Fortanix Keys API

openapi: 3.2.0
info:
  title: Fortanix DSM REST Keys API
  description: "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients. \n- PATCH requests accept a JSON value describing a partial update to the specified resource. All top-level fields in the PATCH request are optional. If an optional field is omitted, the existing value of that field is preserved. In general, for nested JSON objects, the request must provide the complete object value rather than a partial update."
  termsOfService: https://fortanix.com/legal/agreements-and-standard-terms
  contact:
    name: Fortanix Support
    url: https://support.fortanix.com/
    email: support@fortanix.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: 0.1.0-20260710
servers:
- url: '{dsmEndpoint}'
  description: DSM Endpoint
  variables:
    dsmEndpoint:
      default: https://amer.smartkey.io
      description: Type your DSM server URL here (include https://)
tags:
- name: Keys
paths:
  /crypto/v1/keys/{key_id}/activate:
    post:
      operationId: ActivateSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Transition a security object to Active state.
      description: Transition a security object to Active state.
      parameters:
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
  /crypto/v1/keys/copy:
    post:
      operationId: CopySobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Make a copy of a security object.
      description: 'A new key will be created in the target group and will have the

        same key material as the original key. Links will be maintained

        between all copied keys and the source key.

        If the key is being copied to an externally linked group, it needs

        to be exportable.


        This can also be used to rotate an external key by copying the

        key material from a native DSM key. This key material will then

        finally be imported into the external KMS.

        For AWS KMS keys, after the rotation, the new key will have the

        original aliases and the old key''s aliases will have

        (rotated at <timestamp>) appended in front of it.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CopySobjectRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/keys:
    post:
      operationId: CreateSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Generate a new security object.
      description: 'Generate a new security object (such as an RSA key pair or an AES key)

        of the requested size, elliptic curve, etc.


        By default, all key operations except for EXPORT that are implemented

        for that type of key will be enabled. These may be overridden by

        requesting specific operations in the key creation request.


        Objects of type Secret/Opaque may not be generated with this API.

        They must be imported via the import API.


        For AWS/Azure/GCP KMS keys, this generates the key material in the external KMS and a

        corresponding virtual key is created in DSM. EC and RSA keys are supported for Azure

        while only 256-bit AES keys are supported for AWS and GCP.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SobjectRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
    put:
      operationId: ImportSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Import a security object.
      description: 'By default, all key operations that are implemented for that type of

        key will be enabled. These may be overridden by requesting specific

        operations in the key import request.


        For symmetric and asymmetric keys, value is base64-encoding of the

        key material in DER format.


        For AWS/Azure/GCP KMS keys, this imports the key material provided into the

        external KMS and a corresponding virtual key is created in DSM.

        EC and RSA keys are supported for Azure while only 256-bit AES

        keys are supported for AWS and GCP.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SobjectRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
    get:
      operationId: ListSobjects
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get all security objects accessible to the requester.
      description: Get all security objects accessible to the requester.
      parameters:
      - $ref: '#/components/parameters/ListSobjectsParams'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListSobjectsResponse'
  /crypto/v1/keys/{key_id}:
    delete:
      operationId: DeleteSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Delete the specified security object.
      description: Delete the specified security object.
      parameters:
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
    patch:
      operationId: UpdateSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Update the properties of a security object like

        name, description, etc.'
      description: 'Update the properties of a security object like

        name, description, etc.'
      parameters:
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SobjectRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/keys/{key_id}/destroy:
    post:
      operationId: DestroySobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Transition a security object to Destroyed state. Objects in the

        `Destroyed` state cannot be used in any cryptographic operation.

        Their metadata however, remains accessible.'
      description: 'Transition a security object to Destroyed state. Objects in the

        `Destroyed` state cannot be used in any cryptographic operation.

