Infisical KMS Signing API
The KMS Signing API from Infisical — 4 operation(s) for kms signing.
OpenAPI Specification
openapi: 3.0.3
info:
title: Infisical Admin KMS Signing API
description: List of all available APIs that can be consumed
version: 0.0.1
servers:
- url: https://us.infisical.com
description: Production server (US)
- url: https://eu.infisical.com
description: Production server (EU)
- url: http://localhost:8080
description: Local server
tags:
- name: KMS Signing
paths:
/api/v1/kms/keys/{keyId}/public-key:
get:
operationId: getKmsKeyPublicKey
tags:
- KMS Signing
description: Get the public key for a KMS key that is used for signing and verifying data. This endpoint is only available for asymmetric keys.
parameters:
- schema:
type: string
format: uuid
in: path
name: keyId
required: true
description: The ID of the key to get the public key for. The key must be for signing and verifying.
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
publicKey:
type: string
required:
- publicKey
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
/api/v1/kms/keys/{keyId}/signing-algorithms:
get:
operationId: listKmsKeySigningAlgorithms
tags:
- KMS Signing
description: List all available signing algorithms for a KMS key
parameters:
- schema:
type: string
format: uuid
in: path
name: keyId
required: true
description: The ID of the key to list the signing algorithms for. The key must be for signing and verifying.
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
signingAlgorithms:
type: array
items:
type: string
enum:
- RSASSA_PSS_SHA_512
- RSASSA_PSS_SHA_384
- RSASSA_PSS_SHA_256
- RSASSA_PKCS1_V1_5_SHA_512
- RSASSA_PKCS1_V1_5_SHA_384
- RSASSA_PKCS1_V1_5_SHA_256
- ECDSA_SHA_512
- ECDSA_SHA_384
- ECDSA_SHA_256
- ML_DSA_44
- ML_DSA_65
- ML_DSA_87
required:
- signingAlgorithms
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
/api/v1/kms/keys/{keyId}/sign:
post:
operationId: signWithKmsKey
tags:
- KMS Signing
description: Sign data with a KMS key.
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
signingAlgorithm:
type: string
enum:
- RSASSA_PSS_SHA_512
- RSASSA_PSS_SHA_384
- RSASSA_PSS_SHA_256
- RSASSA_PKCS1_V1_5_SHA_512
- RSASSA_PKCS1_V1_5_SHA_384
- RSASSA_PKCS1_V1_5_SHA_256
- ECDSA_SHA_512
- ECDSA_SHA_384
- ECDSA_SHA_256
- ML_DSA_44
- ML_DSA_65
- ML_DSA_87
isDigest:
type: boolean
default: false
description: Whether the data is already digested or not. Please be aware that if you are passing a digest the algorithm used to create the digest must match the signing algorithm used to sign the digest.
data:
type: string
description: The data in string format to be signed (base64 encoded).
required:
- signingAlgorithm
- data
additionalProperties: false
parameters:
- schema:
type: string
format: uuid
in: path
name: keyId
required: true
description: The ID of the key to sign the data with.
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
signature:
type: string
keyId:
type: string
format: uuid
signingAlgorithm:
type: string
enum:
- RSASSA_PSS_SHA_512
- RSASSA_PSS_SHA_384
- RSASSA_PSS_SHA_256
- RSASSA_PKCS1_V1_5_SHA_512
- RSASSA_PKCS1_V1_5_SHA_384
- RSASSA_PKCS1_V1_5_SHA_256
- ECDSA_SHA_512
- ECDSA_SHA_384
- ECDSA_SHA_256
- ML_DSA_44
- ML_DSA_65
- ML_DSA_87
required:
- signature
- keyId
- signingAlgorithm
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
/api/v1/kms/keys/{keyId}/verify:
post:
operationId: verifyWithKmsKey
tags:
- KMS Signing
description: Verify data signatures with a KMS key.
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
isDigest:
type: boolean
default: false
description: Whether the data is already digested or not.
data:
type: string
description: The data in string format to be verified (base64 encoded). For data larger than 1MB you must first create a digest of the data and then pass the digest in the data parameter.
signature:
type: string
description: The signature to be verified (base64 encoded).
signingAlgorithm:
type: string
enum:
- RSASSA_PSS_SHA_512
- RSASSA_PSS_SHA_384
- RSASSA_PSS_SHA_256
- RSASSA_PKCS1_V1_5_SHA_512
- RSASSA_PKCS1_V1_5_SHA_384
- RSASSA_PKCS1_V1_5_SHA_256
- ECDSA_SHA_512
- ECDSA_SHA_384
- ECDSA_SHA_256
- ML_DSA_44
- ML_DSA_65
- ML_DSA_87
required:
- data
- signature
- signingAlgorithm
additionalProperties: false
parameters:
- schema:
type: string
format: uuid
in: path
name: keyId
required: true
description: The ID of the key to verify the data with.
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
signatureValid:
type: boolean
keyId:
type: string
format: uuid
signingAlgorithm:
type: string
enum:
- RSASSA_PSS_SHA_512
- RSASSA_PSS_SHA_384
- RSASSA_PSS_SHA_256
- RSASSA_PKCS1_V1_5_SHA_512
- RSASSA_PKCS1_V1_5_SHA_384
- RSASSA_PKCS1_V1_5_SHA_256
- ECDSA_SHA_512
- ECDSA_SHA_384
- ECDSA_SHA_256
- ML_DSA_44
- ML_DSA_65
- ML_DSA_87
required:
- signatureValid
- keyId
- signingAlgorithm
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: An access token in Infisical