Package co.ankatech.keymanagement.client.keymanagement.api

Class TenantResourcesAlgorithmsCatalogApi

java.lang.Object
co.ankatech.keymanagement.client.keymanagement.api.TenantResourcesAlgorithmsCatalogApi
public class TenantResourcesAlgorithmsCatalogApi extends Object

  • Constructor Details

    • TenantResourcesAlgorithmsCatalogApi

      public TenantResourcesAlgorithmsCatalogApi()

    • TenantResourcesAlgorithmsCatalogApi

      public TenantResourcesAlgorithmsCatalogApi(ApiClient apiClient)

  • Method Details

    • getApiClient

      public ApiClient getApiClient()

    • setApiClient

      public void setApiClient(ApiClient apiClient)

    • getHostIndex

      public int getHostIndex()

    • setHostIndex

      public void setHostIndex(int hostIndex)

    • getCustomBaseUrl

      public String getCustomBaseUrl()

    • setCustomBaseUrl

      public void setCustomBaseUrl(String customBaseUrl)

    • listSupportedAlgorithmsCall

      public okhttp3.Call listSupportedAlgorithmsCall(@Nonnull UUID tenantId, @Nullable String category, @Nullable String status, @Nullable Integer minSecurityLevel, @Nullable Integer maxSecurityLevel, @Nullable Set<String> keyOps, @Nullable Set<String> standards, @Nullable Set<String> kty, @Nullable Set<String> alg, @Nullable Set<String> compositeMode, ApiCallback _callback) throws ApiException
      Build call for listSupportedAlgorithms
      Parameters:
      tenantId - Tenant UUID (required)
      category - Filter by category: CLASSICAL, POST_QUANTUM, or HYBRID (optional)
      status - Filter by status: RECOMMENDED, EXPERIMENTAL, or LEGACY (optional)
      minSecurityLevel - Minimum NIST security level (1, 3, or 5) (optional)
      maxSecurityLevel - Maximum NIST security level (1, 3, or 5) (optional)
      keyOps - Required operations (comma-separated). Must support ALL specified. (optional)
      standards - Required standards (comma-separated). Must have ALL specified. (optional)
      kty - Key types (comma-separated, OR logic). Matches ANY specified. Use COMPOSITE for hybrid algorithms — a composite entry's construction is selected with compositeMode, not here. An unpublished token is a 400 that names the accepted set, never a silently empty page. (optional)
      alg - Algorithms (comma-separated, OR logic). Matches ANY specified. (optional)
      compositeMode - Composite construction modes (comma-separated, OR logic): COMPOSITE_KEM_COMBINE or COMPOSITE_SIGNATURE. Selects among hybrid algorithms, which all publish kty=COMPOSITE. Simple algorithms never match. An unpublished construction is a 400 that names the accepted set, never a silently empty page. (optional)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • listSupportedAlgorithms