        Their metadata however, remains accessible.'
      parameters:
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
  /crypto/v1/keys/digest:
    post:
      operationId: DigestSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Retrieve the digest (hash) of the value of an exportable security object.
      description: Retrieve the digest (hash) of the value of an exportable security object.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ObjectDigestRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObjectDigestResponse'
  /crypto/v1/keys/export:
    post:
      operationId: ExportSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get the details and value of a particular exportable security object.
      description: Get the details and value of a particular exportable security object.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SobjectDescriptor'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/keys/components/export:
    post:
      operationId: ExportSobjectComponents
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Exports the security object as components.
      description: 'Exports the security object as components. This API can only be called

        through an approval request and won''t work if called directly. This

        requires a key custodian policy and quorum approval policy to be set at

        the group level. A new approval request needs to be created (see

        `POST /sys/v1/approval_requests`), then after getting the required approvals,

        the key custodians can fetch the result of this approval request

        (See `POST /sys/v1/approval_requests/:req_id/result`).

        Each key custodian will be able to get only their component.


        Only AES, DES, DES3 & HMAC objects are exportable by components.


        This is described in detail in the following article:

        https://support.fortanix.com/hc/en-us/articles/360043559332-User-s-Guide-Key-Components'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExportSobjectComponentsRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExportComponentsResponse'
  /crypto/v1/keys/kcv:
    post:
      operationId: GetKcv
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Computes the KCV of the input and returns. This is

        only valid for AES, DES & DES3 keys.'
      description: 'Computes the KCV of the input and returns. This is

        only valid for AES, DES & DES3 keys.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/KeyCheckValueRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/KeyCheckValueResponse'
  /crypto/v1/keys/key_attestation:
    post:
      operationId: GetKeyAttestation
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Retrieve a key attestation certificate for a security object.
      description: 'If the cluster is capable of key attestation, and requested security

        object supports key attestation (currently only RSA or EC keys that have

        their private key component), a key attestation is returned.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/KeyAttestationRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/KeyAttestationResponse'
  /crypto/v1/pubkey/{acct_id}/{name}:
    get:
      operationId: GetPubkey
      tags:
      - Keys
      summary: Get public part of an asymmetric key.
      description: 'Returns the public part of an asymmetric key. This needs

        account id and key name as input. No auth is required for this.

        This works with RSA, EC and Certificate objects.'
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: name
        in: path
        required: true
        schema:
          type: string
          maxLength: 4096
          pattern: ^[^\n]*[^\s\n][^\n]*$
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                  format: byte
  /crypto/v1/keys/info:
    post:
      operationId: GetSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Lookup a security object.
      description: Lookup a security object.
      parameters:
      - $ref: '#/components/parameters/GetSobjectParams'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SobjectDescriptor'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/keys/components/import:
    post:
      operationId: ImportSobjectByComponents
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Import a security object by components.
      description: 'Import a security object by components. This API can only be called

        through an approval request and won''t work if called directly. A key

        custodian and quorum policy needs to be set at the group level. After

        an import by components request has been made, key custodians will

        need to add their respective component via

        `POST /sys/v1/approval_requests/:req_id/approve`.


        Only AES, DES, DES3 & HMAC objects are importable by components.


        This is described in detail in the following article:

        https://support.fortanix.com/hc/en-us/articles/360043559332-User-s-Guide-Key-Components'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ImportSobjectComponentsRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/keys/persist:
    post:
      operationId: PersistTransientKey
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Persist a transient key.
      description: 'This API copies a transient key as a persisted security

        object. If the transient key''s origin is "FortanixHSM",

        the origin of the persisted key will be "Transient". If the

        transient key''s origin is "External", the origin of the persisted

        key will be "External".'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersistTransientKeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/keys/{key_id}/private:
    delete:
      operationId: RemovePrivate
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Destroy private half of an asymmetric key.
      description: 'Removes the private portion of an asymmetric key. After this

        operation is performed, operations that require the private key, such

        as encryption and generating signatures, can no longer be performed.'
      parameters:
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
  /crypto/v1/keys/replace:
    post:
      operationId: ReplaceSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Rotate a security object to an existing security object.
      description: 'For two keys R and S, where R is the key to be replaced,

        and S is the intended replacement, this operation will

        - Rename R to the name provided in the request

        - Establish an replaced-replacement between R and S

        - Assign R''s old name to S

        The metadata of S should be mostly same as that of R, and

        it is not possible to update any fields of S while

        performing this operation. If S does not have any custom

        metadata or a rotation policy, any corresponding values

        from R will be copied over to S.

