Register an internal cryptographic use case

Authorize one of your applications to use a key on its own data, for example a service that encrypts records and later decrypts them, in one step. The platform creates the cryptographic actor, its client credential, an exchange context and the capability grants the use case needs. This page also covers suspending, resuming, renewing and revoking a use case.

Who can do it

A tenant administrator, a tenant key manager, or a platform super administrator from inside the tenant, where the console acts as a tenant administrator. Creating, suspending, resuming, renewing and revoking a use case are separate permissions; the console offers New use case only with the permission to create, and Renew for another year only with the permission to renew. All three roles hold them. Generating a key from the dialog also needs the permission to orchestrate keys.

The screen serves SIMPLE tenants, which compose all their authorization here, and STANDARD tenants. On a RAPIDAPI tenant the console does not offer to create a use case.

Before you start

• The application exists and is active. Every use case belongs to exactly one application.
• Decide which operations the application needs. The use case authorizes exactly what you tick. ENCRYPT and DECRYPT need a key-encapsulation key, SIGN and VERIFY a signature key; one key cannot do both.
• The key is referenced, not created by the use case. It keeps its own lifecycle, and revoking the use case never touches it. If no suitable key exists, you can generate one from the dialog.
• The client secret is shown once, when the use case is created. Have a secure secret store ready.

Steps

1. Open Internal Use Cases.
2. Select New use case. The dialog Provision Internal Use Case opens.
3. Enter the name and, optionally, a Description. Choose the application.
4. Tick the operations. An operation the selected key cannot serve is unavailable.
5. Choose the Key the operations run on, or select Generate a key to create one. For REENCRYPT or RESIGN, choose a Source key and a Target key (destination); the same key for both moves data from an older material version of the key to its current one.
6. Select Provision.
7. In Credential Created — Capture Now, copy the Client ID and the Client Secret (shown ONCE) to your secret store, then select I have securely stored the secret.

To manage an existing use case, use the controls on its row:

• Suspend use case: give a Reason for suspension and select Suspend. The workload is denied every cryptographic operation; nothing is destroyed.
• Resume use case: restores it exactly. No confirmation is asked.
• Renew for another year: moves its end of validity to one year after the later of today and its current end.
• Revoke use case: type the use case's name to confirm, give a Reason, and select Revoke. This is terminal.

What you see when it worked

The console confirms with Use case "<name>" provisioned, and the use case appears in the list with its application, its referenced key and its authorization status. It is valid for one year from its creation. The application authenticates with the client ID and secret you stored and can run the operations you ticked on the key.

The other actions confirm with Use case "<name>" suspended. Resume restores it exactly., Use case "<name>" resumed., "<name>" renewed for another year or Use case "<name>" revoked. Its keys remain in the inventory. Revoking withdraws the actor, its credential, the exchange context and every capability grant the use case composed.

If it fails

Without the console

Related

• Internal Use Cases: what the screen shows and every decision you make on it.
• Create a key
• Applications