      public List<SupportedAlgorithm> listSupportedAlgorithms(@Nonnull UUID tenantId, @Nullable String category, @Nullable String status, @Nullable Integer minSecurityLevel, @Nullable Integer maxSecurityLevel, @Nullable Set<String> keyOps, @Nullable Set<String> standards, @Nullable Set<String> kty, @Nullable Set<String> alg, @Nullable Set<String> compositeMode) throws ApiException
      Get permitted algorithms for tenant (policy-filtered) Returns cryptographic algorithms filtered by tenant-specific algorithm policies. ## Policy Resolution 1. Tenant-specific algorithm policy (if configured) — applied as a filter 2. When no active policy exists for the tenant, the active deployment policy applies, and the full catalog only when there is no deployment policy either ## Filtering Logic - Algorithms explicitly denied by policy are excluded - Algorithms not mentioned in policy are included by default - Composite algorithms inherit filtering from component algorithms - When the policy requires composite keys (`requireComposite`), every standalone post-quantum algorithm is excluded, hash-based signatures (SLH-DSA, XMSS, LMS) excepted — the rule the cryptographic service applies when it refuses such a key at creation and rotation. The list is the server's verdict: a client renders it rather than re-judging the hybrid requirement. ## Query Parameters (all optional, same as the cryptographic service) | Parameter | Type | Logic | Description | |-----------|------|-------|-------------| | `category` | string | = | CLASSICAL, POST_QUANTUM, or HYBRID | | `status` | string | = | RECOMMENDED, EXPERIMENTAL, or LEGACY | | `minSecurityLevel` | int | >= | Minimum NIST level (1, 3, 5) | | `maxSecurityLevel` | int | <= | Maximum NIST level (1, 3, 5) | | `keyOps` | array | AND | Required operations (must support ALL) | | `standards` | array | AND | Required standards (must have ALL) | | `kty` | array | OR | Key types (matches ANY, including COMPOSITE) | | `alg` | array | OR | Algorithms (matches ANY) | ## Use Cases - Populate key generation UI with permitted algorithms - Validate algorithm selection against policy - Audit effective algorithm permissions ## Authentication & Authorization - JWT with tenantId claim matching path parameter - Scope: admin.tenant.algorithms.read - Service-to-service calls from the cryptographic service: the tenant was already validated by that service
      Parameters:
      tenantId - Tenant UUID (required)
      category - Filter by category: CLASSICAL, POST_QUANTUM, or HYBRID (optional)
      status - Filter by status: RECOMMENDED, EXPERIMENTAL, or LEGACY (optional)
      minSecurityLevel - Minimum NIST security level (1, 3, or 5) (optional)
      maxSecurityLevel - Maximum NIST security level (1, 3, or 5) (optional)
      keyOps - Required operations (comma-separated). Must support ALL specified. (optional)
      standards - Required standards (comma-separated). Must have ALL specified. (optional)
      kty - Key types (comma-separated, OR logic). Matches ANY specified. Use COMPOSITE for hybrid algorithms — a composite entry's construction is selected with compositeMode, not here. An unpublished token is a 400 that names the accepted set, never a silently empty page. (optional)
      alg - Algorithms (comma-separated, OR logic). Matches ANY specified. (optional)
      compositeMode - Composite construction modes (comma-separated, OR logic): COMPOSITE_KEM_COMBINE or COMPOSITE_SIGNATURE. Selects among hybrid algorithms, which all publish kty=COMPOSITE. Simple algorithms never match. An unpublished construction is a 400 that names the accepted set, never a silently empty page. (optional)
      Returns:
      List<SupportedAlgorithm>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • listSupportedAlgorithmsWithHttpInfo

      public ApiResponse<List<SupportedAlgorithm>> listSupportedAlgorithmsWithHttpInfo(@Nonnull UUID tenantId, @Nullable String category, @Nullable String status, @Nullable Integer minSecurityLevel, @Nullable Integer maxSecurityLevel, @Nullable Set<String> keyOps, @Nullable Set<String> standards, @Nullable Set<String> kty, @Nullable Set<String> alg, @Nullable Set<String> compositeMode) throws ApiException
      Get permitted algorithms for tenant (policy-filtered) Returns cryptographic algorithms filtered by tenant-specific algorithm policies. ## Policy Resolution 1. Tenant-specific algorithm policy (if configured) — applied as a filter 2. When no active policy exists for the tenant, the active deployment policy applies, and the full catalog only when there is no deployment policy either ## Filtering Logic - Algorithms explicitly denied by policy are excluded - Algorithms not mentioned in policy are included by default - Composite algorithms inherit filtering from component algorithms - When the policy requires composite keys (`requireComposite`), every standalone post-quantum algorithm is excluded, hash-based signatures (SLH-DSA, XMSS, LMS) excepted — the rule the cryptographic service applies when it refuses such a key at creation and rotation. The list is the server's verdict: a client renders it rather than re-judging the hybrid requirement. ## Query Parameters (all optional, same as the cryptographic service) | Parameter | Type | Logic | Description | |-----------|------|-------|-------------| | `category` | string | = | CLASSICAL, POST_QUANTUM, or HYBRID | | `status` | string | = | RECOMMENDED, EXPERIMENTAL, or LEGACY | | `minSecurityLevel` | int | >= | Minimum NIST level (1, 3, 5) | | `maxSecurityLevel` | int | <= | Maximum NIST level (1, 3, 5) | | `keyOps` | array | AND | Required operations (must support ALL) | | `standards` | array | AND | Required standards (must have ALL) | | `kty` | array | OR | Key types (matches ANY, including COMPOSITE) | | `alg` | array | OR | Algorithms (matches ANY) | ## Use Cases - Populate key generation UI with permitted algorithms - Validate algorithm selection against policy - Audit effective algorithm permissions ## Authentication & Authorization - JWT with tenantId claim matching path parameter - Scope: admin.tenant.algorithms.read - Service-to-service calls from the cryptographic service: the tenant was already validated by that service
      Parameters:
      tenantId - Tenant UUID (required)
      category - Filter by category: CLASSICAL, POST_QUANTUM, or HYBRID (optional)
      status - Filter by status: RECOMMENDED, EXPERIMENTAL, or LEGACY (optional)
      minSecurityLevel - Minimum NIST security level (1, 3, or 5) (optional)
      maxSecurityLevel - Maximum NIST security level (1, 3, or 5) (optional)
      keyOps - Required operations (comma-separated). Must support ALL specified. (optional)
      standards - Required standards (comma-separated). Must have ALL specified. (optional)
      kty - Key types (comma-separated, OR logic). Matches ANY specified. Use COMPOSITE for hybrid algorithms — a composite entry's construction is selected with compositeMode, not here. An unpublished token is a 400 that names the accepted set, never a silently empty page. (optional)
      alg - Algorithms (comma-separated, OR logic). Matches ANY specified. (optional)
      compositeMode - Composite construction modes (comma-separated, OR logic): COMPOSITE_KEM_COMBINE or COMPOSITE_SIGNATURE. Selects among hybrid algorithms, which all publish kty=COMPOSITE. Simple algorithms never match. An unpublished construction is a 400 that names the accepted set, never a silently empty page. (optional)
      Returns:
      ApiResponse<List<SupportedAlgorithm>>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • listSupportedAlgorithmsAsync