        For now, this operation is not supported if R, S, or both

        are externally-backed keys.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SobjectReplaceRequest'
      responses:
        '204':
          description: Nothing is returned on success
  /crypto/v1/keys/{key_id}/revert:
    put:
      operationId: RevertPrevKeyOp
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Reverts a security object to a previous state.
      description: 'When a Key Undo Policy is in place, security objects maintain a list

        of history states. Using this API endpoint, clients may revert the

        security object to a previous (non-expired) history state.'
      parameters:
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevertRequest'
      responses:
        '204':
          description: Nothing is returned on success
  /crypto/v1/keys/{key_id}/revoke:
    post:
      operationId: RevokeSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Transition a security object to Deactivated or Compromised state.
      description: Transition a security object to Deactivated or Compromised state.
      parameters:
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevocationReason'
      responses:
        '204':
          description: Nothing is returned on success
  /crypto/v1/keys/rekey:
    post:
      operationId: RotateSobject
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Rotate a security object.
      description: 'Renames current key to "<current_name> (rotated at <timestamp>)"

        and generates a new key with the original name of the source key.

        The metadata of the newly generated key is mostly same as original

        key and it is possible to update the following fields while performing

        rotation: `activation_date`, `deactivation_date`, `state`, `rsa`,

        `aes`, `aria`, `des`, `des3`, `seed`, `dsa`, `kcdsa`, `eckcdsa`,

        `pub_exponent`, `elliptic_curve`, `key_size`, `key_ops`, `description`,

        `enabled`, `custom_metadata`, `publish_public_key`, `rotation_policy`.


        If the key is an external key, additional changes

        might happen (like changes to aws-alias custom_metadata, etc).

        (yet to be documented)


        For AWS KMS keys, a new key is generated in the external KMS and

        after the rotation, the new key will have the original aliases and the old

        key''s aliases will have (rotated at <timestamp>) appended in front of it.

        For Azure KV and GCP KMS keys, this creates a new version of the target key.


        For Tokenization Keys `fpe` subobject should be null or

        excluded to allow existing fpe policy to be copied to the new key.


        **Note:** Key rotation requires that Encryption calls be made using Key name and

        the corresponding returned Key UUID be stored with the encrypted value.


        If the encrypting key UUID is lost, then the encrypted data can no longer

        reliably be decrypted after the key is rotated.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SobjectRekeyRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Sobject'
  /crypto/v1/keys/kcv/verify:
    post:
      operationId: VerifyKcv
      tags:
      - Keys
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Computes the KCV of the input blob and checks if

        it matches the input KCV.'
      description: 'Computes the KCV of the input blob and checks if

        it matches the input KCV.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyKcvRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyKcvResponse'
components:
  schemas:
    SobjectComponent:
      allOf:
      - type: object
        description: Component of security object, held by a custodian.
        properties:
          component:
            type: string
            format: byte
            description: Key component
          component_kcv:
            type: string
            description: Key component KCV
          custodian:
            $ref: '#/components/schemas/Principal'
        required:
        - component
        - custodian
    FpeDate:
      description: 'A structure for specifying a token part representing a date that occurs after a specified date

        and/or occurs before a specified date. Depending on the subparts that make up the date, one of

