Fortanix Crypto API

openapi: 3.2.0
info:
  title: Fortanix DSM REST Crypto API
  description: "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients. \n- PATCH requests accept a JSON value describing a partial update to the specified resource. All top-level fields in the PATCH request are optional. If an optional field is omitted, the existing value of that field is preserved. In general, for nested JSON objects, the request must provide the complete object value rather than a partial update."
  termsOfService: https://fortanix.com/legal/agreements-and-standard-terms
  contact:
    name: Fortanix Support
    url: https://support.fortanix.com/
    email: support@fortanix.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: 0.1.0-20260710
servers:
- url: '{dsmEndpoint}'
  description: DSM Endpoint
  variables:
    dsmEndpoint:
      default: https://amer.smartkey.io
      description: Type your DSM server URL here (include https://)
tags:
- name: Crypto
paths:
  /crypto/v1/agree:
    post:
      operationId: Agree
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Agree on a key from two other keys.
      description: 'Perform a cryptographic key agreement operation between a public key and a

        private key. Both keys must have been generated from the same parameters (e.g.

        the same elliptic curve). Both keys must allow the AGREEKEY operation. The

        request body contains the requested properties for the new key as well as the

        mechanism (e.g. Diffie-Hellman) to be used to produce the key material for the

        new key. The output of this API should not be used directly as a cryptographic

        key. The target object type should be HMAC or Secret, and a key derivation

        procedure should be used to derive the actual key material.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgreeKeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/keys/batch/decrypt:
    post:
      operationId: BatchDecrypt
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Batch decrypt with one or more keys.
      description: 'The order of batch items in the response matches that of the request.

        returned in the same order. An individual status code is returned

        for each batch item.


        **Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/BatchDecryptRequestItem'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/BatchDecryptResponseItem'
  /crypto/v1/keys/batch/encrypt:
    post:
      operationId: BatchEncrypt
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Batch encrypt with one or more keys.
      description: 'The order of batch items in the response matches that of the request.

        An individual status code is returned for each batch item.


        **Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/BatchEncryptRequestItem'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/BatchEncryptResponseItem'
  /crypto/v1/keys/batch/sign:
    post:
      operationId: BatchSign
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Batch sign with one or more private keys.
      description: 'The order of batch items in the response matches that of the request.

        An individual status code is returned for each batch item.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/SignRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/BatchSignResponseItem'
  /crypto/v1/keys/batch/verify:
    post:
      operationId: BatchVerify
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Batch verify with one or more public keys.
      description: 'The order of batch items in the response matches that of the request.

        An individual status code is returned for each batch item.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/VerifyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/BatchVerifyResponseItem'
  /crypto/v1/digest:
    post:
      operationId: CreateDigest
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Compute digest (hash) of data.
      description: Compute digest (hash) of data.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DigestRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DigestResponse'
  /crypto/v1/decapsulate:
    post:
      operationId: Decapsulate
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Decrypt an encapsulated key with this Sobject, obtaining a new

        symmetric key in the target group.'
      description: 'Decrypt an encapsulated key with this Sobject, obtaining a new

        symmetric key in the target group.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DecapsulateKeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/decrypt:
    post:
      operationId: Decrypt
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Decrypt data using a symmetric or asymmetric key.
      description: 'For symmetric ciphers, `mode` (the block cipher mode) is a required field.

        For GCM and CCM modes, `tag_len` is a required field.

        `iv` is required for symmetric ciphers and unused for asymmetric ciphers.

        If the mode requires one, the request must contain the initialization vector

        used when the data was encrypted.

        Objects of type Opaque, EC, or HMAC may not be used with this API.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DecryptRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DecryptResponse'
  /crypto/v1/decrypt/final:
    post:
      operationId: DecryptFinal
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Conclude multi-part decryption. See `/crypto/v1/decrypt/init` for

        more details.'
      description: 'Conclude multi-part decryption. See `/crypto/v1/decrypt/init` for

        more details.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DecryptFinalRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DecryptFinalResponse'
  /crypto/v1/decrypt/init:
    post:
      operationId: DecryptInit
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Begin multi-part decryption.
      description: 'This API is used when decrypting more data than the client wishes

        to submit in a single request. It supports only symmetric ciphers

        and CBC, CBCNOPAD, CTR, and GCM modes of operation. To perform

        multi-part decryption, the client makes one request to the `init`

        resource, zero or more requests to the `update` resource, followed

        by one request to the `final` resource. The response to init and

        update requests includes a `state` field. The `state` is an opaque

        data blob that must be supplied unmodified by the client with each

        subsequent request.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DecryptInitRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DecryptInitResponse'
  /crypto/v1/decrypt/update:
    post:
      operationId: DecryptUpdate
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Continue multi-part decryption. See `/crypto/v1/decrypt/init` for

