Google Cloud KMS Folders API

openapi: 3.2.0
info:
  title: Cloud Key Management Service (KMS) Folders API
  version: v1
  description: Generated from Google's published Discovery document for Cloud Key Management Service (KMS) API (cloudkms v1, revision 20261106). 5 operation(s).
  contact:
    name: Google
    url: https://developers.google.com/
  termsOfService: https://developers.google.com/terms
servers:
- url: https://cloudkms.googleapis.com
tags:
- name: Folders
paths:
  /v1/folders/{foldersId}/kajPolicyConfig:
    patch:
      operationId: cloudkms.folders.updateKajPolicyConfig
      summary: Update kaj policy config folders
      description: Updates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.
      parameters:
      - name: foldersId
        in: path
        required: true
        description: Resource name segment (foldersId).
        schema:
          type: string
      - name: updateMask
        in: query
        required: false
        description: Optional. Specifies the list of fields to update.
        schema:
          format: google-fieldmask
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/KeyAccessJustificationsPolicyConfig'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/KeyAccessJustificationsPolicyConfig'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-platform
        - https://www.googleapis.com/auth/cloudkms
      - apiKey: []
      tags:
      - Folders
    get:
      operationId: cloudkms.folders.getKajPolicyConfig
      summary: Get kaj policy config folders
      description: Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.
      parameters:
      - name: foldersId
        in: path
        required: true
        description: Resource name segment (foldersId).
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/KeyAccessJustificationsPolicyConfig'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-platform
        - https://www.googleapis.com/auth/cloudkms
      - apiKey: []
      tags:
      - Folders
  /v1/folders/{foldersId}/autokeyConfig:
    get:
      operationId: cloudkms.folders.getAutokeyConfig
      summary: Get autokey config folders
      description: Returns the AutokeyConfig for a folder or project.
      parameters:
      - name: foldersId
        in: path
        required: true
        description: Resource name segment (foldersId).
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AutokeyConfig'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-platform
        - https://www.googleapis.com/auth/cloudkms
      - apiKey: []
      tags:
      - Folders
    patch:
      operationId: cloudkms.folders.updateAutokeyConfig
      summary: Update autokey config folders
      description: Updates the AutokeyConfig for a folder or a project. The caller must have both `cloudkms.autokeyConfigs.update` permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy` permission on the provided key project. A KeyHandle creation in the folder's descendant projects will use this configuration to determine where to create the resulting CryptoKey.
      parameters:
      - name: foldersId
        in: path
        required: true
        description: Resource name segment (foldersId).
        schema:
          type: string
      - name: updateMask
        in: query
        required: false
        description: Required. Masks which fields of the AutokeyConfig to update, e.g. `keyProject`.
        schema:
          format: google-fieldmask
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AutokeyConfig'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AutokeyConfig'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-platform
        - https://www.googleapis.com/auth/cloudkms
      - apiKey: []
      tags:
      - Folders
  /v1/folders/{foldersId}:showEffectiveAutokeyConfig:
    get:
      operationId: cloudkms.folders.showEffectiveAutokeyConfig
      summary: Show effective autokey config folders
      description: 'Returns the effective Cloud KMS Autokey configuration for a given project or folder. Note on permissions: - If called on a project (`projects/{project}`), requires `cloudkms.projects.showEffectiveAutokeyConfig`. - If called on a folder (`folders/{folder}`), requires `cloudkms.folders.showEffectiveAutokeyConfig`.'
      parameters:
      - name: foldersId
        in: path
        required: true
        description: Resource name segment (foldersId).
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ShowEffectiveAutokeyConfigResponse'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-platform
        - https://www.googleapis.com/auth/cloudkms
      - apiKey: []
      tags:
      - Folders
components:
  schemas:
    AutokeyConfig:
      description: Cloud KMS Autokey configuration for a project or folder.
      type: object
      properties:
        keyProject:
          type: string
          description: Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or `projects/{PROJECT_NUMBER}`, where Cloud KMS Autokey will provision a new CryptoKey when a KeyHandle is created. On UpdateAutokeyConfig, the caller will require `cloudkms.cryptoKeys.setIamPolicy` permission on this key project. Once configured, for Cloud KMS Autokey to function properly, this key project must have the Cloud KMS API activated and the Cloud KMS Service Agent for this key project must be granted the `cloudkms.admin` role (or pertinent permissions). A request with an empty key project field will clear the configuration.
        keyProjectResolutionMode:
          description: Optional. KeyProjectResolutionMode for the AutokeyConfig. Valid values are `DEDICATED_KEY_PROJECT`, `RESOURCE_PROJECT`, or `DISABLED`.
