Lists CryptoKeys.
POST	`/v1/{parent}/cryptoKeys`	Create a new CryptoKey within a KeyRing. CryptoKey.purpose and CryptoKey.version_template.algorithm are required.
GET	`/v1/{parent}/ekmConnections`	Lists EkmConnections.
POST	`/v1/{parent}/ekmConnections`	Creates a new EkmConnection in a given Project and Location.
GET	`/v1/{parent}/importJobs`	Lists ImportJobs.
POST	`/v1/{parent}/importJobs`	Create a new ImportJob within a KeyRing. ImportJob.import_method is required.
GET	`/v1/{parent}/keyRings`	Lists KeyRings.
POST	`/v1/{parent}/keyRings`	Create a new KeyRing in a given Project and Location.
GET	`/v1/{resource}:getIamPolicy`	Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
POST	`/v1/{resource}:setIamPolicy`	Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` erro
POST	`/v1/{resource}:testIamPermissions`	Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND`

Questions

Does the Cloud Key Management Service (KMS) API API need an API key?

Yes. The Cloud Key Management Service (KMS) API API uses OAuth authentication; the documentation explains how to get credentials.

Does the Cloud Key Management Service (KMS) API API support HTTPS?

Yes, the Cloud Key Management Service (KMS) API API is served over HTTPS.

How many endpoints does the Cloud Key Management Service (KMS) API API have?

Its OpenAPI description lists 29 endpoints in version v1. All of them are shown on this page.

What are alternatives to the Cloud Key Management Service (KMS) API API?

Other Analytics APIs include Google Play Integrity API, versionhistory.googleapis.com API, Doc Converter, Perspective Comment Analyzer API, Safe Browsing API.

Compare alternatives →

Google Play Integrity API

Analytics

The Play Integrity API helps you check that you're interacting with your genuine app on a genuine Android device powered by Google Play services. The Play Integrity API has replaced SafetyNet Attestation and Android Device Verification.

OAuth1 endpoints

versionhistory.googleapis.com API

Analytics

Version History API - Prod

No auth4 endpoints

Doc Converter

Analytics

This api converts file formats of OpenXml and OpenOffice documents formats to vector files (e.g., svg)

No auth1 endpoints

Perspective Comment Analyzer API

Analytics

The Perspective Comment Analyzer API provides information about the potential impact of a comment on a conversation (e.g. it can provide a score for the "toxicity" of a comment). Users can leverage the "SuggestCommentScore" method to submit corrections to improve Perspective over time. Users can set the "doNotStore" flag to ensure that all submitted comments are automatically deleted after scores are returned.

OAuth2 endpoints

Safe Browsing API

Analytics

Enables client applications to check web resources (most commonly URLs) against Google-generated lists of unsafe web resources. The Safe Browsing APIs are for non-commercial use only. If you need to use APIs to detect malicious URLs for commercial purposes – meaning “for sale or revenue-generating purposes” – please refer to the Web Risk API.

No auth7 endpoints

Web Fonts Developer API

Analytics

The Google Web Fonts Developer API lets you retrieve information about web fonts served by Google.

No auth1 endpoints

Listed from APIs.guru (CC0).

Overview

At a glance

Make a first request

Endpoints

Questions

Similar analytics APIs

Google Play Integrity API

versionhistory.googleapis.com API

Doc Converter

Perspective Comment Analyzer API

Safe Browsing API

Web Fonts Developer API