        more details.'
      description: 'Continue multi-part decryption. See `/crypto/v1/decrypt/init` for

        more details.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DecryptUpdateRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DecryptUpdateResponse'
  /crypto/v1/derive:
    post:
      operationId: Derive
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Derive a new key from an existing key.
      description: 'The request body contains the requested properties for the new key

        as well as the mechanism to be used to produce the key material for

        the new key.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeriveKeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/encapsulate:
    post:
      operationId: Encapsulate
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Obtain a new symmetric key and its encapsulated version from this Sobject.
      description: 'The resulting symmetric key is created as a new Sobject in the given

        group. The details of this Sobject along with the ciphertext encapsulating the

        symmetric key are returned in the response.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EncapsulateKeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EncapsulateKeyResponse'
  /crypto/v1/encrypt:
    post:
      operationId: Encrypt
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Encrypt data using a symmetric or asymmetric key.
      description: 'For symmetric ciphers, `mode` (the block cipher mode) is a required field.

        For GCM and CCM modes, `tag_len` is a required field.

        `iv` is optional for symmetric ciphers and unused for asymmetric ciphers. If

        provided, it will be used as the cipher initialization vector. The length of

        `iv` must match the initialization vector size for the cipher and mode. If not

        provided, a random iv of the correct length is created and returned in the

        response.

        Objects of type Opaque, EC, or HMAC may not be used with this API.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EncryptRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EncryptResponse'
  /crypto/v1/encrypt/final:
    post:
      operationId: EncryptFinal
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Conclude multi-part encryption. See `/crypto/v1/encrypt/init`

        for more details.'
      description: 'Conclude multi-part encryption. See `/crypto/v1/encrypt/init`

        for more details.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EncryptFinalRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EncryptFinalResponse'
  /crypto/v1/encrypt/init:
    post:
      operationId: EncryptInit
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Begin multi-part encryption.
      description: 'This API is used when encrypting more data than the client wishes

        to submit in a single request. It supports only symmetric ciphers

        and CBC, CBCNOPAD, CTR, and GCM modes of operation. To perform

        multi-part encryption, the client makes one request to the `init`

        resource, zero or more requests to the `update` resource, followed

        by one request to the `final` resource. The response to init and

        update requests includes a `state` field. The `state` is an opaque

        data blob that must be supplied unmodified by the client with each

        subsequent request.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EncryptInitRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EncryptInitResponse'
  /crypto/v1/encrypt/update:
    post:
      operationId: EncryptUpdate
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Continue multi-part encryption. See `/crypto/v1/encrypt/init`

        for more details.'
      description: 'Continue multi-part encryption. See `/crypto/v1/encrypt/init`

        for more details.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EncryptUpdateRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EncryptUpdateResponse'
  /crypto/v1/mac:
    post:
      operationId: Mac
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Compute a message authentication code (HMAC or CMAC). The key being used

        should have the `MACGENERATE` key operation.'
      description: 'A key of type `HMAC` needs to be used for computing an HMAC, and the hash

        algorithm should be present in the request.


        AES, ARIA, DES3, and SEED keys can be used for computing a CMAC. No hash

        algorithm should be specified for CMAC computation.

        The digest algorithm shouldn''t be specified in case of CMAC.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MacRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MacResponse'
  /crypto/v1/macverify:
    post:
      operationId: MacVerify
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Verify the input MAC. The key used must have the `MACVERIFY`

        key operation.'
      description: 'Verify the input MAC. The key used must have the `MACVERIFY`

        key operation.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyMacRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyResponse'
  /crypto/v1/sign:
    post:
      operationId: Sign
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Sign with a private key. The key must be asymmetric and have the `SIGN`

        key operation enabled.'
      description: 'Note: Signing prehashed data with LMS keys


        When creating an LMS signature, the first step is to hash the message

        with a prefix that is unknown to the caller (see RFC8554, algorithm 3).

        As the caller cannot precompute this value, DSM follows different

        semantics for prehashed data. Namely, when the hash field is used, DSM

        will check the length of the digest and then feed it as raw data for the

        LMS signature generation.


        Consequently, if you hash your data using an algorithm such as SHA256

        and then supply this digest to the LMS signing API (putting prehashed

        data in the `hash` field), DSM interprets the provided digest as raw

        data, and verification of the signature should be conducted accordingly.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignResponse'
  /crypto/v1/transform:
    post:
      operationId: Transform
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Transform an existing key into a new one.
      description: 'Some protocols (such as BIP32) require weak forms of key derivation,

        where the resulting key can be used to recompute the original key.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TransformKeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/unwrapkey:
    post:
      operationId: Unwrap
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Unwrap a security object with another security object.
      description: 'Unwrap (decrypt) a wrapped key and import it into DSM. This allows one to

        securely import security objects into DSM that were previously wrapped by

        DSM or another key management system. A new security object will be created

        in DSM with the unwrapped data.

