Package co.ankatech.keymanagement.client.keymanagement.api

Class TenantResourcesKeyLifecycleApi

java.lang.Object
co.ankatech.keymanagement.client.keymanagement.api.TenantResourcesKeyLifecycleApi
public class TenantResourcesKeyLifecycleApi extends Object

  • Constructor Details

    • TenantResourcesKeyLifecycleApi

      public TenantResourcesKeyLifecycleApi()

    • TenantResourcesKeyLifecycleApi

      public TenantResourcesKeyLifecycleApi(ApiClient apiClient)

  • Method Details

    • getApiClient

      public ApiClient getApiClient()

    • setApiClient

      public void setApiClient(ApiClient apiClient)

    • getHostIndex

      public int getHostIndex()

    • setHostIndex

      public void setHostIndex(int hostIndex)

    • getCustomBaseUrl

      public String getCustomBaseUrl()

    • setCustomBaseUrl

      public void setCustomBaseUrl(String customBaseUrl)

    • analyzeKeystoreCall

      public okhttp3.Call analyzeKeystoreCall(@Nonnull UUID tenantId, @Nonnull File keystore, @Nonnull File metadata, @Nullable File password, ApiCallback _callback) throws ApiException
      Build call for analyzeKeystore
      Parameters:
      tenantId - (required)
      keystore - (required)
      metadata - (required)
      password - (optional)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • analyzeKeystore

      public KeystoreAnalysisResponse analyzeKeystore(@Nonnull UUID tenantId, @Nonnull File keystore, @Nonnull File metadata, @Nullable File password) throws ApiException
      Analyze a keystore (PKCS#12 / JKS) WITHOUT importing it (read-only preview) Inspects a PKCS#12 or JKS keystore and reports, per alias, the detected algorithm, the projected Stable KID, and the cryptographic purpose derived from the certificate's X.509 KeyUsage (ENCRYPT_DECRYPT, SIGN_VERIFY, or AMBIGUOUS), by S2S-proxying to the cryptographic service. Sent as `multipart/form-data` with the same three parts as the import endpoint: `metadata` (JSON), `keystore` (binary file), and an optional `password` (binary). This is a pure preview: NOTHING is imported, wrapped, audited, or persisted, and an ambiguous alias is reported (200) rather than rejected. The password is forwarded to Core API as raw bytes — never logged, stringified, or echoed. **Authorization**: requires scope `migration.importKeystore` (shared with the import endpoint; analysis is gated on the same scope).
      Parameters:
      tenantId - (required)
      keystore - (required)
      metadata - (required)
      password - (optional)
      Returns:
      KeystoreAnalysisResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • analyzeKeystoreWithHttpInfo

      public ApiResponse<KeystoreAnalysisResponse> analyzeKeystoreWithHttpInfo(@Nonnull UUID tenantId, @Nonnull File keystore, @Nonnull File metadata, @Nullable File password) throws ApiException
      Analyze a keystore (PKCS#12 / JKS) WITHOUT importing it (read-only preview) Inspects a PKCS#12 or JKS keystore and reports, per alias, the detected algorithm, the projected Stable KID, and the cryptographic purpose derived from the certificate's X.509 KeyUsage (ENCRYPT_DECRYPT, SIGN_VERIFY, or AMBIGUOUS), by S2S-proxying to the cryptographic service. Sent as `multipart/form-data` with the same three parts as the import endpoint: `metadata` (JSON), `keystore` (binary file), and an optional `password` (binary). This is a pure preview: NOTHING is imported, wrapped, audited, or persisted, and an ambiguous alias is reported (200) rather than rejected. The password is forwarded to Core API as raw bytes — never logged, stringified, or echoed. **Authorization**: requires scope `migration.importKeystore` (shared with the import endpoint; analysis is gated on the same scope).
      Parameters:
      tenantId - (required)
      keystore - (required)
      metadata - (required)
      password - (optional)
      Returns:
      ApiResponse<KeystoreAnalysisResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • analyzeKeystoreAsync

      public okhttp3.Call analyzeKeystoreAsync(@Nonnull UUID tenantId, @Nonnull File keystore, @Nonnull File metadata, @Nullable File password, ApiCallback<KeystoreAnalysisResponse> _callback) throws ApiException
      Analyze a keystore (PKCS#12 / JKS) WITHOUT importing it (read-only preview) (asynchronously) Inspects a PKCS#12 or JKS keystore and reports, per alias, the detected algorithm, the projected Stable KID, and the cryptographic purpose derived from the certificate's X.509 KeyUsage (ENCRYPT_DECRYPT, SIGN_VERIFY, or AMBIGUOUS), by S2S-proxying to the cryptographic service. Sent as `multipart/form-data` with the same three parts as the import endpoint: `metadata` (JSON), `keystore` (binary file), and an optional `password` (binary). This is a pure preview: NOTHING is imported, wrapped, audited, or persisted, and an ambiguous alias is reported (200) rather than rejected. The password is forwarded to Core API as raw bytes — never logged, stringified, or echoed. **Authorization**: requires scope `migration.importKeystore` (shared with the import endpoint; analysis is gated on the same scope).
      Parameters:
      tenantId - (required)
      keystore - (required)
      metadata - (required)
      password - (optional)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • archiveKeyCall

      public okhttp3.Call archiveKeyCall(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback _callback) throws ApiException
      Build call for archiveKey
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • archiveKey

      public void archiveKey(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Archive a cryptographic key Moves a revoked key to archived state for compliance/audit retention. Archived keys are read-only and cannot be used for cryptographic operations. Workflow: 1. Validates tenant access from JWT 2. Validates key is in REVOKED state 3. Updates key status to ARCHIVED in the database 4. Records an audit event Use cases: - Long-term compliance retention after revocation - Audit trail preservation - Historical data retention requirements State transition: REVOKED → ARCHIVED (other states rejected with 409). **Authorization**: requires scope `admin.keys.archive`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • archiveKeyWithHttpInfo

      public ApiResponse<Void> archiveKeyWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Archive a cryptographic key Moves a revoked key to archived state for compliance/audit retention. Archived keys are read-only and cannot be used for cryptographic operations. Workflow: 1. Validates tenant access from JWT 2. Validates key is in REVOKED state 3. Updates key status to ARCHIVED in the database 4. Records an audit event Use cases: - Long-term compliance retention after revocation - Audit trail preservation - Historical data retention requirements State transition: REVOKED → ARCHIVED (other states rejected with 409). **Authorization**: requires scope `admin.keys.archive`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      ApiResponse<Void>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • archiveKeyAsync

      public okhttp3.Call archiveKeyAsync(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback<Void> _callback) throws ApiException
      Archive a cryptographic key (asynchronously) Moves a revoked key to archived state for compliance/audit retention. Archived keys are read-only and cannot be used for cryptographic operations. Workflow: 1. Validates tenant access from JWT 2. Validates key is in REVOKED state 3. Updates key status to ARCHIVED in the database 4. Records an audit event Use cases: - Long-term compliance retention after revocation - Audit trail preservation - Historical data retention requirements State transition: REVOKED → ARCHIVED (other states rejected with 409). **Authorization**: requires scope `admin.keys.archive`.
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • cancelKeyDestructionCall

      public okhttp3.Call cancelKeyDestructionCall(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback _callback) throws ApiException
      Build call for cancelKeyDestruction
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • cancelKeyDestruction

      public void cancelKeyDestruction(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Cancel a scheduled key destruction Cancels a key's scheduled destruction before the platform runs it: every scheduled destruction order of the key ends CANCELLED, every version waiting for destruction returns to the status it had before the request was approved, and the key reads ARCHIVED again. A later destruction needs a new request and a new approval. A destruction request that is still waiting for approval is withdrawn through the quorum request's own cancel instead. Valid source state: PENDING_DESTRUCTION only. An executed destruction cannot be cancelled. **Authorization**: requires scope `admin.keys.cancel-destruction`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • cancelKeyDestructionWithHttpInfo

      public ApiResponse<Void> cancelKeyDestructionWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Cancel a scheduled key destruction Cancels a key's scheduled destruction before the platform runs it: every scheduled destruction order of the key ends CANCELLED, every version waiting for destruction returns to the status it had before the request was approved, and the key reads ARCHIVED again. A later destruction needs a new request and a new approval. A destruction request that is still waiting for approval is withdrawn through the quorum request's own cancel instead. Valid source state: PENDING_DESTRUCTION only. An executed destruction cannot be cancelled. **Authorization**: requires scope `admin.keys.cancel-destruction`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      ApiResponse<Void>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • cancelKeyDestructionAsync

      public okhttp3.Call cancelKeyDestructionAsync(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback<Void> _callback) throws ApiException
      Cancel a scheduled key destruction (asynchronously) Cancels a key's scheduled destruction before the platform runs it: every scheduled destruction order of the key ends CANCELLED, every version waiting for destruction returns to the status it had before the request was approved, and the key reads ARCHIVED again. A later destruction needs a new request and a new approval. A destruction request that is still waiting for approval is withdrawn through the quorum request's own cancel instead. Valid source state: PENDING_DESTRUCTION only. An executed destruction cannot be cancelled. **Authorization**: requires scope `admin.keys.cancel-destruction`.
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • exportKeyCall

      public okhttp3.Call exportKeyCall(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback _callback) throws ApiException
      Build call for exportKey
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • exportKey

      public AdminKeyExportResponse exportKey(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Export public key material and metadata for a key (public-only) Returns the PUBLIC key material and full operational metadata for a key. This is the S2S source the cryptographic service proxies to from its migration export endpoint. **Security — public material only**: private key material is never returned. - Simple asymmetric key: `publicKey` carries the Base64 SubjectPublicKeyInfo. - Symmetric key (`kty=oct`): `publicKey` is null (no secret material exposed). - Composite key: only component PUBLIC keys are returned via `components[]`; `publicKey` is null and no component private material is exposed. **Non-exportable keys** (`exportable=false`) are refused with `400 Bad Request`, mirroring the cryptographic service's export behavior; no key material is present in the refusal. **Tenant isolation**: a `kid` that does not exist for the authenticated tenant — including a key owned by another tenant — yields `404 Not Found` with a generic detail that does not reveal the key's existence elsewhere. **Authorization**: requires scope `admin.keys.read`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      AdminKeyExportResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • exportKeyWithHttpInfo

      public ApiResponse<AdminKeyExportResponse> exportKeyWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Export public key material and metadata for a key (public-only) Returns the PUBLIC key material and full operational metadata for a key. This is the S2S source the cryptographic service proxies to from its migration export endpoint. **Security — public material only**: private key material is never returned. - Simple asymmetric key: `publicKey` carries the Base64 SubjectPublicKeyInfo. - Symmetric key (`kty=oct`): `publicKey` is null (no secret material exposed). - Composite key: only component PUBLIC keys are returned via `components[]`; `publicKey` is null and no component private material is exposed. **Non-exportable keys** (`exportable=false`) are refused with `400 Bad Request`, mirroring the cryptographic service's export behavior; no key material is present in the refusal. **Tenant isolation**: a `kid` that does not exist for the authenticated tenant — including a key owned by another tenant — yields `404 Not Found` with a generic detail that does not reveal the key's existence elsewhere. **Authorization**: requires scope `admin.keys.read`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      ApiResponse<AdminKeyExportResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • exportKeyAsync

      public okhttp3.Call exportKeyAsync(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback<AdminKeyExportResponse> _callback) throws ApiException
      Export public key material and metadata for a key (public-only) (asynchronously) Returns the PUBLIC key material and full operational metadata for a key. This is the S2S source the cryptographic service proxies to from its migration export endpoint. **Security — public material only**: private key material is never returned. - Simple asymmetric key: `publicKey` carries the Base64 SubjectPublicKeyInfo. - Symmetric key (`kty=oct`): `publicKey` is null (no secret material exposed). - Composite key: only component PUBLIC keys are returned via `components[]`; `publicKey` is null and no component private material is exposed. **Non-exportable keys** (`exportable=false`) are refused with `400 Bad Request`, mirroring the cryptographic service's export behavior; no key material is present in the refusal. **Tenant isolation**: a `kid` that does not exist for the authenticated tenant — including a key owned by another tenant — yields `404 Not Found` with a generic detail that does not reveal the key's existence elsewhere. **Authorization**: requires scope `admin.keys.read`.
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • getKeyLifecycleCauseVerdictsCall

