Package co.ankatech.ankasecure.keymanagement

Class DestructionOperations

java.lang.Object
co.ankatech.ankasecure.keymanagement.DestructionOperations
public final class DestructionOperations extends Object
Destruction requests for keys and key versions. Obtained from AuthenticatedKeyManagementSdk.destruction().

A workload never destroys key material. It requests the destruction, and the request always opens a quorum request: at least one person other than the requester must approve it in the Admin Console. The approval schedules the destruction; the server destroys exactly the approved material by itself once the cooling-off period (7 to 365 days, 30 by default, counted from the approval) has ended. A destroyed key keeps its metadata, public key and audit evidence, and its Key ID is never reused in the tenant.

Until the server destroys it, a request can be withdrawn: before the approval through QuorumRequestOperations.cancel(UUID), after it through the cancel operations of this class, which restore the materials. Requesting the destruction of a key's last remaining version is the destruction of the key itself.


 sdk.keys().archive("legacy-signing-key");
 QuorumRequestReceipt receipt = sdk.destruction().requestKey("legacy-signing-key",
         new MarkForDestructionRequest().coolingOffDays(30));
 // receipt.requestId() waits for approval in the Admin Console

  • Method Details

    • requestKey

      public QuorumRequestReceipt requestKey(String kid, MarkForDestructionRequest request)
      Requests the destruction of an archived key: every material it has not yet destroyed (POST /tenants/{t}/keys/{kid}/mark-for-destruction).
      Parameters:
      kid - the key identifier; must not be null
      request - the cooling-off period, 7 to 365 days; must not be null (a request with no coolingOffDays takes the tenant's default, else the deployment's, else 30)
      Returns:
      the quorum request the destruction now waits on
      Throws:
      KeyManagementSdkException - when the key is not archived (409), the cooling-off is out of range (400), the tenant has no eligible approver other than the requester (422), or the call is refused otherwise

    • cancelKey

      public void cancelKey(String kid)
      Cancels the scheduled destruction of a key and restores its materials (POST /tenants/{t}/keys/{kid}/cancel-destruction). A destruction already executed cannot be cancelled (409).
      Parameters:
      kid - the key identifier; must not be null
      Throws:
      KeyManagementSdkException - when the call is refused

    • requestVersion

      public QuorumRequestReceipt requestVersion(String stableKid, int version, MaterialMarkForDestructionRequest request)
      Requests the destruction of one material version (POST /tenants/{t}/keys/{stableKid}/materials/{version}/mark-for-destruction). When it is the key's last version not already destroyed or awaiting destruction, the request is the destruction of the key and needs what that needs (an archived key).
      Parameters:
      stableKid - the key's stable identifier; must not be null
      version - the version number
      request - the cooling-off period, 7 to 365 days; must not be null
      Returns:
      the quorum request the destruction now waits on
      Throws:
      KeyManagementSdkException - when the call is refused

    • cancelVersion

      public MaterialVersionResponse cancelVersion(String stableKid, int version)
      Cancels the scheduled destruction of one material version and restores it (POST /tenants/{t}/keys/{stableKid}/materials/{version}/cancel-destruction). When the version is part of a key destruction, the whole key destruction is cancelled.
      Parameters:
      stableKid - the key's stable identifier; must not be null
      version - the version number
      Returns:
      the restored version
      Throws:
      KeyManagementSdkException - when the call is refused

    • orders

      public List<KeyDestructionOrderView> orders(String kid)
      Lists the key's destruction orders, newest first, with their status and outcome (GET /tenants/{t}/keys/{kid}/destruction-orders). A request still waiting for approval is read through QuorumRequestOperations.get(UUID); an approved one is an order here.
      Parameters:
      kid - the key identifier; must not be null
      Returns:
      the key's orders; empty when its destruction was never approved
      Throws:
      KeyManagementSdkException - when the key does not exist in the tenant (404) or the call is refused