      public okhttp3.Call listSupportedAlgorithmsAsync(@Nonnull UUID tenantId, @Nullable String category, @Nullable String status, @Nullable Integer minSecurityLevel, @Nullable Integer maxSecurityLevel, @Nullable Set<String> keyOps, @Nullable Set<String> standards, @Nullable Set<String> kty, @Nullable Set<String> alg, @Nullable Set<String> compositeMode, ApiCallback<List<SupportedAlgorithm>> _callback) throws ApiException
      Get permitted algorithms for tenant (policy-filtered) (asynchronously) Returns cryptographic algorithms filtered by tenant-specific algorithm policies. ## Policy Resolution 1. Tenant-specific algorithm policy (if configured) — applied as a filter 2. When no active policy exists for the tenant, the active deployment policy applies, and the full catalog only when there is no deployment policy either ## Filtering Logic - Algorithms explicitly denied by policy are excluded - Algorithms not mentioned in policy are included by default - Composite algorithms inherit filtering from component algorithms - When the policy requires composite keys (`requireComposite`), every standalone post-quantum algorithm is excluded, hash-based signatures (SLH-DSA, XMSS, LMS) excepted — the rule the cryptographic service applies when it refuses such a key at creation and rotation. The list is the server's verdict: a client renders it rather than re-judging the hybrid requirement. ## Query Parameters (all optional, same as the cryptographic service) | Parameter | Type | Logic | Description | |-----------|------|-------|-------------| | `category` | string | = | CLASSICAL, POST_QUANTUM, or HYBRID | | `status` | string | = | RECOMMENDED, EXPERIMENTAL, or LEGACY | | `minSecurityLevel` | int | >= | Minimum NIST level (1, 3, 5) | | `maxSecurityLevel` | int | <= | Maximum NIST level (1, 3, 5) | | `keyOps` | array | AND | Required operations (must support ALL) | | `standards` | array | AND | Required standards (must have ALL) | | `kty` | array | OR | Key types (matches ANY, including COMPOSITE) | | `alg` | array | OR | Algorithms (matches ANY) | ## Use Cases - Populate key generation UI with permitted algorithms - Validate algorithm selection against policy - Audit effective algorithm permissions ## Authentication & Authorization - JWT with tenantId claim matching path parameter - Scope: admin.tenant.algorithms.read - Service-to-service calls from the cryptographic service: the tenant was already validated by that service
      Parameters:
      tenantId - Tenant UUID (required)
      category - Filter by category: CLASSICAL, POST_QUANTUM, or HYBRID (optional)
      status - Filter by status: RECOMMENDED, EXPERIMENTAL, or LEGACY (optional)
      minSecurityLevel - Minimum NIST security level (1, 3, or 5) (optional)
      maxSecurityLevel - Maximum NIST security level (1, 3, or 5) (optional)
      keyOps - Required operations (comma-separated). Must support ALL specified. (optional)
      standards - Required standards (comma-separated). Must have ALL specified. (optional)
      kty - Key types (comma-separated, OR logic). Matches ANY specified. Use COMPOSITE for hybrid algorithms — a composite entry's construction is selected with compositeMode, not here. An unpublished token is a 400 that names the accepted set, never a silently empty page. (optional)
      alg - Algorithms (comma-separated, OR logic). Matches ANY specified. (optional)
      compositeMode - Composite construction modes (comma-separated, OR logic): COMPOSITE_KEM_COMBINE or COMPOSITE_SIGNATURE. Selects among hybrid algorithms, which all publish kty=COMPOSITE. Simple algorithms never match. An unpublished construction is a 400 that names the accepted set, never a silently empty page. (optional)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object