      public okhttp3.Call getKeyLifecycleCauseVerdictsCall(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback _callback) throws ApiException
      Build call for getKeyLifecycleCauseVerdicts
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • getKeyLifecycleCauseVerdicts

      public KeyLifecycleCauseVerdictsResponse getKeyLifecycleCauseVerdicts(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Project what each lifecycle act, under each cause, does to this key's read path Returns, for the key {kid}, the server verdict the suspend, revoke, archive and reactivate dialogs render: for every lifecycle act and every <code>KeyLifecycleCause</code>, whether DECRYPT, VERIFY and the REENCRYPT / RESIGN <em>source</em> legs stop, continue, or stop on some material versions only. Each cell is the tenant's effective lifecycle policy composed with the platform cause rule (<code>allowed = policyCell AND causeRule</code>), evaluated over the key's non-destroyed material versions; a source leg is decided on the DECRYPT / VERIFY row it reads on, never on the write row. The cause list is the published <code>KeyLifecycleCause</code> vocabulary. SUSPEND and REVOKE appear once per cause; ARCHIVE appears once, carrying the revocation cause the key already holds (retained through archive); REACTIVATE appears once with no cause. The response also states the key's current status and the causes it carries today. The endpoint performs ZERO writes (no database, HSM, cache, event or audit write). **Authorization**: requires scope `admin.keys.read`. The tenant boundary is enforced from the path `tenantId` (platform-admin-on-ROOT or `tenantId == jwtTenantId`) before any lookup. A kid that does not exist and a kid owned by another tenant produce the same 404.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      KeyLifecycleCauseVerdictsResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • getKeyLifecycleCauseVerdictsWithHttpInfo

      public ApiResponse<KeyLifecycleCauseVerdictsResponse> getKeyLifecycleCauseVerdictsWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Project what each lifecycle act, under each cause, does to this key's read path Returns, for the key {kid}, the server verdict the suspend, revoke, archive and reactivate dialogs render: for every lifecycle act and every <code>KeyLifecycleCause</code>, whether DECRYPT, VERIFY and the REENCRYPT / RESIGN <em>source</em> legs stop, continue, or stop on some material versions only. Each cell is the tenant's effective lifecycle policy composed with the platform cause rule (<code>allowed = policyCell AND causeRule</code>), evaluated over the key's non-destroyed material versions; a source leg is decided on the DECRYPT / VERIFY row it reads on, never on the write row. The cause list is the published <code>KeyLifecycleCause</code> vocabulary. SUSPEND and REVOKE appear once per cause; ARCHIVE appears once, carrying the revocation cause the key already holds (retained through archive); REACTIVATE appears once with no cause. The response also states the key's current status and the causes it carries today. The endpoint performs ZERO writes (no database, HSM, cache, event or audit write). **Authorization**: requires scope `admin.keys.read`. The tenant boundary is enforced from the path `tenantId` (platform-admin-on-ROOT or `tenantId == jwtTenantId`) before any lookup. A kid that does not exist and a kid owned by another tenant produce the same 404.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      ApiResponse<KeyLifecycleCauseVerdictsResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • getKeyLifecycleCauseVerdictsAsync

      public okhttp3.Call getKeyLifecycleCauseVerdictsAsync(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback<KeyLifecycleCauseVerdictsResponse> _callback) throws ApiException
      Project what each lifecycle act, under each cause, does to this key's read path (asynchronously) Returns, for the key {kid}, the server verdict the suspend, revoke, archive and reactivate dialogs render: for every lifecycle act and every <code>KeyLifecycleCause</code>, whether DECRYPT, VERIFY and the REENCRYPT / RESIGN <em>source</em> legs stop, continue, or stop on some material versions only. Each cell is the tenant's effective lifecycle policy composed with the platform cause rule (<code>allowed = policyCell AND causeRule</code>), evaluated over the key's non-destroyed material versions; a source leg is decided on the DECRYPT / VERIFY row it reads on, never on the write row. The cause list is the published <code>KeyLifecycleCause</code> vocabulary. SUSPEND and REVOKE appear once per cause; ARCHIVE appears once, carrying the revocation cause the key already holds (retained through archive); REACTIVATE appears once with no cause. The response also states the key's current status and the causes it carries today. The endpoint performs ZERO writes (no database, HSM, cache, event or audit write). **Authorization**: requires scope `admin.keys.read`. The tenant boundary is enforced from the path `tenantId` (platform-admin-on-ROOT or `tenantId == jwtTenantId`) before any lookup. A kid that does not exist and a kid owned by another tenant produce the same 404.
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • getKeyMetadataCall

      public okhttp3.Call getKeyMetadataCall(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback _callback) throws ApiException
      Build call for getKeyMetadata
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • getKeyMetadata

      public AdminKeyResponse getKeyMetadata(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Get key metadata Retrieves operational metadata for a single cryptographic key. The response is an `AdminKeyResponse` containing identity, algorithm, lifecycle state, usage counters, expiration timestamps, suspension / revocation / destruction metadata (when applicable), and caller-editable fields (`displayName`, `description`, `exportable`). Persistence-internal fields (surrogate id, version, deletedAt, lazy composite components) are never exposed. **Expired is derived, never stored**: `status` reads `expired` when the key's current material has passed its `expiresAt` or used up its `maxUsageLimit`, and `protectionStopReasons` names which (`EXPIRY_REACHED`, `USAGE_LIMIT_REACHED`, or both in that order); it is `[]` for every other status. Such a key no longer encrypts or signs, still decrypts and verifies what it already protected, and is rotated to protect again: `availableActions.canRotate` answers from the `ROTATE` cell of the tenant's effective dual lifecycle policy for the key's state, the cell `rotateKey` is admitted on, so under the DEFAULT and STRICT templates an expired key stays rotatable. **No key material**: the response carries no public key, for any caller. The public key (or, for a composite key, each component's) is released by `exportKey` (`GET /keys/{kid}/export`) only, and only for a key whose `exportable` is `true`: a key with `exportable=false` cannot be exported, not even in public form, which is the same rule the cryptographic service applies to its own export. **Authorization references**: `authorizationReferences` reports how many internal crypto use cases, cryptographic exchanges and standalone capability grants in this tenant reference the key, and their total. It is a reading: no key command is gated on it. It is absent on the service-to-service key read, where it is not computed. **Next rotation**: `nextRotationAt` is the instant the key is next due for automatic rotation, equal to the `nextDueAt` of `getKeyRotationSchedule` for the same key. It is present only when the key's schedule is `SCHEDULED`, may lie in the past when the key is overdue, and is present only for a caller that also holds `admin.keys.rotation-schedule.read`. **Authorization**: requires scope `admin.keys.read`. A caller reads its own tenant's keys. A platform administrator (`tenantId == ROOT_TENANT_ID`) reads any tenant's keys on a customer-operated deployment (`PRIVATE_CLOUD`, `ON_PREMISE`) and is refused with 403 on `SAAS`. Any other cross-tenant address answers **404**, byte-identical to a key that does not exist.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      AdminKeyResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • getKeyMetadataWithHttpInfo

      public ApiResponse<AdminKeyResponse> getKeyMetadataWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Get key metadata Retrieves operational metadata for a single cryptographic key. The response is an `AdminKeyResponse` containing identity, algorithm, lifecycle state, usage counters, expiration timestamps, suspension / revocation / destruction metadata (when applicable), and caller-editable fields (`displayName`, `description`, `exportable`). Persistence-internal fields (surrogate id, version, deletedAt, lazy composite components) are never exposed. **Expired is derived, never stored**: `status` reads `expired` when the key's current material has passed its `expiresAt` or used up its `maxUsageLimit`, and `protectionStopReasons` names which (`EXPIRY_REACHED`, `USAGE_LIMIT_REACHED`, or both in that order); it is `[]` for every other status. Such a key no longer encrypts or signs, still decrypts and verifies what it already protected, and is rotated to protect again: `availableActions.canRotate` answers from the `ROTATE` cell of the tenant's effective dual lifecycle policy for the key's state, the cell `rotateKey` is admitted on, so under the DEFAULT and STRICT templates an expired key stays rotatable. **No key material**: the response carries no public key, for any caller. The public key (or, for a composite key, each component's) is released by `exportKey` (`GET /keys/{kid}/export`) only, and only for a key whose `exportable` is `true`: a key with `exportable=false` cannot be exported, not even in public form, which is the same rule the cryptographic service applies to its own export. **Authorization references**: `authorizationReferences` reports how many internal crypto use cases, cryptographic exchanges and standalone capability grants in this tenant reference the key, and their total. It is a reading: no key command is gated on it. It is absent on the service-to-service key read, where it is not computed. **Next rotation**: `nextRotationAt` is the instant the key is next due for automatic rotation, equal to the `nextDueAt` of `getKeyRotationSchedule` for the same key. It is present only when the key's schedule is `SCHEDULED`, may lie in the past when the key is overdue, and is present only for a caller that also holds `admin.keys.rotation-schedule.read`. **Authorization**: requires scope `admin.keys.read`. A caller reads its own tenant's keys. A platform administrator (`tenantId == ROOT_TENANT_ID`) reads any tenant's keys on a customer-operated deployment (`PRIVATE_CLOUD`, `ON_PREMISE`) and is refused with 403 on `SAAS`. Any other cross-tenant address answers **404**, byte-identical to a key that does not exist.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      ApiResponse<AdminKeyResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • getKeyMetadataAsync

      public okhttp3.Call getKeyMetadataAsync(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback<AdminKeyResponse> _callback) throws ApiException
      Get key metadata (asynchronously) Retrieves operational metadata for a single cryptographic key. The response is an `AdminKeyResponse` containing identity, algorithm, lifecycle state, usage counters, expiration timestamps, suspension / revocation / destruction metadata (when applicable), and caller-editable fields (`displayName`, `description`, `exportable`). Persistence-internal fields (surrogate id, version, deletedAt, lazy composite components) are never exposed. **Expired is derived, never stored**: `status` reads `expired` when the key's current material has passed its `expiresAt` or used up its `maxUsageLimit`, and `protectionStopReasons` names which (`EXPIRY_REACHED`, `USAGE_LIMIT_REACHED`, or both in that order); it is `[]` for every other status. Such a key no longer encrypts or signs, still decrypts and verifies what it already protected, and is rotated to protect again: `availableActions.canRotate` answers from the `ROTATE` cell of the tenant's effective dual lifecycle policy for the key's state, the cell `rotateKey` is admitted on, so under the DEFAULT and STRICT templates an expired key stays rotatable. **No key material**: the response carries no public key, for any caller. The public key (or, for a composite key, each component's) is released by `exportKey` (`GET /keys/{kid}/export`) only, and only for a key whose `exportable` is `true`: a key with `exportable=false` cannot be exported, not even in public form, which is the same rule the cryptographic service applies to its own export. **Authorization references**: `authorizationReferences` reports how many internal crypto use cases, cryptographic exchanges and standalone capability grants in this tenant reference the key, and their total. It is a reading: no key command is gated on it. It is absent on the service-to-service key read, where it is not computed. **Next rotation**: `nextRotationAt` is the instant the key is next due for automatic rotation, equal to the `nextDueAt` of `getKeyRotationSchedule` for the same key. It is present only when the key's schedule is `SCHEDULED`, may lie in the past when the key is overdue, and is present only for a caller that also holds `admin.keys.rotation-schedule.read`. **Authorization**: requires scope `admin.keys.read`. A caller reads its own tenant's keys. A platform administrator (`tenantId == ROOT_TENANT_ID`) reads any tenant's keys on a customer-operated deployment (`PRIVATE_CLOUD`, `ON_PREMISE`) and is refused with 403 on `SAAS`. Any other cross-tenant address answers **404**, byte-identical to a key that does not exist.
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • importKeyCall

      public okhttp3.Call importKeyCall(@Nonnull UUID tenantId, @Nonnull KeyImportRequest keyImportRequest, ApiCallback _callback) throws ApiException
      Build call for importKey
      Parameters:
      tenantId - (required)
      keyImportRequest - Public-key import specification (kid, kty, alg, publicKey/components). Mirrors the cryptographic service's key import request. (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • importKey