        the three options is used.'
      oneOf:
      - title: FpeDateVariantDayMonthYear
        type: object
        properties:
          dmy_date:
            $ref: '#/components/schemas/FpeDateDayMonthYear'
        required:
        - dmy_date
      - title: FpeDateVariantMonthDay
        type: object
        properties:
          month_day_date:
            $ref: '#/components/schemas/FpeDateMonthDay'
        required:
        - month_day_date
      - title: FpeDateVariantMonthYear
        type: object
        properties:
          month_year_date:
            $ref: '#/components/schemas/FpeDateMonthYear'
        required:
        - month_year_date
    EffectiveKeyOperations:
      description: "Operations allowed to be performed on a given key by a given User or an app\n\n\n\n          SIGN:\n            If this is set, the key can be used for signing.\n\n\n          VERIFY:\n            If this is set, the key can used for verifying a signature.\n\n\n          ENCRYPT:\n            If this is set, the key can be used for encryption.\n\n\n          DECRYPT:\n            If this is set, the key can be used for decryption.\n\n\n          WRAPKEY:\n            If this is set, the key can be used wrapping other keys.\n            The key being wrapped must have the EXPORT operation enabled.\n\n\n          UNWRAPKEY:\n            If this is set, the key can be used to unwrap a wrapped key.\n\n\n          DERIVEKEY:\n            If this is set, the key can be used to derive another key.\n\n\n          TRANSFORM:\n            If this is set, the key can be transformed.\n\n\n          MACGENERATE:\n            If this is set, the key can be used to compute a cryptographic\n            Message Authentication Code (MAC) on a message.\n\n\n          MACVERIFY:\n            If they is set, the key can be used to verify a MAC.\n\n\n          EXPORT:\n            If this is set, the value of the key can be retrieved\n            with an authenticated request. This shouldn't be set unless\n            required. It is more secure to keep the key's value inside DSM only.\n\n\n          APPMANAGEABLE:\n            Without this operation, management operations like delete, destroy,\n            rotate, activate, restore, revoke, revert, update, remove_private, etc.\n            cannot be performed by a crypto App.\n            A user with access or admin app can still perform these operations.\n            This option is only relevant for crypto apps.\n\n\n          HIGHVOLUME:\n            If this is set, audit logs will not be recorded for the key.\n            High volume here tries to signify a key that is being used a lot\n            and will produce lots of logs. Setting this operation disables\n            audit logs for the key.\n\n\n          AGREEKEY:\n            If this is set, the key can be used for key agreement.\n            Both the private and public key should have this option enabled\n            to perform an agree operation.\n\n\n          ENCAPSULATE:\n            If this is set, the key can be used for key encapsulation. The\n            result is a new symmetric key and a ciphertext.\n\n\n          DECAPSULATE:\n            If this is set, the key can be used for key decapsulation. If\n            decapsulation succeeds, the result is a new symmetric key.\n\n\n          MASKDECRYPT:\n            If this is set, the key can be used for masked decryption only.\n\n"
      type: string
      enum:
      - SIGN
      - VERIFY
      - ENCRYPT
      - DECRYPT
      - WRAPKEY
      - UNWRAPKEY
      - DERIVEKEY
      - TRANSFORM
      - MACGENERATE
      - MACVERIFY
      - EXPORT
      - APPMANAGEABLE
      - HIGHVOLUME
      - AGREEKEY
      - ENCAPSULATE
      - DECAPSULATE
      - MASKDECRYPT
    ExternalKmsInfoVariantOci:
      allOf:
      - type: object
        properties:
          type:
            type: string
            enum:
            - Oci
        required:
        - type
      - $ref: '#/components/schemas/OciVaultInfo'
    VerifyKcvRequest:
      allOf:
      - type: object
        description: Verify KCV of a key
        properties:
          kcv:
            type: string
            description: 'Key Checksum Value. Could be one of following two variants:

              - Encrypt KCV: 24-bit checksum as a 6-character case-insensitive hex string (Default)