        The wrapping key must have the `UNWRAPKEY` operation enabled.

        The `obj_type` parameter specifies the object type of the security object being

        unwrapped.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UnwrapKeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/verify:
    post:
      operationId: Verify
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Verify a signature with a public key. The verifying key must be an

        asymmetric key with the `VERIFY` key operation enabled.'
      description: 'Note on using LMS key: See documentation of the /crypto/v1/sign API.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyResponse'
  /crypto/v1/wrapkey:
    post:
      operationId: Wrap
      tags:
      - Crypto
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Wrap a security object with another security object.
      description: 'Wrap (encrypt) an existing security object with a key. This allows keys to be

        securely exported from DSM so they can be later imported into DSM or

        another key management system.

        The key being wrapped must have the `EXPORT` operation enabled. The wrapping key

        must have the `WRAPKEY` operation enabled.


        The following wrapping operations are supported:

        * Symmetric keys, HMAC keys, opaque objects, and secret objects may be wrapped

        with symmetric or asymmetric keys.

        * Asymmetric keys may be wrapped with symmetric keys. Wrapping an asymmetric

        key with an asymmetric key is not supported.

        When wrapping with an asymmetric key, the wrapped object size must fit as

        plaintext for the wrapping key size and algorithm.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WrapKeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WrapKeyResponse'
components:
  schemas:
    FpeDate:
      description: 'A structure for specifying a token part representing a date that occurs after a specified date

        and/or occurs before a specified date. Depending on the subparts that make up the date, one of