      public KeyExportResponse importKey(@Nonnull UUID tenantId, @Nonnull KeyImportRequest keyImportRequest) throws ApiException
      Import a PUBLIC key (simple or composite) into the tenant keystore Imports public key material for a simple or composite (hybrid) key, by S2S-proxying to the cryptographic service. This endpoint imports PUBLIC keys only — private key material is never accepted. **Vocabulary constraints (both enforced upstream, both surfaced as `400`)** - `kty` MUST be a published key type. A stored value outside the vocabulary can neither be filtered on nor round-tripped, so it is refused rather than stored. - For a composite key, `alg` MUST name a pairing this deployment's composite catalogue carries. The construction — whether the component secrets are combined into one or both components sign one composite message — is resolved FROM the pairing rather than restated by the caller, so an uncatalogued pairing has no resolvable construction and cannot be served. Call `GET /api/v3/admin/tenants/{tenantId}/supported-algorithms?kty=COMPOSITE` for the pairings this deployment accepts — the tenant plane, reachable with the same tenant-scoped authorization this import already requires. **Authorization**: requires scope `migration.importKey`.
      Parameters:
      tenantId - (required)
      keyImportRequest - Public-key import specification (kid, kty, alg, publicKey/components). Mirrors the cryptographic service's key import request. (required)
      Returns:
      KeyExportResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • importKeyWithHttpInfo

      public ApiResponse<KeyExportResponse> importKeyWithHttpInfo(@Nonnull UUID tenantId, @Nonnull KeyImportRequest keyImportRequest) throws ApiException
      Import a PUBLIC key (simple or composite) into the tenant keystore Imports public key material for a simple or composite (hybrid) key, by S2S-proxying to the cryptographic service. This endpoint imports PUBLIC keys only — private key material is never accepted. **Vocabulary constraints (both enforced upstream, both surfaced as `400`)** - `kty` MUST be a published key type. A stored value outside the vocabulary can neither be filtered on nor round-tripped, so it is refused rather than stored. - For a composite key, `alg` MUST name a pairing this deployment's composite catalogue carries. The construction — whether the component secrets are combined into one or both components sign one composite message — is resolved FROM the pairing rather than restated by the caller, so an uncatalogued pairing has no resolvable construction and cannot be served. Call `GET /api/v3/admin/tenants/{tenantId}/supported-algorithms?kty=COMPOSITE` for the pairings this deployment accepts — the tenant plane, reachable with the same tenant-scoped authorization this import already requires. **Authorization**: requires scope `migration.importKey`.
      Parameters:
      tenantId - (required)
      keyImportRequest - Public-key import specification (kid, kty, alg, publicKey/components). Mirrors the cryptographic service's key import request. (required)
      Returns:
      ApiResponse<KeyExportResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • importKeyAsync

      public okhttp3.Call importKeyAsync(@Nonnull UUID tenantId, @Nonnull KeyImportRequest keyImportRequest, ApiCallback<KeyExportResponse> _callback) throws ApiException
      Import a PUBLIC key (simple or composite) into the tenant keystore (asynchronously) Imports public key material for a simple or composite (hybrid) key, by S2S-proxying to the cryptographic service. This endpoint imports PUBLIC keys only — private key material is never accepted. **Vocabulary constraints (both enforced upstream, both surfaced as `400`)** - `kty` MUST be a published key type. A stored value outside the vocabulary can neither be filtered on nor round-tripped, so it is refused rather than stored. - For a composite key, `alg` MUST name a pairing this deployment's composite catalogue carries. The construction — whether the component secrets are combined into one or both components sign one composite message — is resolved FROM the pairing rather than restated by the caller, so an uncatalogued pairing has no resolvable construction and cannot be served. Call `GET /api/v3/admin/tenants/{tenantId}/supported-algorithms?kty=COMPOSITE` for the pairings this deployment accepts — the tenant plane, reachable with the same tenant-scoped authorization this import already requires. **Authorization**: requires scope `migration.importKey`.
      Parameters:
      tenantId - (required)
      keyImportRequest - Public-key import specification (kid, kty, alg, publicKey/components). Mirrors the cryptographic service's key import request. (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • importKeystoreCall

      public okhttp3.Call importKeystoreCall(@Nonnull UUID tenantId, @Nonnull File keystore, @Nonnull File metadata, @Nullable File password, ApiCallback _callback) throws ApiException
      Build call for importKeystore
      Parameters:
      tenantId - (required)
      keystore - (required)
      metadata - (required)
      password - (optional)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • importKeystore

      public KeystoreImportResponse importKeystore(@Nonnull UUID tenantId, @Nonnull File keystore, @Nonnull File metadata, @Nullable File password) throws ApiException
      Import a keystore (PKCS#12 / JKS) into the tenant keystore Imports private keys and trusted certificates from a PKCS#12 or JKS keystore into the tenant keystore, by S2S-proxying to the cryptographic service. Sent as `multipart/form-data` with three parts: `metadata` (JSON), `keystore` (binary file), and an optional `password` (binary). The password is forwarded to the cryptographic service as raw bytes — it is never logged, stringified, or echoed in any error or audit payload. **Authorization**: requires scope `migration.importKeystore`.
      Parameters:
      tenantId - (required)
      keystore - (required)
      metadata - (required)
      password - (optional)
      Returns:
      KeystoreImportResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • importKeystoreWithHttpInfo

      public ApiResponse<KeystoreImportResponse> importKeystoreWithHttpInfo(@Nonnull UUID tenantId, @Nonnull File keystore, @Nonnull File metadata, @Nullable File password) throws ApiException
      Import a keystore (PKCS#12 / JKS) into the tenant keystore Imports private keys and trusted certificates from a PKCS#12 or JKS keystore into the tenant keystore, by S2S-proxying to the cryptographic service. Sent as `multipart/form-data` with three parts: `metadata` (JSON), `keystore` (binary file), and an optional `password` (binary). The password is forwarded to the cryptographic service as raw bytes — it is never logged, stringified, or echoed in any error or audit payload. **Authorization**: requires scope `migration.importKeystore`.
      Parameters:
      tenantId - (required)
      keystore - (required)
      metadata - (required)
      password - (optional)
      Returns:
      ApiResponse<KeystoreImportResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • importKeystoreAsync

      public okhttp3.Call importKeystoreAsync(@Nonnull UUID tenantId, @Nonnull File keystore, @Nonnull File metadata, @Nullable File password, ApiCallback<KeystoreImportResponse> _callback) throws ApiException
      Import a keystore (PKCS#12 / JKS) into the tenant keystore (asynchronously) Imports private keys and trusted certificates from a PKCS#12 or JKS keystore into the tenant keystore, by S2S-proxying to the cryptographic service. Sent as `multipart/form-data` with three parts: `metadata` (JSON), `keystore` (binary file), and an optional `password` (binary). The password is forwarded to the cryptographic service as raw bytes — it is never logged, stringified, or echoed in any error or audit payload. **Authorization**: requires scope `migration.importKeystore`.
      Parameters:
      tenantId - (required)
      keystore - (required)
      metadata - (required)
      password - (optional)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • listKeyDestructionOrdersCall

      public okhttp3.Call listKeyDestructionOrdersCall(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback _callback) throws ApiException
      Build call for listKeyDestructionOrders
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • listKeyDestructionOrders

      public List<KeyDestructionOrderView> listKeyDestructionOrders(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      List a key's destruction orders Lists, newest first, what the approval of each destruction request of the key scheduled: the versions it destroys, when it runs (`eligibleFrom`), the cooling-off period and where it came from, the quorum request that approved it, and how it ended — SCHEDULED, EXECUTED, CANCELLED or FAILED. A FAILED order destroyed nothing and is never retried; cancel the destruction and request it again. A destruction request still waiting for approval is not an order yet: read it through the quorum request. A destroyed key keeps its orders, so the history of its destruction stays readable. **Authorization**: requires scope `admin.keys.read`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      List<KeyDestructionOrderView>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • listKeyDestructionOrdersWithHttpInfo

      public ApiResponse<List<KeyDestructionOrderView>> listKeyDestructionOrdersWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      List a key's destruction orders Lists, newest first, what the approval of each destruction request of the key scheduled: the versions it destroys, when it runs (`eligibleFrom`), the cooling-off period and where it came from, the quorum request that approved it, and how it ended — SCHEDULED, EXECUTED, CANCELLED or FAILED. A FAILED order destroyed nothing and is never retried; cancel the destruction and request it again. A destruction request still waiting for approval is not an order yet: read it through the quorum request. A destroyed key keeps its orders, so the history of its destruction stays readable. **Authorization**: requires scope `admin.keys.read`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      ApiResponse<List<KeyDestructionOrderView>>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • listKeyDestructionOrdersAsync

      public okhttp3.Call listKeyDestructionOrdersAsync(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback<List<KeyDestructionOrderView>> _callback) throws ApiException
      List a key's destruction orders (asynchronously) Lists, newest first, what the approval of each destruction request of the key scheduled: the versions it destroys, when it runs (`eligibleFrom`), the cooling-off period and where it came from, the quorum request that approved it, and how it ended — SCHEDULED, EXECUTED, CANCELLED or FAILED. A FAILED order destroyed nothing and is never retried; cancel the destruction and request it again. A destruction request still waiting for approval is not an order yet: read it through the quorum request. A destroyed key keeps its orders, so the history of its destruction stays readable. **Authorization**: requires scope `admin.keys.read`.
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • listKeysCall

      public okhttp3.Call listKeysCall(@Nonnull UUID tenantId, @Nullable String status, @Nullable String origin, @Nullable Boolean restricted, @Nullable String kty, @Nullable String conformance, @Nullable Integer page, @Nullable Integer size, @Nullable List<String> sort, ApiCallback _callback) throws ApiException
      Build call for listKeys
      Parameters:
      tenantId - (required)
      status - (optional)
      origin - Optional key-origin filter, applied server-side BEFORE pagination, using the SAME token a key's `origin` field carries in the response: `GENERATED` or `IMPORTED`. Absent or empty means no filter. Any other value is rejected with 400 — never a silently empty page. (optional)
      restricted - Optional restricted-flag filter, applied server-side BEFORE pagination. (optional)
      kty - Optional key-type filter, applied server-side BEFORE pagination, using the SAME token a key's `kty` field carries in the response: `ML-KEM`, `ML-DSA`, `SLH-DSA`, `FALCON`, `XMSS`, `LMS`, `HQC`, `FRODO`, `CMCE`, `BIKE`, `SABER`, `NTRU`, `NTRUPRIME`, `SMAUG-T`, `RSA`, `EC`, `OKP`, `oct`, `SM2`, `GOST-EC`, and `COMPOSITE` for every hybrid pairing. A composite key publishes one coarse token; its pairing is named by `alg` and its construction by `compositeMode`. Absent or empty means no filter. Any other value is rejected with 400. (optional)
      conformance - Optional conformance filter, applied server-side BEFORE pagination. ALL (or absent) = no filter; CONFORMING / NON_CONFORMING select by the per-key conformance verdict. Keys with no conformance basis are excluded from both. (optional)
      page - Zero-based page index (0..N) (optional, default to 0)
      size - The size of the page to be returned (optional, default to 25)
      sort - Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported. (optional)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • listKeys