              - Cmac KCV: 40-bit checksum as a 10-character case-insensitive hex string

              Note: Cmac KCV is only available for AES or 3-key DES3 keys'
          value:
            type: string
            format: byte
            description: Key material
          obj_type:
            $ref: '#/components/schemas/ObjectType'
          kcv_method:
            $ref: '#/components/schemas/KcvMethod'
        required:
        - kcv
        - value
        - obj_type
    Mgf:
      description: Specifies the Mask Generating Function (MGF) to use.
      oneOf:
      - title: MgfVariantMgf1
        type: object
        properties:
          mgf1:
            $ref: '#/components/schemas/MgfMgf1'
        required:
        - mgf1
    KeyCreationMethodVariantUnwrap:
      allOf:
      - type: object
        properties:
          method:
            type: string
            enum:
            - Unwrap
        required:
        - method
      - type: object
        properties: {}
    RsaEncryptionPaddingOaep:
      allOf:
      - type: object
        description: Optimal Asymmetric Encryption Padding (PKCS#1 v2.1).
        properties:
          mgf:
            $ref: '#/components/schemas/Mgf'
        required:
        - mgf
    FpeDataPart:
      description: Structure for specifying (part of) a complex tokenization data type.
      oneOf:
      - $ref: '#/components/schemas/FpeEncryptedPart'
      - $ref: '#/components/schemas/FpeDataPartLiteral'
      - $ref: '#/components/schemas/FpeCompoundPart'
    PublishPublicKeyConfigEnabled:
      allOf:
      - type: object
        properties:
          list_previous_version:
            type: boolean
            description: Additionally list the previous version of the key if not compromised.
        required:
        - list_previous_version
    GoogleAccessReason:
      description: An access reason provided by Google when making EKMS API calls.
      type: string
      enum:
      - REASON_UNSPECIFIED
      - CUSTOMER_INITIATED_SUPPORT
      - GOOGLE_INITIATED_SERVICE
      - THIRD_PARTY_DATA_REQUEST
      - GOOGLE_INITIATED_REVIEW
      - CUSTOMER_INITIATED_ACCESS
      - GOOGLE_INITIATED_SYSTEM_OPERATION
      - REASON_NOT_EXPECTED
      - MODIFIED_CUSTOMER_INITIATED_ACCESS
      - MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION
      - GOOGLE_RESPONSE_TO_PRODUCTION_ALERT
      - CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING
    Slip10Options:
      allOf:
      - type: object
        properties:
          derivation_path:
            type: array
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
            description: 'The Slip10 path, starting from master. Master key is [].


              Ex: m/42/42''/0 -> [42, 2**31 + 42, 0]'
        required:
        - derivation_path
    CipherMode:
      description: Cipher mode used for symmetric key algorithms.
      type: string
      enum:
      - ECB
      - CBC
      - CBCNOPAD
      - CFB
      - OFB
      - CTR
      - GCM
      - CCM
      - KW
      - KWP
      - FF1
    GoogleAccessReasonPolicy:
      allOf:
      - type: object
        description: 'Policy specifying acceptable access reasons

          by Google Service Account at App or Sobject level.'
        properties:
          allow:
            type: array
            uniqueItems: true
            items:
              $ref: '#/components/schemas/GoogleAccessReason'
            description: Set of allowed Google Access reasons.
          allow_missing_reason:
            type: boolean
            description: Accept incoming requests which do not specify any access reasons.
        required:
        - allow
        - allow_missing_reason
    FpeDayMonthDate:
      allOf:
      - type: object
        description: 'A structure for specifying a particular date consisting of a day and a month, for use in an

          FpeDate structure.'
        properties:
          month:
            type: integer
            minimum: 0
            maximum: 255
            description: The month, which should be an integer from 1 to 12.
          day:
            type: integer
            minimum: 0
            maximum: 255
            description: 'The day, which should be an integer from 1 to either 29, 30, or 31, depending on the month

              and year. Here, February is treated as having 29 days.'
        required:
        - month
        - day
    FpeInputProcessing:
      description: Options to apply some pre- and post-processing to the input.
      oneOf:
      - title: FpeInputProcessingVariantStripUnknown
        type: string
       

# --- truncated at 32 KB (136 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/fortanix/refs/heads/main/openapi/fortanix-keys-api-openapi.yml