        the three options is used.'
      oneOf:
      - title: FpeDateVariantDayMonthYear
        type: object
        properties:
          dmy_date:
            $ref: '#/components/schemas/FpeDateDayMonthYear'
        required:
        - dmy_date
      - title: FpeDateVariantMonthDay
        type: object
        properties:
          month_day_date:
            $ref: '#/components/schemas/FpeDateMonthDay'
        required:
        - month_day_date
      - title: FpeDateVariantMonthYear
        type: object
        properties:
          month_year_date:
            $ref: '#/components/schemas/FpeDateMonthYear'
        required:
        - month_year_date
    EffectiveKeyOperations:
      description: "Operations allowed to be performed on a given key by a given User or an app\n\n\n\n          SIGN:\n            If this is set, the key can be used for signing.\n\n\n          VERIFY:\n            If this is set, the key can used for verifying a signature.\n\n\n          ENCRYPT:\n            If this is set, the key can be used for encryption.\n\n\n          DECRYPT:\n            If this is set, the key can be used for decryption.\n\n\n          WRAPKEY:\n            If this is set, the key can be used wrapping other keys.\n            The key being wrapped must have the EXPORT operation enabled.\n\n\n          UNWRAPKEY:\n            If this is set, the key can be used to unwrap a wrapped key.\n\n\n          DERIVEKEY:\n            If this is set, the key can be used to derive another key.\n\n\n          TRANSFORM:\n            If this is set, the key can be transformed.\n\n\n          MACGENERATE:\n            If this is set, the key can be used to compute a cryptographic\n            Message Authentication Code (MAC) on a message.\n\n\n          MACVERIFY:\n            If they is set, the key can be used to verify a MAC.\n\n\n          EXPORT:\n            If this is set, the value of the key can be retrieved\n            with an authenticated request. This shouldn't be set unless\n            required. It is more secure to keep the key's value inside DSM only.\n\n\n          APPMANAGEABLE:\n            Without this operation, management operations like delete, destroy,\n            rotate, activate, restore, revoke, revert, update, remove_private, etc.\n            cannot be performed by a crypto App.\n            A user with access or admin app can still perform these operations.\n            This option is only relevant for crypto apps.\n\n\n          HIGHVOLUME:\n            If this is set, audit logs will not be recorded for the key.\n            High volume here tries to signify a key that is being used a lot\n            and will produce lots of logs. Setting this operation disables\n            audit logs for the key.\n\n\n          AGREEKEY:\n            If this is set, the key can be used for key agreement.\n            Both the private and public key should have this option enabled\n            to perform an agree operation.\n\n\n          ENCAPSULATE:\n            If this is set, the key can be used for key encapsulation. The\n            result is a new symmetric key and a ciphertext.\n\n\n          DECAPSULATE:\n            If this is set, the key can be used for key decapsulation. If\n            decapsulation succeeds, the result is a new symmetric key.\n\n\n          MASKDECRYPT:\n            If this is set, the key can be used for masked decryption only.\n\n"
      type: string
      enum:
      - SIGN
      - VERIFY
      - ENCRYPT
      - DECRYPT
      - WRAPKEY
      - UNWRAPKEY
      - DERIVEKEY
      - TRANSFORM
      - MACGENERATE
      - MACVERIFY
      - EXPORT
      - APPMANAGEABLE
      - HIGHVOLUME
      - AGREEKEY
      - ENCAPSULATE
      - DECAPSULATE
      - MASKDECRYPT
    ExternalKmsInfoVariantOci:
      allOf:
      - type: object
        properties:
          type:
            type: string
            enum:
            - Oci
        required:
        - type
      - $ref: '#/components/schemas/OciVaultInfo'
    DecryptFinalRequest:
      allOf:
      - type: object
        description: Request body to finalize a multi-part decryption.
        properties:
          key:
            $ref: '#/components/schemas/SobjectDescriptor'
          state:
            type: string
            format: byte
            description: Current state of the encrypted cipher
          tag:
            type: string
            format: byte
            description: Tag value of the encrypted cipher. Only applicable when using GCM mode.
        required:
        - state
    Mgf:
      description: Specifies the Mask Generating Function (MGF) to use.
      oneOf:
      - title: MgfVariantMgf1
        type: object
        properties:
          mgf1:
            $ref: '#/components/schemas/MgfMgf1'
        required:
        - mgf1
    KeyCreationMethodVariantUnwrap:
      allOf:
      - type: object
        properties:
          method:
            type: string
            enum:
            - Unwrap
        required:
        - method
      - type: object
        properties: {}
    RsaEncryptionPaddingOaep:
      allOf:
      - type: object
        description: Optimal Asymmetric Encryption Padding (PKCS#1 v2.1).
        properties:
          mgf:
            $ref: '#/components/schemas/Mgf'
        required:
        - mgf
    FpeDataPart:
      description: Structure for specifying (part of) a complex tokenization data type.
      oneOf:
      - $ref: '#/components/schemas/FpeEncryptedPart'
      - $ref: '#/components/schemas/FpeDataPartLiteral'
      - $ref: '#/components/schemas/FpeCompoundPart'
    PublishPublicKeyConfigEnabled:
      allOf:
      - type: object
        properties:
          list_previous_version:
            type: boolean
            description: Additionally list the previous version of the key if not compromised.
        required:
        - list_previous_version
    DecryptInitResponse:
      allOf:
      - type: object
        description: Response body for initializing multi-part decryption.
        properties:
          kid:
            type:
            - string
            - 'null'
            format: uuid
            description: The key id is returned for non-transient keys.
          state:
            type: string
            format: byte
            description: Opaque data, not to be interpreted or modified by the client and must be provided with next request.
        required:
        - state
    GoogleAccessReason:
      description: An access reason provided by Google when making EKMS API calls.
      type: string
      enum:
      - REASON_UNSPECIFIED
      - CUSTOMER_INITIATED_SUPPORT
      - GOOGLE_INITIATED_SERVICE
      - THIRD_PARTY_DATA_REQUEST
      - GOOGLE_INITIATED_REVIEW
      - CUSTOMER_INITIATED_ACCESS
      - GOOGLE_INITIATED_SYSTEM_OPERATION
      - REASON_NOT_EXPECTED
      - MODIFIED_CUSTOMER_INITIATED_ACCESS
      - MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION
      - GOOGLE_RESPONSE_TO_PRODUCTION_ALERT
      - CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING
    BatchDecryptRequestItem:
      allOf:
      - type: object
        description: 'Request body of each item in batch decryption


          **Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.'
        properties:
          kid:
            type: string
            format: uuid
            description: UUID of the sobject
          request:
            $ref: '#/components/schemas/DecryptRequest'
        required:
        - kid
        - request
    Slip10Options:
      allOf:
      - type: object
        properties:
          derivation_path:
            type: array
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
            description: 'The Slip10 path, starting from master. Master key is [].


              Ex: m/42/42''/0 -> [42, 2**31 + 42, 0]'
        required:
        - derivation_path
    BatchDecryptResponseItem:
      oneOf:
      - title: BatchDecryptResponseItemSuccess
        type: object
        properties:
          status:
            type: integer
          body:
            $ref: '#/components/schemas/DecryptResponse'
      - title: BatchDecryptResponseItemError
        type: object
  

# --- truncated at 32 KB (156 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/fortanix/refs/heads/main/openapi/fortanix-crypto-api-openapi.yml