      public PageAdminKeyResponse listKeys(@Nonnull UUID tenantId, @Nullable String status, @Nullable String origin, @Nullable Boolean restricted, @Nullable String kty, @Nullable String conformance, @Nullable Integer page, @Nullable Integer size, @Nullable List<String> sort) throws ApiException
      List keys for tenant (paginated) Returns a paginated view of cryptographic keys owned by the specified tenant, optionally filtered by lifecycle status. **No key material**: a row carries no public key, for any caller, so a page's size is bounded by its row count whatever algorithms it lists (a Classic McEliece public key alone is 1.39 MB of Base64). The public key is released by `exportKey` (`GET /keys/{kid}/export`) only. **Population**: without `status`, every key the tenant still holds, in any lifecycle state: `active`, `expired`, `suspended`, `revoked`, `archived` and `pending_destruction`. Each row's `status` and material members (`alg`, `kty`, usage, expiry, `destructionEligibleFrom`) are read from the same material the single-key read `GET /keys/{kid}` uses, so a key reports the same `status` on both. Destroyed keys are never in the default list. **Deleted view** (`status=deleted_logical`, and only that value): the tenant's destroyed keys, read-only. A Deleted-view row is identified by `uuid`, the key identity the audit trail records for every operation the key performed; its `kid` names the same key, because a destroyed key's kid is never given to another key and no new key can be created under it. It is built from the key identity alone: it carries `kid`, `uuid`, `tenantId`, `status`, `displayName`, `description`, the revocation cause and reason, `revokedAt`, `archivedAt`, `deletedAt`, the record timestamps and `updatedBy`, and never `alg`, `kty`, `keyType`, `compositeMode`, `keyOps`, `origin`, `exportable`, usage, expiry, `authorizationReferences`, `conforming` or `hasAdmissibleTarget`. Every action flag on it is `allowed=false`. A `kty`, `origin` or `restricted` filter matches no Deleted-view row, and neither conformance value selects one. **Lifecycle timestamps**: `revokedAt` is present once a key has been revoked, `archivedAt` once it has been archived, and `deletedAt` only on a Deleted-view row. **Action flags**: every row carries `availableActions` with seven flags — `canRevoke`, `canArchive`, `canMarkForDestruction`, `canCancelDestruction`, `canRotate`, `canSuspend`, `canReactivate` — computed from the row's state and the caller's scopes. A caller lacking a flag's scope reads `Insufficient privileges`. `canPatch` is published by `GET /keys/{kid}` only. The flags are a reading; every action endpoint enforces its own rule. **Response shape**: a paged `Page<AdminKeyResponse>` envelope with `content` (the array of keys for the current page), `totalElements`, `totalPages`, `number` (zero-based page index), `size`, and the standard pagination flags (`first`, `last`, `empty`, `numberOfElements`). **Pagination**: server-side. Default `size=25`, default sort `createdAt,desc`. Max `size=200` (rejected with 400 above). Sort fields allow-list: `createdAt`, `expiresAt`, `alg`, `kty`, `status`, `kid`. Any other sort field returns 400. Sorting by `kty` orders over ONE vocabulary: every composite key carries the single coarse token `COMPOSITE`, so the ordering is over the published key types and not over a column whose values follow two conventions. **Query parameters**: - `status` (optional): filter by exact lifecycle state, using the SAME token a key's `status` field carries in the response — `active`, `pending_rotation`, `rotated`, `expired`, `revoked`, `archived`, `deleted_logical`, `suspended`, `pending_destruction`. Absent or empty means no filter. - `kty` (optional): filter by exact key type, using the SAME token a key's `kty` field carries in the response — `ML-KEM`, `ML-DSA`, `SLH-DSA`, `FALCON`, `XMSS`, `LMS`, `HQC`, `FRODO`, `CMCE`, `BIKE`, `SABER`, `NTRU`, `NTRUPRIME`, `SMAUG-T`, `RSA`, `EC`, `OKP`, `oct`, `SM2`, `GOST-EC`, and `COMPOSITE` for every hybrid pairing. A composite key's construction is carried by `compositeMode` and its pairing by `alg`, never by `kty`. Absent or empty means no filter. - `origin` (optional): filter by exact key origin, using the SAME token a key's `origin` field carries in the response — `GENERATED` or `IMPORTED`. Absent or empty means no filter. Any other value is rejected with 400, never answered with an empty page. - `page` (optional, default 0): zero-based page index. - `size` (optional, default 25, max 200): page size. - `sort` (optional, default `createdAt,desc`): sort field + direction. **Authorization references**: every key on the page except a Deleted-view row carries `authorizationReferences`, resolved for the whole page at once — how many internal crypto use cases, cryptographic exchanges and standalone capability grants in this tenant reference it, and their total. It is a reading: no key command is gated on it. It is absent on the service-to-service listing, where it is not computed. The conformance members `conforming` and `hasAdmissibleTarget` are computed for live keys only (`active`, `expired`, `suspended`). **Next rotation**: `nextRotationAt` is the instant a key is next due for automatic rotation, equal to the `nextDueAt` of `getKeyRotationSchedule` for that key. It is present only on a key whose schedule is `SCHEDULED`, may lie in the past when the key is overdue, and is present only for a caller that also holds `admin.keys.rotation-schedule.read`. It is never on a Deleted-view row. **Authorization**: requires scope `admin.keys.read`. A caller lists its own tenant's keys. A platform administrator (`tenantId == ROOT_TENANT_ID`) lists any tenant's keys on a customer-operated deployment (`PRIVATE_CLOUD`, `ON_PREMISE`) and is refused with 403 on `SAAS`. Any other cross-tenant address answers **404**.
      Parameters:
      tenantId - (required)
      status - (optional)
      origin - Optional key-origin filter, applied server-side BEFORE pagination, using the SAME token a key's `origin` field carries in the response: `GENERATED` or `IMPORTED`. Absent or empty means no filter. Any other value is rejected with 400 — never a silently empty page. (optional)
      restricted - Optional restricted-flag filter, applied server-side BEFORE pagination. (optional)
      kty - Optional key-type filter, applied server-side BEFORE pagination, using the SAME token a key's `kty` field carries in the response: `ML-KEM`, `ML-DSA`, `SLH-DSA`, `FALCON`, `XMSS`, `LMS`, `HQC`, `FRODO`, `CMCE`, `BIKE`, `SABER`, `NTRU`, `NTRUPRIME`, `SMAUG-T`, `RSA`, `EC`, `OKP`, `oct`, `SM2`, `GOST-EC`, and `COMPOSITE` for every hybrid pairing. A composite key publishes one coarse token; its pairing is named by `alg` and its construction by `compositeMode`. Absent or empty means no filter. Any other value is rejected with 400. (optional)
      conformance - Optional conformance filter, applied server-side BEFORE pagination. ALL (or absent) = no filter; CONFORMING / NON_CONFORMING select by the per-key conformance verdict. Keys with no conformance basis are excluded from both. (optional)
      page - Zero-based page index (0..N) (optional, default to 0)
      size - The size of the page to be returned (optional, default to 25)
      sort - Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported. (optional)
      Returns:
      PageAdminKeyResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • listKeysWithHttpInfo

      public ApiResponse<PageAdminKeyResponse> listKeysWithHttpInfo(@Nonnull UUID tenantId, @Nullable String status, @Nullable String origin, @Nullable Boolean restricted, @Nullable String kty, @Nullable String conformance, @Nullable Integer page, @Nullable Integer size, @Nullable List<String> sort) throws ApiException
      List keys for tenant (paginated) Returns a paginated view of cryptographic keys owned by the specified tenant, optionally filtered by lifecycle status. **No key material**: a row carries no public key, for any caller, so a page's size is bounded by its row count whatever algorithms it lists (a Classic McEliece public key alone is 1.39 MB of Base64). The public key is released by `exportKey` (`GET /keys/{kid}/export`) only. **Population**: without `status`, every key the tenant still holds, in any lifecycle state: `active`, `expired`, `suspended`, `revoked`, `archived` and `pending_destruction`. Each row's `status` and material members (`alg`, `kty`, usage, expiry, `destructionEligibleFrom`) are read from the same material the single-key read `GET /keys/{kid}` uses, so a key reports the same `status` on both. Destroyed keys are never in the default list. **Deleted view** (`status=deleted_logical`, and only that value): the tenant's destroyed keys, read-only. A Deleted-view row is identified by `uuid`, the key identity the audit trail records for every operation the key performed; its `kid` names the same key, because a destroyed key's kid is never given to another key and no new key can be created under it. It is built from the key identity alone: it carries `kid`, `uuid`, `tenantId`, `status`, `displayName`, `description`, the revocation cause and reason, `revokedAt`, `archivedAt`, `deletedAt`, the record timestamps and `updatedBy`, and never `alg`, `kty`, `keyType`, `compositeMode`, `keyOps`, `origin`, `exportable`, usage, expiry, `authorizationReferences`, `conforming` or `hasAdmissibleTarget`. Every action flag on it is `allowed=false`. A `kty`, `origin` or `restricted` filter matches no Deleted-view row, and neither conformance value selects one. **Lifecycle timestamps**: `revokedAt` is present once a key has been revoked, `archivedAt` once it has been archived, and `deletedAt` only on a Deleted-view row. **Action flags**: every row carries `availableActions` with seven flags — `canRevoke`, `canArchive`, `canMarkForDestruction`, `canCancelDestruction`, `canRotate`, `canSuspend`, `canReactivate` — computed from the row's state and the caller's scopes. A caller lacking a flag's scope reads `Insufficient privileges`. `canPatch` is published by `GET /keys/{kid}` only. The flags are a reading; every action endpoint enforces its own rule. **Response shape**: a paged `Page<AdminKeyResponse>` envelope with `content` (the array of keys for the current page), `totalElements`, `totalPages`, `number` (zero-based page index), `size`, and the standard pagination flags (`first`, `last`, `empty`, `numberOfElements`). **Pagination**: server-side. Default `size=25`, default sort `createdAt,desc`. Max `size=200` (rejected with 400 above). Sort fields allow-list: `createdAt`, `expiresAt`, `alg`, `kty`, `status`, `kid`. Any other sort field returns 400. Sorting by `kty` orders over ONE vocabulary: every composite key carries the single coarse token `COMPOSITE`, so the ordering is over the published key types and not over a column whose values follow two conventions. **Query parameters**: - `status` (optional): filter by exact lifecycle state, using the SAME token a key's `status` field carries in the response — `active`, `pending_rotation`, `rotated`, `expired`, `revoked`, `archived`, `deleted_logical`, `suspended`, `pending_destruction`. Absent or empty means no filter. - `kty` (optional): filter by exact key type, using the SAME token a key's `kty` field carries in the response — `ML-KEM`, `ML-DSA`, `SLH-DSA`, `FALCON`, `XMSS`, `LMS`, `HQC`, `FRODO`, `CMCE`, `BIKE`, `SABER`, `NTRU`, `NTRUPRIME`, `SMAUG-T`, `RSA`, `EC`, `OKP`, `oct`, `SM2`, `GOST-EC`, and `COMPOSITE` for every hybrid pairing. A composite key's construction is carried by `compositeMode` and its pairing by `alg`, never by `kty`. Absent or empty means no filter. - `origin` (optional): filter by exact key origin, using the SAME token a key's `origin` field carries in the response — `GENERATED` or `IMPORTED`. Absent or empty means no filter. Any other value is rejected with 400, never answered with an empty page. - `page` (optional, default 0): zero-based page index. - `size` (optional, default 25, max 200): page size. - `sort` (optional, default `createdAt,desc`): sort field + direction. **Authorization references**: every key on the page except a Deleted-view row carries `authorizationReferences`, resolved for the whole page at once — how many internal crypto use cases, cryptographic exchanges and standalone capability grants in this tenant reference it, and their total. It is a reading: no key command is gated on it. It is absent on the service-to-service listing, where it is not computed. The conformance members `conforming` and `hasAdmissibleTarget` are computed for live keys only (`active`, `expired`, `suspended`). **Next rotation**: `nextRotationAt` is the instant a key is next due for automatic rotation, equal to the `nextDueAt` of `getKeyRotationSchedule` for that key. It is present only on a key whose schedule is `SCHEDULED`, may lie in the past when the key is overdue, and is present only for a caller that also holds `admin.keys.rotation-schedule.read`. It is never on a Deleted-view row. **Authorization**: requires scope `admin.keys.read`. A caller lists its own tenant's keys. A platform administrator (`tenantId == ROOT_TENANT_ID`) lists any tenant's keys on a customer-operated deployment (`PRIVATE_CLOUD`, `ON_PREMISE`) and is refused with 403 on `SAAS`. Any other cross-tenant address answers **404**.
      Parameters:
      tenantId - (required)
      status - (optional)
      origin - Optional key-origin filter, applied server-side BEFORE pagination, using the SAME token a key's `origin` field carries in the response: `GENERATED` or `IMPORTED`. Absent or empty means no filter. Any other value is rejected with 400 — never a silently empty page. (optional)
      restricted - Optional restricted-flag filter, applied server-side BEFORE pagination. (optional)
      kty - Optional key-type filter, applied server-side BEFORE pagination, using the SAME token a key's `kty` field carries in the response: `ML-KEM`, `ML-DSA`, `SLH-DSA`, `FALCON`, `XMSS`, `LMS`, `HQC`, `FRODO`, `CMCE`, `BIKE`, `SABER`, `NTRU`, `NTRUPRIME`, `SMAUG-T`, `RSA`, `EC`, `OKP`, `oct`, `SM2`, `GOST-EC`, and `COMPOSITE` for every hybrid pairing. A composite key publishes one coarse token; its pairing is named by `alg` and its construction by `compositeMode`. Absent or empty means no filter. Any other value is rejected with 400. (optional)
      conformance - Optional conformance filter, applied server-side BEFORE pagination. ALL (or absent) = no filter; CONFORMING / NON_CONFORMING select by the per-key conformance verdict. Keys with no conformance basis are excluded from both. (optional)
      page - Zero-based page index (0..N) (optional, default to 0)
      size - The size of the page to be returned (optional, default to 25)
      sort - Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported. (optional)
      Returns:
      ApiResponse<PageAdminKeyResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • listKeysAsync