          type: string
          enum:
          - KEY_PROJECT_RESOLUTION_MODE_UNSPECIFIED
          - DEDICATED_KEY_PROJECT
          - RESOURCE_PROJECT
          - DISABLED
        state:
          readOnly: true
          type: string
          enum:
          - STATE_UNSPECIFIED
          - ACTIVE
          - KEY_PROJECT_DELETED
          - UNINITIALIZED
          - KEY_PROJECT_PERMISSION_DENIED
          description: Output only. The state for the AutokeyConfig.
        name:
          description: Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`, `projects/{PROJECT_NUMBER}/autokeyConfig`, or `projects/{PROJECT_ID}/autokeyConfig`.
          type: string
        etag:
          description: Optional. A checksum computed by the server based on the value of other fields. This may be sent on update requests to ensure that the client has an up-to-date value before proceeding. The request will be rejected with an ABORTED error on a mismatched etag.
          type: string
    KeyAccessJustificationsPolicy:
      type: object
      properties:
        allowedAccessReasons:
          items:
            type: string
            enum:
            - REASON_UNSPECIFIED
            - CUSTOMER_INITIATED_SUPPORT
            - GOOGLE_INITIATED_SERVICE
            - THIRD_PARTY_DATA_REQUEST
            - GOOGLE_INITIATED_REVIEW
            - CUSTOMER_INITIATED_ACCESS
            - GOOGLE_INITIATED_SYSTEM_OPERATION
            - REASON_NOT_EXPECTED
            - MODIFIED_CUSTOMER_INITIATED_ACCESS
            - MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION
            - GOOGLE_RESPONSE_TO_PRODUCTION_ALERT
            - CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING
          type: array
          description: The list of allowed reasons for access to a CryptoKey. Note that empty allowed_access_reasons has a different meaning depending on where this message appears. If this is under KeyAccessJustificationsPolicyConfig, it means allow-all. If this is under CryptoKey, it means deny-all.
      description: A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey or KeyAccessJustificationsPolicyConfig (the default Key Access Justifications policy).
    Source:
      properties:
        name:
          type: string
          description: Contains the resource name of the AutokeyConfig that is effective, for example, `folders/{FOLDER_NUMBER}` or `projects/{PROJECT_NUMBER}` or `organizations/{ORGANIZATION_NUMBER}`.
      type: object
      description: Source of the effective AutokeyConfig.
    GoogleRpcError:
      type: object
      description: The error envelope every Google API returns.
      properties:
        error:
          type: object
          properties:
            code:
              type: integer
            message:
              type: string
            status:
              type: string
            details:
              type: array
              items:
                type: object
    KeyAccessJustificationsPolicyConfig:
      description: Represents a singleton configuration for Key Access Justifications policies.
      properties:
        defaultKeyAccessJustificationPolicy:
          $ref: '#/components/schemas/KeyAccessJustificationsPolicy'
          description: Optional. Specifies the default key access justifications (KAJ) policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. This overrides any default policies in its ancestry. If this field is unset, or is set but contains an empty allowed_access_reasons list, no default Key Access Justifications (KAJ) policy configuration is active. In this scenario, all newly created keys will default to an "allow-all" policy.
        name:
          description: Identifier. Represents the resource name for this KeyAccessJustificationsPolicyConfig in the format of "{organizations|folders|projects}/*/kajPolicyConfig".
          type: string
        defaultPolicyAvailable:
          type: boolean
          readOnly: true
          description: Output only. Indicates whether this parent resource is available to default policy feature. Please consult [the prerequisite of default policy feature](https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy#before) for more details.
      type: object
    ShowEffectiveAutokeyConfigResponse:
      description: Response message for ShowEffectiveAutokeyConfig
      type: object
      properties:
        keyProjectResolutionMode:
          description: The KeyProjectResolutionMode for the AutokeyConfig.
          type: string
          enum:
          - KEY_PROJECT_RESOLUTION_MODE_UNSPECIFIED
          - DEDICATED_KEY_PROJECT
          - RESOURCE_PROJECT
          - DISABLED
        keyProject:
          description: Name of the key project configured in the ancestry of the project or folder.
          type: string
        source:
          $ref: '#/components/schemas/Source'
          description: Source of the effective AutokeyConfig.
  securitySchemes:
    apiKey:
      type: apiKey
      in: query
      name: key
      description: API key; accepted by methods that do not need user data.
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://accounts.google.com/o/oauth2/auth
          tokenUrl: https://oauth2.googleapis.com/token
          scopes:
            https://www.googleapis.com/auth/cloud-platform: See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account.
            https://www.googleapis.com/auth/cloudkms: View and manage your keys and secrets stored in Cloud Key Management Service
externalDocs:
  url: https://cloud.google.com/kms/
x-provenance:
  method: harvested
  publisher: Google
  source: https://cloudkms.googleapis.com/$discovery/rest?version=v1
  note: converted by discovery-to-openapi.py from Google's Discovery document (revision 20261106)