Package co.ankatech.ankasecure.keymanagement

Class AuthenticatedKeyManagementSdk

java.lang.Object
co.ankatech.ankasecure.keymanagement.AuthenticatedKeyManagementSdk
All Implemented Interfaces:
AutoCloseable
public final class AuthenticatedKeyManagementSdk extends Object implements AutoCloseable
An authenticated Key Management SDK instance: one administrative workload's DPoP-bound session in its tenant. Created by AnkaSecureKeyManagementSdk.authenticateWorkload(WorkloadCredential).

The operations are grouped by resource, one accessor per group:

Every operation acts in tenantId(), the tenant the workload's token names; no method takes a tenant. A platform (ROOT) workload's session is bound to no tenant: tenantId() is empty and every group accessor fails fast with a TenantBindingRequiredException, sending nothing. The instance is immutable and thread-safe; close() wipes the access token, and every later call fails.


 try (AuthenticatedKeyManagementSdk sdk = factory.authenticateWorkload(credential)) {
     AdminKeyResponse key = sdk.keys().get("payments-signing-key");
     RotationAdmissibilityResponse verdict = sdk.rotation().admissibility(key.getKid());
 }

  • Method Details

    • keys

      public KeyOperations keys()
      Returns:
      the keys of the tenant

    • materials

      public MaterialOperations materials()
      Returns:
      the material versions of the tenant's keys

    • rotation

      public RotationOperations rotation()
      Returns:
      the rotation of the tenant's keys

    • destruction

      public DestructionOperations destruction()
      Returns:
      destruction requests for the tenant's keys and versions

    • quorumRequests

      public QuorumRequestOperations quorumRequests()
      Returns:
      the workload's own quorum requests

    • exchangeContexts

      public ExchangeContextOperations exchangeContexts()
      Returns:
      the tenant's exchange contexts

    • exchanges

      public ExchangeOperations exchanges()
      Returns:
      the tenant's cryptographic exchanges

    • capabilityGrants

      public CapabilityGrantOperations capabilityGrants()
      Returns:
      the tenant's capability grants

    • constraintPolicies

      public ConstraintPolicyOperations constraintPolicies()
      Returns:
      the tenant's constraint policies

    • internalCryptoUseCases

      public InternalCryptoUseCaseOperations internalCryptoUseCases()
      Returns:
      the tenant's internal cryptographic use cases

    • directory

      public DirectoryOperations directory()
      Returns:
      read-only lookups of the tenant's applications, actors and counterparty types

    • tenantId

      public Optional<UUID> tenantId()
      The tenant every operation of this instance acts in: the tenant the workload's token names.
      Returns:
      the bound tenant, or empty for a platform (ROOT) session, which addresses no tenant

    • close

      public void close()
      Wipes the access token; every later call fails with "SDK instance is closed". Idempotent.
      Specified by:
      close in interface AutoCloseable

    • isClosed

      public boolean isClosed()
      Returns:
      true once close() has been called

    • isTokenExpired

      public boolean isTokenExpired()
      Whether the token held now is past its expiry, read from the token's own exp claim. The next request renews it; this reports the token held at this moment.
      Returns:
      true if the token is expired, carries no exp, cannot be parsed, or the instance is closed; false if it is still valid

    • viewSession

      public SessionInfo viewSession()
      Summarises the session by parsing the token's claims locally: no request is sent and the token is never logged or returned. Reads sub (the workload id), client_id, exp and the scopes array (RFC 8693).
      Returns:
      a token-free summary of the workload, its expiry and its scopes
      Throws:
      KeyManagementSdkException - if the instance is closed or the token cannot be parsed