      public okhttp3.Call listKeysAsync(@Nonnull UUID tenantId, @Nullable String status, @Nullable String origin, @Nullable Boolean restricted, @Nullable String kty, @Nullable String conformance, @Nullable Integer page, @Nullable Integer size, @Nullable List<String> sort, ApiCallback<PageAdminKeyResponse> _callback) throws ApiException
      List keys for tenant (paginated) (asynchronously) Returns a paginated view of cryptographic keys owned by the specified tenant, optionally filtered by lifecycle status. **No key material**: a row carries no public key, for any caller, so a page's size is bounded by its row count whatever algorithms it lists (a Classic McEliece public key alone is 1.39 MB of Base64). The public key is released by `exportKey` (`GET /keys/{kid}/export`) only. **Population**: without `status`, every key the tenant still holds, in any lifecycle state: `active`, `expired`, `suspended`, `revoked`, `archived` and `pending_destruction`. Each row's `status` and material members (`alg`, `kty`, usage, expiry, `destructionEligibleFrom`) are read from the same material the single-key read `GET /keys/{kid}` uses, so a key reports the same `status` on both. Destroyed keys are never in the default list. **Deleted view** (`status=deleted_logical`, and only that value): the tenant's destroyed keys, read-only. A Deleted-view row is identified by `uuid`, the key identity the audit trail records for every operation the key performed; its `kid` names the same key, because a destroyed key's kid is never given to another key and no new key can be created under it. It is built from the key identity alone: it carries `kid`, `uuid`, `tenantId`, `status`, `displayName`, `description`, the revocation cause and reason, `revokedAt`, `archivedAt`, `deletedAt`, the record timestamps and `updatedBy`, and never `alg`, `kty`, `keyType`, `compositeMode`, `keyOps`, `origin`, `exportable`, usage, expiry, `authorizationReferences`, `conforming` or `hasAdmissibleTarget`. Every action flag on it is `allowed=false`. A `kty`, `origin` or `restricted` filter matches no Deleted-view row, and neither conformance value selects one. **Lifecycle timestamps**: `revokedAt` is present once a key has been revoked, `archivedAt` once it has been archived, and `deletedAt` only on a Deleted-view row. **Action flags**: every row carries `availableActions` with seven flags — `canRevoke`, `canArchive`, `canMarkForDestruction`, `canCancelDestruction`, `canRotate`, `canSuspend`, `canReactivate` — computed from the row's state and the caller's scopes. A caller lacking a flag's scope reads `Insufficient privileges`. `canPatch` is published by `GET /keys/{kid}` only. The flags are a reading; every action endpoint enforces its own rule. **Response shape**: a paged `Page<AdminKeyResponse>` envelope with `content` (the array of keys for the current page), `totalElements`, `totalPages`, `number` (zero-based page index), `size`, and the standard pagination flags (`first`, `last`, `empty`, `numberOfElements`). **Pagination**: server-side. Default `size=25`, default sort `createdAt,desc`. Max `size=200` (rejected with 400 above). Sort fields allow-list: `createdAt`, `expiresAt`, `alg`, `kty`, `status`, `kid`. Any other sort field returns 400. Sorting by `kty` orders over ONE vocabulary: every composite key carries the single coarse token `COMPOSITE`, so the ordering is over the published key types and not over a column whose values follow two conventions. **Query parameters**: - `status` (optional): filter by exact lifecycle state, using the SAME token a key's `status` field carries in the response — `active`, `pending_rotation`, `rotated`, `expired`, `revoked`, `archived`, `deleted_logical`, `suspended`, `pending_destruction`. Absent or empty means no filter. - `kty` (optional): filter by exact key type, using the SAME token a key's `kty` field carries in the response — `ML-KEM`, `ML-DSA`, `SLH-DSA`, `FALCON`, `XMSS`, `LMS`, `HQC`, `FRODO`, `CMCE`, `BIKE`, `SABER`, `NTRU`, `NTRUPRIME`, `SMAUG-T`, `RSA`, `EC`, `OKP`, `oct`, `SM2`, `GOST-EC`, and `COMPOSITE` for every hybrid pairing. A composite key's construction is carried by `compositeMode` and its pairing by `alg`, never by `kty`. Absent or empty means no filter. - `origin` (optional): filter by exact key origin, using the SAME token a key's `origin` field carries in the response — `GENERATED` or `IMPORTED`. Absent or empty means no filter. Any other value is rejected with 400, never answered with an empty page. - `page` (optional, default 0): zero-based page index. - `size` (optional, default 25, max 200): page size. - `sort` (optional, default `createdAt,desc`): sort field + direction. **Authorization references**: every key on the page except a Deleted-view row carries `authorizationReferences`, resolved for the whole page at once — how many internal crypto use cases, cryptographic exchanges and standalone capability grants in this tenant reference it, and their total. It is a reading: no key command is gated on it. It is absent on the service-to-service listing, where it is not computed. The conformance members `conforming` and `hasAdmissibleTarget` are computed for live keys only (`active`, `expired`, `suspended`). **Next rotation**: `nextRotationAt` is the instant a key is next due for automatic rotation, equal to the `nextDueAt` of `getKeyRotationSchedule` for that key. It is present only on a key whose schedule is `SCHEDULED`, may lie in the past when the key is overdue, and is present only for a caller that also holds `admin.keys.rotation-schedule.read`. It is never on a Deleted-view row. **Authorization**: requires scope `admin.keys.read`. A caller lists its own tenant's keys. A platform administrator (`tenantId == ROOT_TENANT_ID`) lists any tenant's keys on a customer-operated deployment (`PRIVATE_CLOUD`, `ON_PREMISE`) and is refused with 403 on `SAAS`. Any other cross-tenant address answers **404**.
      Parameters:
      tenantId - (required)
      status - (optional)
      origin - Optional key-origin filter, applied server-side BEFORE pagination, using the SAME token a key's `origin` field carries in the response: `GENERATED` or `IMPORTED`. Absent or empty means no filter. Any other value is rejected with 400 — never a silently empty page. (optional)
      restricted - Optional restricted-flag filter, applied server-side BEFORE pagination. (optional)
      kty - Optional key-type filter, applied server-side BEFORE pagination, using the SAME token a key's `kty` field carries in the response: `ML-KEM`, `ML-DSA`, `SLH-DSA`, `FALCON`, `XMSS`, `LMS`, `HQC`, `FRODO`, `CMCE`, `BIKE`, `SABER`, `NTRU`, `NTRUPRIME`, `SMAUG-T`, `RSA`, `EC`, `OKP`, `oct`, `SM2`, `GOST-EC`, and `COMPOSITE` for every hybrid pairing. A composite key publishes one coarse token; its pairing is named by `alg` and its construction by `compositeMode`. Absent or empty means no filter. Any other value is rejected with 400. (optional)
      conformance - Optional conformance filter, applied server-side BEFORE pagination. ALL (or absent) = no filter; CONFORMING / NON_CONFORMING select by the per-key conformance verdict. Keys with no conformance basis are excluded from both. (optional)
      page - Zero-based page index (0..N) (optional, default to 0)
      size - The size of the page to be returned (optional, default to 25)
      sort - Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported. (optional)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • markKeyForDestructionCall

      public okhttp3.Call markKeyForDestructionCall(@Nonnull UUID tenantId, @Nonnull String kid, @Nullable MarkForDestructionRequest markForDestructionRequest, ApiCallback _callback) throws ApiException
      Build call for markKeyForDestruction
      Parameters:
      tenantId - (required)
      kid - (required)
      markForDestructionRequest - (optional)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • markKeyForDestruction

      public QuorumRequestResponse markKeyForDestruction(@Nonnull UUID tenantId, @Nonnull String kid, @Nullable MarkForDestructionRequest markForDestructionRequest) throws ApiException
      Request the destruction of an archived key Requests the destruction of an ARCHIVED key. The request always waits for the approval of a person other than the requester, whether or not the tenant has a quorum approval policy: with no policy one approval is needed, and an enabled policy can require more. The call answers **202 Accepted** with the quorum request and its `Location`; nothing about the key changes until the request is approved. Approval and rejection are made in the Admin Console, after the approver authenticates again. On approval, every material version the key has left becomes PENDING_DESTRUCTION and a destruction order is scheduled for the approval instant plus the cooling-off period (`coolingOffDays`, 7 to 365 days; when omitted, the tenant lifecycle policy's `destruction.coolingOffDefaultDays`, else the deployment's, else 30). When the period ends, the platform destroys exactly those versions on its own, retires the Key ID for good (it is never reused in this tenant) and keeps the key's metadata and audit trail. While the destruction waits, decryption and verification of historical data remain available where the lifecycle policy allows them, and no new encryption or signature uses the key. `cancel-destruction` stops it at any point before it runs. Destruction erases the private material from the platform's active storage; backups taken earlier are not altered, and restoring one restores the key as it was at that point. The request is approved for the key's versions as they stood when it was made: a version restored, added or destroyed before the approval ends the request FAILED (`quorum-target-changed`), and a new request is needed. Read the scheduled destruction with `GET /tenants/{tenantId}/keys/{kid}/destruction-orders`. Valid source state: ARCHIVED only. **Authorization**: requires scope `admin.keys.mark-for-destruction`.
      Parameters:
      tenantId - (required)
      kid - (required)
      markForDestructionRequest - (optional)
      Returns:
      QuorumRequestResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • markKeyForDestructionWithHttpInfo

      public ApiResponse<QuorumRequestResponse> markKeyForDestructionWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid, @Nullable MarkForDestructionRequest markForDestructionRequest) throws ApiException
      Request the destruction of an archived key Requests the destruction of an ARCHIVED key. The request always waits for the approval of a person other than the requester, whether or not the tenant has a quorum approval policy: with no policy one approval is needed, and an enabled policy can require more. The call answers **202 Accepted** with the quorum request and its `Location`; nothing about the key changes until the request is approved. Approval and rejection are made in the Admin Console, after the approver authenticates again. On approval, every material version the key has left becomes PENDING_DESTRUCTION and a destruction order is scheduled for the approval instant plus the cooling-off period (`coolingOffDays`, 7 to 365 days; when omitted, the tenant lifecycle policy's `destruction.coolingOffDefaultDays`, else the deployment's, else 30). When the period ends, the platform destroys exactly those versions on its own, retires the Key ID for good (it is never reused in this tenant) and keeps the key's metadata and audit trail. While the destruction waits, decryption and verification of historical data remain available where the lifecycle policy allows them, and no new encryption or signature uses the key. `cancel-destruction` stops it at any point before it runs. Destruction erases the private material from the platform's active storage; backups taken earlier are not altered, and restoring one restores the key as it was at that point. The request is approved for the key's versions as they stood when it was made: a version restored, added or destroyed before the approval ends the request FAILED (`quorum-target-changed`), and a new request is needed. Read the scheduled destruction with `GET /tenants/{tenantId}/keys/{kid}/destruction-orders`. Valid source state: ARCHIVED only. **Authorization**: requires scope `admin.keys.mark-for-destruction`.
      Parameters:
      tenantId - (required)
      kid - (required)
      markForDestructionRequest - (optional)
      Returns:
      ApiResponse<QuorumRequestResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • markKeyForDestructionAsync

