Package co.ankatech.ankasecure.keymanagement

Class KeyOperations

java.lang.Object
co.ankatech.ankasecure.keymanagement.KeyOperations
public final class KeyOperations extends Object
The keys of the workload's tenant: listing and reading, creation and import, export of the public part, the metadata update, and the key lifecycle (suspend, reactivate, revoke, archive). Obtained from AuthenticatedKeyManagementSdk.keys().

Request and response bodies are the generated models of the Key Management contract, so every member an operation accepts can be set. A refused call throws KeyManagementSdkException carrying the RFC 9457 problem; classify on KeyManagementSdkException.getProblemType().


 OrchestrationKeyRequest request = new OrchestrationKeyRequest()
         .kid("payments-signing-key")
         .kty("ML-DSA")
         .algorithm("ML-DSA-65");
 OrchestrationKeyResponse created = sdk.keys().create(request);

  • Method Details

    • list

      public PageAdminKeyResponse list(KeyListQuery query)
      Lists the tenant's keys (GET /tenants/{t}/keys).
      Parameters:
      query - the filters and page; must not be null (KeyListQuery.firstPage() for the server's defaults)
      Returns:
      one page of keys
      Throws:
      KeyManagementSdkException - when the Admin API refuses the call

    • get

      public AdminKeyResponse get(String kid)
      Reads one key (GET /tenants/{t}/keys/{kid}).
      Parameters:
      kid - the key identifier; must not be null
      Returns:
      the key, with its lifecycle status (a destroyed key reads deleted_logical)
      Throws:
      KeyManagementSdkException - when the key does not exist in the tenant (404) or the call is refused

    • create

      public OrchestrationKeyResponse create(OrchestrationKeyRequest request)
      Creates a key (POST /tenants/{t}/keys).

      A Key ID that belonged to a destroyed key of this tenant is never reused: the Admin API answers 409 with problem type …/key-id-retired.

      Parameters:
      request - the key to create; must not be null
      Returns:
      the created key
      Throws:
      KeyManagementSdkException - when the request is invalid (400), the Key ID is taken or retired (409), the algorithm is refused by policy (422), or the call is refused otherwise

    • update

      public void update(String kid, AdminKeyMergePatchRequest patch)
      Updates a key's metadata with a JSON merge patch (PATCH /tenants/{t}/keys/{kid}).

      A change that weakens the key (a later expiry, a higher usage limit, making it exportable) waits for quorum approval when the tenant's quorum policy gates key weakening: the call then throws QuorumApprovalPendingException and nothing changes until people approve it in the Admin Console.

      Parameters:
      kid - the key identifier; must not be null
      patch - the members to change; must not be null
      Throws:
      QuorumApprovalPendingException - when the change waits for quorum approval
      KeyManagementSdkException - when the call is refused

    • importKey

      public KeyExportResponse importKey(KeyImportRequest request)
      Imports one key (POST /tenants/{t}/keys/import-key).
      Parameters:
      request - the key to import; must not be null
      Returns:
      the imported key's public representation
      Throws:
      KeyManagementSdkException - when the call is refused (a retired Key ID is 409 …/key-id-retired)

    • importKeystore

      public KeystoreImportResponse importKeystore(Path keystore, String metadata, SecretChars password)
      Imports the private keys and trusted certificates of a PKCS#12 or JKS keystore (POST /tenants/{t}/keys/import-keystore).

      The keystore password travels as the raw bytes of the password part, read from password and wiped after the request; it is never written to a file or a log.

      Parameters:
      keystore - the keystore file; must not be null
      metadata - the import metadata JSON document (the Key IDs and policies to give the imported entries, as the import contract defines it); must not be null
      password - the keystore password, or null for an unprotected keystore
      Returns:
      the import outcome per entry
      Throws:
      KeyManagementSdkException - when the keystore cannot be read or the call is refused

    • analyzeKeystore

      public KeystoreAnalysisResponse analyzeKeystore(Path keystore, String metadata, SecretChars password)
      Analyses a keystore without importing anything (POST /tenants/{t}/keys/import-keystore/analyze).
      Parameters:
      keystore - the keystore file; must not be null
      metadata - the import metadata JSON document; must not be null
      password - the keystore password, or null for an unprotected keystore
      Returns:
      what an import would do with each entry
      Throws:
      KeyManagementSdkException - when the keystore cannot be read or the call is refused

    • export

      public AdminKeyExportResponse export(String kid)
      Exports a key's public part (GET /tenants/{t}/keys/{kid}/export).
      Parameters:
      kid - the key identifier; must not be null
      Returns:
      the exported public key and its metadata
      Throws:
      KeyManagementSdkException - when the call is refused

    • lifecycleCauseVerdicts

      public KeyLifecycleCauseVerdictsResponse lifecycleCauseVerdicts(String kid)
      Reads which lifecycle causes the key admits for a revocation or a suspension (GET /tenants/{t}/keys/{kid}/lifecycle-cause-verdicts).
      Parameters:
      kid - the key identifier; must not be null
      Returns:
      the verdict per cause
      Throws:
      KeyManagementSdkException - when the call is refused

    • supportedAlgorithms

      public List<SupportedAlgorithm> supportedAlgorithms(SupportedAlgorithmQuery query)
      Reads the tenant's supported algorithm catalogue (GET /tenants/{t}/supported-algorithms).
      Parameters:
      query - the filters; must not be null (SupportedAlgorithmQuery.all() for the whole catalogue)
      Returns:
      the matching algorithms
      Throws:
      KeyManagementSdkException - when the call is refused

    • suspend

      public void suspend(String kid, SuspendKeyRequest request)
      Suspends a key (POST /tenants/{t}/keys/{kid}/suspend).
      Parameters:
      kid - the key identifier; must not be null
      request - the suspension cause and reason; must not be null
      Throws:
      KeyManagementSdkException - when the call is refused

    • reactivate

      public void reactivate(String kid)
      Reactivates a suspended key (POST /tenants/{t}/keys/{kid}/reactivate).
      Parameters:
      kid - the key identifier; must not be null
      Throws:
      KeyManagementSdkException - when the call is refused

    • revoke

      public void revoke(String kid, RevokeKeyRequest request)
      Revokes a key (POST /tenants/{t}/keys/{kid}/revoke).
      Parameters:
      kid - the key identifier; must not be null
      request - the revocation cause and reason; must not be null
      Throws:
      KeyManagementSdkException - when the call is refused

    • archive

      public void archive(String kid)
      Archives a key (POST /tenants/{t}/keys/{kid}/archive); an archived key can then be requested for destruction.
      Parameters:
      kid - the key identifier; must not be null
      Throws:
      KeyManagementSdkException - when the call is refused