      public okhttp3.Call markKeyForDestructionAsync(@Nonnull UUID tenantId, @Nonnull String kid, @Nullable MarkForDestructionRequest markForDestructionRequest, ApiCallback<QuorumRequestResponse> _callback) throws ApiException
      Request the destruction of an archived key (asynchronously) Requests the destruction of an ARCHIVED key. The request always waits for the approval of a person other than the requester, whether or not the tenant has a quorum approval policy: with no policy one approval is needed, and an enabled policy can require more. The call answers **202 Accepted** with the quorum request and its `Location`; nothing about the key changes until the request is approved. Approval and rejection are made in the Admin Console, after the approver authenticates again. On approval, every material version the key has left becomes PENDING_DESTRUCTION and a destruction order is scheduled for the approval instant plus the cooling-off period (`coolingOffDays`, 7 to 365 days; when omitted, the tenant lifecycle policy's `destruction.coolingOffDefaultDays`, else the deployment's, else 30). When the period ends, the platform destroys exactly those versions on its own, retires the Key ID for good (it is never reused in this tenant) and keeps the key's metadata and audit trail. While the destruction waits, decryption and verification of historical data remain available where the lifecycle policy allows them, and no new encryption or signature uses the key. `cancel-destruction` stops it at any point before it runs. Destruction erases the private material from the platform's active storage; backups taken earlier are not altered, and restoring one restores the key as it was at that point. The request is approved for the key's versions as they stood when it was made: a version restored, added or destroyed before the approval ends the request FAILED (`quorum-target-changed`), and a new request is needed. Read the scheduled destruction with `GET /tenants/{tenantId}/keys/{kid}/destruction-orders`. Valid source state: ARCHIVED only. **Authorization**: requires scope `admin.keys.mark-for-destruction`.
      Parameters:
      tenantId - (required)
      kid - (required)
      markForDestructionRequest - (optional)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • patchKeyMetadataCall

      public okhttp3.Call patchKeyMetadataCall(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull AdminKeyMergePatchRequest adminKeyMergePatchRequest, ApiCallback _callback) throws ApiException
      Build call for patchKeyMetadata
      Parameters:
      tenantId - (required)
      kid - (required)
      adminKeyMergePatchRequest - RFC 7396 JSON Merge-Patch document. Only include fields you wish to change. (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • patchKeyMetadata

      public QuorumRequestResponse patchKeyMetadata(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull AdminKeyMergePatchRequest adminKeyMergePatchRequest) throws ApiException
      Update key metadata (JSON Merge-Patch) Applies RFC 7396 JSON Merge-Patch to update key metadata fields. Workflow: 1. Validates tenant access from JWT. 2. Validates the patch document's shape and values (`400`). 3. Looks the key up in the tenant (`404` for an unknown key or another tenant's, also for an empty document `{}`). 4. Updates metadata fields in the database. 5. Records an audit event. An empty document `{}` on an existing key changes nothing, writes nothing, publishes no audit event and answers `204`. Patchable fields (see `AdminKeyMergePatchRequest` schema for full details): - `displayName`: Human-readable key name (a string, max 255 UTF-8 bytes). - `description`: Key description (a string, max 1000 UTF-8 bytes). - `exportable`: Boolean flag for key export permission. - `expiresAt`: Hard expiration UTC timestamp (ISO-8601 string). - `softLimitExpiration`: Soft expiration UTC timestamp (warning threshold). - `maxUsageLimit`: Hard usage counter limit (`0` means unlimited). - `softUsageLimit`: Soft usage counter limit (`0` means no threshold). Merge-patch semantics (RFC 7396): absent fields leave the current value unchanged, and an explicit `null` clears the field. `exportable` is the exception: it is always `true` or `false`, so a `null` there is refused with a `400`. Where each field lives, and which states admit it: - `displayName` and `description` are stored on the key and can be changed in every state the key can be addressed in. - `exportable`, `expiresAt`, `softLimitExpiration`, `maxUsageLimit` and `softUsageLimit` are stored on the key's current material. A REVOKED, ARCHIVED or PENDING_DESTRUCTION key has none, so a patch naming any of them is refused with a `409` that names them and the key's status, and nothing is written. A reached protection limit is final. The hard expiry (`expiresAt`) and the hard usage limit (`maxUsageLimit`) can be changed — extended, shortened or cleared — only while the key's current material has not reached them. Once the expiry has passed, or the operations that applied protection (encrypt, sign) have used up the limit, the key reads `EXPIRED` with that reason in `protectionStopReasons`, and a patch naming that field is refused with a `409` `key-protection-limit-reached` that names it; nothing is written and no audit event is published. The remedy is a rotation, which gives the key a new current material with its own expiry and usage limit; the old material keeps decrypting and verifying. Each field is frozen only by its own limit (an exhausted key's `expiresAt` stays changeable), and `displayName`, `description`, `exportable` and the two soft limits stay patchable on an expired or exhausted key. This follows KMIP 1.4 Table 112 (the Protect Stop Date may change only \"as long as the Protect Stop Date has not been reached\") and §3.21 (Usage Limits are not changed once allocation began), and NIST SP 800-57 Part 1 Rev. 5 §5.3 (the end of the originator-usage period is met by re-keying). The expiry is reached strictly after the `expiresAt` instant, the same instant the cryptographic service stops encrypting and signing at. Validation rules (each a `400` before anything is written): - The document must be a JSON object; a field outside the seven above is refused and named, never ignored. - No value is coerced: `displayName` and `description` must be strings, `exportable` a boolean, the timestamps ISO-8601 strings, and the usage limits non-negative integers. - `displayName` at most 255 UTF-8 bytes; `description` at most 1000 UTF-8 bytes. - `expiresAt` must not be in the past. - A positive `maxUsageLimit` must be greater than the key's current `usageCount`: a limit at or below it would stop protection at once, a deliberate stop that suspend and revoke express. `0` (unlimited) is always accepted while the limit is not reached. - The values the key carries AFTER the patch must be ordered, a patch carrying one member of a pair being checked against the key's stored other: a positive `softUsageLimit` requires a positive `maxUsageLimit` and must be strictly less than it, and `softLimitExpiration` must be strictly before `expiresAt`. **Authorization**: requires scope `admin.keys.patch`.
      Parameters:
      tenantId - (required)
      kid - (required)
      adminKeyMergePatchRequest - RFC 7396 JSON Merge-Patch document. Only include fields you wish to change. (required)
      Returns:
      QuorumRequestResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • patchKeyMetadataWithHttpInfo

      public ApiResponse<QuorumRequestResponse> patchKeyMetadataWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull AdminKeyMergePatchRequest adminKeyMergePatchRequest) throws ApiException
      Update key metadata (JSON Merge-Patch) Applies RFC 7396 JSON Merge-Patch to update key metadata fields. Workflow: 1. Validates tenant access from JWT. 2. Validates the patch document's shape and values (`400`). 3. Looks the key up in the tenant (`404` for an unknown key or another tenant's, also for an empty document `{}`). 4. Updates metadata fields in the database. 5. Records an audit event. An empty document `{}` on an existing key changes nothing, writes nothing, publishes no audit event and answers `204`. Patchable fields (see `AdminKeyMergePatchRequest` schema for full details): - `displayName`: Human-readable key name (a string, max 255 UTF-8 bytes). - `description`: Key description (a string, max 1000 UTF-8 bytes). - `exportable`: Boolean flag for key export permission. - `expiresAt`: Hard expiration UTC timestamp (ISO-8601 string). - `softLimitExpiration`: Soft expiration UTC timestamp (warning threshold). - `maxUsageLimit`: Hard usage counter limit (`0` means unlimited). - `softUsageLimit`: Soft usage counter limit (`0` means no threshold). Merge-patch semantics (RFC 7396): absent fields leave the current value unchanged, and an explicit `null` clears the field. `exportable` is the exception: it is always `true` or `false`, so a `null` there is refused with a `400`. Where each field lives, and which states admit it: - `displayName` and `description` are stored on the key and can be changed in every state the key can be addressed in. - `exportable`, `expiresAt`, `softLimitExpiration`, `maxUsageLimit` and `softUsageLimit` are stored on the key's current material. A REVOKED, ARCHIVED or PENDING_DESTRUCTION key has none, so a patch naming any of them is refused with a `409` that names them and the key's status, and nothing is written. A reached protection limit is final. The hard expiry (`expiresAt`) and the hard usage limit (`maxUsageLimit`) can be changed — extended, shortened or cleared — only while the key's current material has not reached them. Once the expiry has passed, or the operations that applied protection (encrypt, sign) have used up the limit, the key reads `EXPIRED` with that reason in `protectionStopReasons`, and a patch naming that field is refused with a `409` `key-protection-limit-reached` that names it; nothing is written and no audit event is published. The remedy is a rotation, which gives the key a new current material with its own expiry and usage limit; the old material keeps decrypting and verifying. Each field is frozen only by its own limit (an exhausted key's `expiresAt` stays changeable), and `displayName`, `description`, `exportable` and the two soft limits stay patchable on an expired or exhausted key. This follows KMIP 1.4 Table 112 (the Protect Stop Date may change only \"as long as the Protect Stop Date has not been reached\") and §3.21 (Usage Limits are not changed once allocation began), and NIST SP 800-57 Part 1 Rev. 5 §5.3 (the end of the originator-usage period is met by re-keying). The expiry is reached strictly after the `expiresAt` instant, the same instant the cryptographic service stops encrypting and signing at. Validation rules (each a `400` before anything is written): - The document must be a JSON object; a field outside the seven above is refused and named, never ignored. - No value is coerced: `displayName` and `description` must be strings, `exportable` a boolean, the timestamps ISO-8601 strings, and the usage limits non-negative integers. - `displayName` at most 255 UTF-8 bytes; `description` at most 1000 UTF-8 bytes. - `expiresAt` must not be in the past. - A positive `maxUsageLimit` must be greater than the key's current `usageCount`: a limit at or below it would stop protection at once, a deliberate stop that suspend and revoke express. `0` (unlimited) is always accepted while the limit is not reached. - The values the key carries AFTER the patch must be ordered, a patch carrying one member of a pair being checked against the key's stored other: a positive `softUsageLimit` requires a positive `maxUsageLimit` and must be strictly less than it, and `softLimitExpiration` must be strictly before `expiresAt`. **Authorization**: requires scope `admin.keys.patch`.
      Parameters:
      tenantId - (required)
      kid - (required)
      adminKeyMergePatchRequest - RFC 7396 JSON Merge-Patch document. Only include fields you wish to change. (required)
      Returns:
      ApiResponse<QuorumRequestResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • patchKeyMetadataAsync

      public okhttp3.Call patchKeyMetadataAsync(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull AdminKeyMergePatchRequest adminKeyMergePatchRequest, ApiCallback<QuorumRequestResponse> _callback) throws ApiException
      Update key metadata (JSON Merge-Patch) (asynchronously) Applies RFC 7396 JSON Merge-Patch to update key metadata fields. Workflow: 1. Validates tenant access from JWT. 2. Validates the patch document's shape and values (`400`). 3. Looks the key up in the tenant (`404` for an unknown key or another tenant's, also for an empty document `{}`). 4. Updates metadata fields in the database. 5. Records an audit event. An empty document `{}` on an existing key changes nothing, writes nothing, publishes no audit event and answers `204`. Patchable fields (see `AdminKeyMergePatchRequest` schema for full details): - `displayName`: Human-readable key name (a string, max 255 UTF-8 bytes). - `description`: Key description (a string, max 1000 UTF-8 bytes). - `exportable`: Boolean flag for key export permission. - `expiresAt`: Hard expiration UTC timestamp (ISO-8601 string). - `softLimitExpiration`: Soft expiration UTC timestamp (warning threshold). - `maxUsageLimit`: Hard usage counter limit (`0` means unlimited). - `softUsageLimit`: Soft usage counter limit (`0` means no threshold). Merge-patch semantics (RFC 7396): absent fields leave the current value unchanged, and an explicit `null` clears the field. `exportable` is the exception: it is always `true` or `false`, so a `null` there is refused with a `400`. Where each field lives, and which states admit it: - `displayName` and `description` are stored on the key and can be changed in every state the key can be addressed in. - `exportable`, `expiresAt`, `softLimitExpiration`, `maxUsageLimit` and `softUsageLimit` are stored on the key's current material. A REVOKED, ARCHIVED or PENDING_DESTRUCTION key has none, so a patch naming any of them is refused with a `409` that names them and the key's status, and nothing is written. A reached protection limit is final. The hard expiry (`expiresAt`) and the hard usage limit (`maxUsageLimit`) can be changed — extended, shortened or cleared — only while the key's current material has not reached them. Once the expiry has passed, or the operations that applied protection (encrypt, sign) have used up the limit, the key reads `EXPIRED` with that reason in `protectionStopReasons`, and a patch naming that field is refused with a `409` `key-protection-limit-reached` that names it; nothing is written and no audit event is published. The remedy is a rotation, which gives the key a new current material with its own expiry and usage limit; the old material keeps decrypting and verifying. Each field is frozen only by its own limit (an exhausted key's `expiresAt` stays changeable), and `displayName`, `description`, `exportable` and the two soft limits stay patchable on an expired or exhausted key. This follows KMIP 1.4 Table 112 (the Protect Stop Date may change only \"as long as the Protect Stop Date has not been reached\") and §3.21 (Usage Limits are not changed once allocation began), and NIST SP 800-57 Part 1 Rev. 5 §5.3 (the end of the originator-usage period is met by re-keying). The expiry is reached strictly after the `expiresAt` instant, the same instant the cryptographic service stops encrypting and signing at. Validation rules (each a `400` before anything is written): - The document must be a JSON object; a field outside the seven above is refused and named, never ignored. - No value is coerced: `displayName` and `description` must be strings, `exportable` a boolean, the timestamps ISO-8601 strings, and the usage limits non-negative integers. - `displayName` at most 255 UTF-8 bytes; `description` at most 1000 UTF-8 bytes. - `expiresAt` must not be in the past. - A positive `maxUsageLimit` must be greater than the key's current `usageCount`: a limit at or below it would stop protection at once, a deliberate stop that suspend and revoke express. `0` (unlimited) is always accepted while the limit is not reached. - The values the key carries AFTER the patch must be ordered, a patch carrying one member of a pair being checked against the key's stored other: a positive `softUsageLimit` requires a positive `maxUsageLimit` and must be strictly less than it, and `softLimitExpiration` must be strictly before `expiresAt`. **Authorization**: requires scope `admin.keys.patch`.
      Parameters:
      tenantId - (required)
      kid - (required)
      adminKeyMergePatchRequest - RFC 7396 JSON Merge-Patch document. Only include fields you wish to change. (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • reactivateKeyCall

      public okhttp3.Call reactivateKeyCall(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback _callback) throws ApiException
      Build call for reactivateKey
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • reactivateKey

      public void reactivateKey(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Reactivate a suspended cryptographic key Reactivates a key that was previously suspended, restoring it to its pre-suspension status. Suspension admits ACTIVE only, so that status is ACTIVE. Use this endpoint when the security investigation is cleared and no compromise was found. If compromise was confirmed, use POST .../revoke instead. Valid source state: SUSPENDED only. State transition: SUSPENDED → ACTIVE (the recorded pre-suspension status). **Authorization**: requires scope `admin.keys.reactivate`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • reactivateKeyWithHttpInfo

      public ApiResponse<Void> reactivateKeyWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Reactivate a suspended cryptographic key Reactivates a key that was previously suspended, restoring it to its pre-suspension status. Suspension admits ACTIVE only, so that status is ACTIVE. Use this endpoint when the security investigation is cleared and no compromise was found. If compromise was confirmed, use POST .../revoke instead. Valid source state: SUSPENDED only. State transition: SUSPENDED → ACTIVE (the recorded pre-suspension status). **Authorization**: requires scope `admin.keys.reactivate`.
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      ApiResponse<Void>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • reactivateKeyAsync

      public okhttp3.Call reactivateKeyAsync(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback<Void> _callback) throws ApiException
      Reactivate a suspended cryptographic key (asynchronously) Reactivates a key that was previously suspended, restoring it to its pre-suspension status. Suspension admits ACTIVE only, so that status is ACTIVE. Use this endpoint when the security investigation is cleared and no compromise was found. If compromise was confirmed, use POST .../revoke instead. Valid source state: SUSPENDED only. State transition: SUSPENDED → ACTIVE (the recorded pre-suspension status). **Authorization**: requires scope `admin.keys.reactivate`.
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • revokeKeyCall

      public okhttp3.Call revokeKeyCall(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull RevokeKeyRequest revokeKeyRequest, ApiCallback _callback) throws ApiException
      Build call for revokeKey
      Parameters:
      tenantId - (required)
      kid - (required)
      revokeKeyRequest - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • revokeKey

      public void revokeKey(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull RevokeKeyRequest revokeKeyRequest) throws ApiException
      Revoke a cryptographic key Marks a key as REVOKED. This operation is irreversible. A request body is REQUIRED and must carry BOTH members. `reason` is the operator's own justification, recorded at canonical position 21 of the signed audit event so a revocation can be answered later. `cause` is the platform's classification, and it is MANDATORY with no default: it decides whether historical DECRYPT, VERIFY and the REENCRYPT / RESIGN source legs survive on this key. SECURITY_COMPROMISE stops every operation on the key; every other cause does not stop historical decrypt/verify (the tenant's lifecycle policy still applies and may deny them on its own). Omitting it is a 400 naming `cause`. State transition: ACTIVE, EXPIRED or SUSPENDED → REVOKED. **Refused (409 `invalid-key-state`), with nothing written to the key:** - a key already retired — REVOKED, ARCHIVED or PENDING_DESTRUCTION. A re-revoke would rewrite the recorded cause, and with it whether historical DECRYPT and VERIFY survive; on a key pending destruction it would also leave the destruction schedule without `admin.keys.cancel-destruction`. To stop a destruction, use `POST .../cancel-destruction`. - a key suspended with cause SECURITY_COMPROMISE, when the requested cause is anything else. Once revoked, the platform reads only the revocation cause, so a weaker cause would re-open DECRYPT and VERIFY on a compromised key. Revoke it with cause SECURITY_COMPROMISE. Every refusal is recorded as a FAILURE admin audit event carrying the refusal and the requested cause. A key-level revoke never lowers a per-version SECURITY_COMPROMISE: a version already revoked with that cause keeps it, and the other versions take the requested cause. **Authorization**: requires scope `admin.keys.revoke`.
      Parameters:
      tenantId - (required)
      kid - (required)
      revokeKeyRequest - (required)
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • revokeKeyWithHttpInfo

      public ApiResponse<Void> revokeKeyWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull RevokeKeyRequest revokeKeyRequest) throws ApiException
      Revoke a cryptographic key Marks a key as REVOKED. This operation is irreversible. A request body is REQUIRED and must carry BOTH members. `reason` is the operator's own justification, recorded at canonical position 21 of the signed audit event so a revocation can be answered later. `cause` is the platform's classification, and it is MANDATORY with no default: it decides whether historical DECRYPT, VERIFY and the REENCRYPT / RESIGN source legs survive on this key. SECURITY_COMPROMISE stops every operation on the key; every other cause does not stop historical decrypt/verify (the tenant's lifecycle policy still applies and may deny them on its own). Omitting it is a 400 naming `cause`. State transition: ACTIVE, EXPIRED or SUSPENDED → REVOKED. **Refused (409 `invalid-key-state`), with nothing written to the key:** - a key already retired — REVOKED, ARCHIVED or PENDING_DESTRUCTION. A re-revoke would rewrite the recorded cause, and with it whether historical DECRYPT and VERIFY survive; on a key pending destruction it would also leave the destruction schedule without `admin.keys.cancel-destruction`. To stop a destruction, use `POST .../cancel-destruction`. - a key suspended with cause SECURITY_COMPROMISE, when the requested cause is anything else. Once revoked, the platform reads only the revocation cause, so a weaker cause would re-open DECRYPT and VERIFY on a compromised key. Revoke it with cause SECURITY_COMPROMISE. Every refusal is recorded as a FAILURE admin audit event carrying the refusal and the requested cause. A key-level revoke never lowers a per-version SECURITY_COMPROMISE: a version already revoked with that cause keeps it, and the other versions take the requested cause. **Authorization**: requires scope `admin.keys.revoke`.
      Parameters:
      tenantId - (required)
      kid - (required)
      revokeKeyRequest - (required)
      Returns:
      ApiResponse<Void>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • revokeKeyAsync

      public okhttp3.Call revokeKeyAsync(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull RevokeKeyRequest revokeKeyRequest, ApiCallback<Void> _callback) throws ApiException
      Revoke a cryptographic key (asynchronously) Marks a key as REVOKED. This operation is irreversible. A request body is REQUIRED and must carry BOTH members. `reason` is the operator's own justification, recorded at canonical position 21 of the signed audit event so a revocation can be answered later. `cause` is the platform's classification, and it is MANDATORY with no default: it decides whether historical DECRYPT, VERIFY and the REENCRYPT / RESIGN source legs survive on this key. SECURITY_COMPROMISE stops every operation on the key; every other cause does not stop historical decrypt/verify (the tenant's lifecycle policy still applies and may deny them on its own). Omitting it is a 400 naming `cause`. State transition: ACTIVE, EXPIRED or SUSPENDED → REVOKED. **Refused (409 `invalid-key-state`), with nothing written to the key:** - a key already retired — REVOKED, ARCHIVED or PENDING_DESTRUCTION. A re-revoke would rewrite the recorded cause, and with it whether historical DECRYPT and VERIFY survive; on a key pending destruction it would also leave the destruction schedule without `admin.keys.cancel-destruction`. To stop a destruction, use `POST .../cancel-destruction`. - a key suspended with cause SECURITY_COMPROMISE, when the requested cause is anything else. Once revoked, the platform reads only the revocation cause, so a weaker cause would re-open DECRYPT and VERIFY on a compromised key. Revoke it with cause SECURITY_COMPROMISE. Every refusal is recorded as a FAILURE admin audit event carrying the refusal and the requested cause. A key-level revoke never lowers a per-version SECURITY_COMPROMISE: a version already revoked with that cause keeps it, and the other versions take the requested cause. **Authorization**: requires scope `admin.keys.revoke`.
      Parameters:
      tenantId - (required)
      kid - (required)
      revokeKeyRequest - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • rotateKeyCall

      public okhttp3.Call rotateKeyCall(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull RotationRequest rotationRequest, @Nullable String idempotencyKey, ApiCallback _callback) throws ApiException
      Build call for rotateKey
      Parameters:
      tenantId - (required)
      kid - (required)
      rotationRequest - New material specification (no kid — the Stable KID is the path {kid}). Mirrors the cryptographic service's rotation request. (required)
      idempotencyKey - Client-chosen key naming this rotation (draft-ietf-httpapi-idempotency-key-header): 1 to 255 visible ASCII characters, new for each rotation and identical on every resend of it. A resend with the same key and request never rotates twice; the same key with another request is refused 422 `idempotency-key-reused`. Scoped to the tenant. Absent, every request is a new rotation. (optional)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • rotateKey

      public KeySummaryResponse rotateKey(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull RotationRequest rotationRequest, @Nullable String idempotencyKey) throws ApiException
      Rotate a cryptographic key (advance its material version) Advances the Stable KID {kid} to a NEW PRIMARY material version. The kid is FIXED — rotation does not mint a successor key; it generates a new material version (new algorithm/spec) under the same key id and retires the previous one. Workflow: 1. Validates tenant access from JWT 2. Resolves the rotation: a new one expecting the key's current material version, or, under a reused `Idempotency-Key`, the one that key was first used for 3. Proxies the rotation request to the cryptographic service (S2S), which executes each rotation at most once 4. Logs administrative action in admin_audit_log 5. Returns the key metadata at its advanced material version (same kid) **Idempotency** (`Idempotency-Key`, optional; the semantics of draft-ietf-httpapi-idempotency-key-header). A client that may resend a rotation — after a timeout, a lost connection or a `504 rotation-outcome-unknown` — sends a key of its own choosing, 1 to 255 visible ASCII characters (a random UUID is the usual choice), new for each rotation it means to perform and identical on every resend of that rotation. The key belongs to the tenant: another tenant's use of the same string is a different key. - The first request with a key reserves it for that rotation before the cryptographic service is called. - A resend with the same key and the same request (same kid, same `newMaterial`) performs the rotation the key was reserved for and never a second one: it answers **200** with the same body and the response header `Idempotent-Replayed: true` when that rotation had already been applied, or applies it once when it never was. - The same key with another kid or another `newMaterial` is refused **422** `idempotency-key-reused`, and nothing is called. - The same key from another user or application of the tenant is refused **422** `idempotency-key-reused`, and nothing is called: a key belongs to the caller that first used it. - Two concurrent requests with one key perform one rotation; both answer 200, one of them replayed. - What is stored is the rotation, not the answer: only an applied rotation is replayed. A request that was refused (a 4xx) applied nothing, so its resend with the same key sends the same rotation again — the same expected material version — and is answered afresh; it can still never rotate twice. - Without the header, every request is a new rotation, so a resend after a lost answer rotates the key again. The new material MUST be able to serve the Stable KID's invariant purpose (ENCRYPT_DECRYPT or SIGN_VERIFY); a cross-purpose rotation is rejected with 422 `purpose-mismatch`. Within the same purpose, the new material can use the same or a different algorithm (policy permitting). A rotation changes the material, not the key's attributes. A member of `newMaterial` that is omitted (this service relays an omitted member as an explicit `null`, and the cryptographic service treats the two alike) is carried forward from the key's current PRIMARY material, never set to a new-key default: - `exportable`: as it is. - `maxUsageLimit` and `softUsageLimit`: as they are; the new material's usage count starts at 0. A stated `maxUsageLimit` keeps the current soft threshold when it can carry it (none, or strictly below a finite limit); otherwise the threshold is derived as on key creation (none on an unlimited limit, 80% of a finite one). - `expiresAt`: the same validity period counted from the rotation, rotation time + (current `expiresAt` - current creation time). A key without expiry stays without expiry. - `softLimitExpiration`: the same lead time before the new `expiresAt`, never earlier than the rotation time; a soft expiration without a hard one keeps its period from creation. A key without a soft expiration stays without one. A stated value wins; `0` is the explicit \"unlimited\" for `maxUsageLimit`. The creation defaults (expiry at creation plus the maximum cryptoperiod of the key class, unlimited usage) apply to key creation and import only, never to a rotation. A rotation whose new material is weaker than the key's current PRIMARY material — `exportable: true` on a material that is not exportable, or a usage limit that raises or removes the current one — is the weakening update quorum approval gates: with the tenant's policy gating it, the answer is `202` and the rotation waits for its approvals. **Authorization**: requires scope `admin.keys.rotate`.
      Parameters:
      tenantId - (required)
      kid - (required)
      rotationRequest - New material specification (no kid — the Stable KID is the path {kid}). Mirrors the cryptographic service's rotation request. (required)
      idempotencyKey - Client-chosen key naming this rotation (draft-ietf-httpapi-idempotency-key-header): 1 to 255 visible ASCII characters, new for each rotation and identical on every resend of it. A resend with the same key and request never rotates twice; the same key with another request is refused 422 `idempotency-key-reused`. Scoped to the tenant. Absent, every request is a new rotation. (optional)
      Returns:
      KeySummaryResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • rotateKeyWithHttpInfo

      public ApiResponse<KeySummaryResponse> rotateKeyWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull RotationRequest rotationRequest, @Nullable String idempotencyKey) throws ApiException
      Rotate a cryptographic key (advance its material version) Advances the Stable KID {kid} to a NEW PRIMARY material version. The kid is FIXED — rotation does not mint a successor key; it generates a new material version (new algorithm/spec) under the same key id and retires the previous one. Workflow: 1. Validates tenant access from JWT 2. Resolves the rotation: a new one expecting the key's current material version, or, under a reused `Idempotency-Key`, the one that key was first used for 3. Proxies the rotation request to the cryptographic service (S2S), which executes each rotation at most once 4. Logs administrative action in admin_audit_log 5. Returns the key metadata at its advanced material version (same kid) **Idempotency** (`Idempotency-Key`, optional; the semantics of draft-ietf-httpapi-idempotency-key-header). A client that may resend a rotation — after a timeout, a lost connection or a `504 rotation-outcome-unknown` — sends a key of its own choosing, 1 to 255 visible ASCII characters (a random UUID is the usual choice), new for each rotation it means to perform and identical on every resend of that rotation. The key belongs to the tenant: another tenant's use of the same string is a different key. - The first request with a key reserves it for that rotation before the cryptographic service is called. - A resend with the same key and the same request (same kid, same `newMaterial`) performs the rotation the key was reserved for and never a second one: it answers **200** with the same body and the response header `Idempotent-Replayed: true` when that rotation had already been applied, or applies it once when it never was. - The same key with another kid or another `newMaterial` is refused **422** `idempotency-key-reused`, and nothing is called. - The same key from another user or application of the tenant is refused **422** `idempotency-key-reused`, and nothing is called: a key belongs to the caller that first used it. - Two concurrent requests with one key perform one rotation; both answer 200, one of them replayed. - What is stored is the rotation, not the answer: only an applied rotation is replayed. A request that was refused (a 4xx) applied nothing, so its resend with the same key sends the same rotation again — the same expected material version — and is answered afresh; it can still never rotate twice. - Without the header, every request is a new rotation, so a resend after a lost answer rotates the key again. The new material MUST be able to serve the Stable KID's invariant purpose (ENCRYPT_DECRYPT or SIGN_VERIFY); a cross-purpose rotation is rejected with 422 `purpose-mismatch`. Within the same purpose, the new material can use the same or a different algorithm (policy permitting). A rotation changes the material, not the key's attributes. A member of `newMaterial` that is omitted (this service relays an omitted member as an explicit `null`, and the cryptographic service treats the two alike) is carried forward from the key's current PRIMARY material, never set to a new-key default: - `exportable`: as it is. - `maxUsageLimit` and `softUsageLimit`: as they are; the new material's usage count starts at 0. A stated `maxUsageLimit` keeps the current soft threshold when it can carry it (none, or strictly below a finite limit); otherwise the threshold is derived as on key creation (none on an unlimited limit, 80% of a finite one). - `expiresAt`: the same validity period counted from the rotation, rotation time + (current `expiresAt` - current creation time). A key without expiry stays without expiry. - `softLimitExpiration`: the same lead time before the new `expiresAt`, never earlier than the rotation time; a soft expiration without a hard one keeps its period from creation. A key without a soft expiration stays without one. A stated value wins; `0` is the explicit \"unlimited\" for `maxUsageLimit`. The creation defaults (expiry at creation plus the maximum cryptoperiod of the key class, unlimited usage) apply to key creation and import only, never to a rotation. A rotation whose new material is weaker than the key's current PRIMARY material — `exportable: true` on a material that is not exportable, or a usage limit that raises or removes the current one — is the weakening update quorum approval gates: with the tenant's policy gating it, the answer is `202` and the rotation waits for its approvals. **Authorization**: requires scope `admin.keys.rotate`.
      Parameters:
      tenantId - (required)
      kid - (required)
      rotationRequest - New material specification (no kid — the Stable KID is the path {kid}). Mirrors the cryptographic service's rotation request. (required)
      idempotencyKey - Client-chosen key naming this rotation (draft-ietf-httpapi-idempotency-key-header): 1 to 255 visible ASCII characters, new for each rotation and identical on every resend of it. A resend with the same key and request never rotates twice; the same key with another request is refused 422 `idempotency-key-reused`. Scoped to the tenant. Absent, every request is a new rotation. (optional)
      Returns:
      ApiResponse<KeySummaryResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • rotateKeyAsync

      public okhttp3.Call rotateKeyAsync(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull RotationRequest rotationRequest, @Nullable String idempotencyKey, ApiCallback<KeySummaryResponse> _callback) throws ApiException
      Rotate a cryptographic key (advance its material version) (asynchronously) Advances the Stable KID {kid} to a NEW PRIMARY material version. The kid is FIXED — rotation does not mint a successor key; it generates a new material version (new algorithm/spec) under the same key id and retires the previous one. Workflow: 1. Validates tenant access from JWT 2. Resolves the rotation: a new one expecting the key's current material version, or, under a reused `Idempotency-Key`, the one that key was first used for 3. Proxies the rotation request to the cryptographic service (S2S), which executes each rotation at most once 4. Logs administrative action in admin_audit_log 5. Returns the key metadata at its advanced material version (same kid) **Idempotency** (`Idempotency-Key`, optional; the semantics of draft-ietf-httpapi-idempotency-key-header). A client that may resend a rotation — after a timeout, a lost connection or a `504 rotation-outcome-unknown` — sends a key of its own choosing, 1 to 255 visible ASCII characters (a random UUID is the usual choice), new for each rotation it means to perform and identical on every resend of that rotation. The key belongs to the tenant: another tenant's use of the same string is a different key. - The first request with a key reserves it for that rotation before the cryptographic service is called. - A resend with the same key and the same request (same kid, same `newMaterial`) performs the rotation the key was reserved for and never a second one: it answers **200** with the same body and the response header `Idempotent-Replayed: true` when that rotation had already been applied, or applies it once when it never was. - The same key with another kid or another `newMaterial` is refused **422** `idempotency-key-reused`, and nothing is called. - The same key from another user or application of the tenant is refused **422** `idempotency-key-reused`, and nothing is called: a key belongs to the caller that first used it. - Two concurrent requests with one key perform one rotation; both answer 200, one of them replayed. - What is stored is the rotation, not the answer: only an applied rotation is replayed. A request that was refused (a 4xx) applied nothing, so its resend with the same key sends the same rotation again — the same expected material version — and is answered afresh; it can still never rotate twice. - Without the header, every request is a new rotation, so a resend after a lost answer rotates the key again. The new material MUST be able to serve the Stable KID's invariant purpose (ENCRYPT_DECRYPT or SIGN_VERIFY); a cross-purpose rotation is rejected with 422 `purpose-mismatch`. Within the same purpose, the new material can use the same or a different algorithm (policy permitting). A rotation changes the material, not the key's attributes. A member of `newMaterial` that is omitted (this service relays an omitted member as an explicit `null`, and the cryptographic service treats the two alike) is carried forward from the key's current PRIMARY material, never set to a new-key default: - `exportable`: as it is. - `maxUsageLimit` and `softUsageLimit`: as they are; the new material's usage count starts at 0. A stated `maxUsageLimit` keeps the current soft threshold when it can carry it (none, or strictly below a finite limit); otherwise the threshold is derived as on key creation (none on an unlimited limit, 80% of a finite one). - `expiresAt`: the same validity period counted from the rotation, rotation time + (current `expiresAt` - current creation time). A key without expiry stays without expiry. - `softLimitExpiration`: the same lead time before the new `expiresAt`, never earlier than the rotation time; a soft expiration without a hard one keeps its period from creation. A key without a soft expiration stays without one. A stated value wins; `0` is the explicit \"unlimited\" for `maxUsageLimit`. The creation defaults (expiry at creation plus the maximum cryptoperiod of the key class, unlimited usage) apply to key creation and import only, never to a rotation. A rotation whose new material is weaker than the key's current PRIMARY material — `exportable: true` on a material that is not exportable, or a usage limit that raises or removes the current one — is the weakening update quorum approval gates: with the tenant's policy gating it, the answer is `202` and the rotation waits for its approvals. **Authorization**: requires scope `admin.keys.rotate`.
      Parameters:
      tenantId - (required)
      kid - (required)
      rotationRequest - New material specification (no kid — the Stable KID is the path {kid}). Mirrors the cryptographic service's rotation request. (required)
      idempotencyKey - Client-chosen key naming this rotation (draft-ietf-httpapi-idempotency-key-header): 1 to 255 visible ASCII characters, new for each rotation and identical on every resend of it. A resend with the same key and request never rotates twice; the same key with another request is refused 422 `idempotency-key-reused`. Scoped to the tenant. Absent, every request is a new rotation. (optional)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • rotationAdmissibilityCall

      public okhttp3.Call rotationAdmissibilityCall(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback _callback) throws ApiException
      Build call for rotationAdmissibility
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • rotationAdmissibility

      public RotationAdmissibilityResponse rotationAdmissibility(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Preview rotation admissibility for a source key (console-facing) Returns the server-authoritative rotation admissibility verdict for the source key {kid}: for every algorithm in the tenant catalogue, whether the key may rotate to it and why. The verdict is computed by the cryptographic service (the single rule authority) and relayed 1:1 — this service recomputes no rule and reorders no candidate. The endpoint performs ZERO writes (no database, HSM, cache, event or audit write). Clients read the verdict through this endpoint: the cryptographic service computes it, and that computation is reachable only service-to-service, never from outside the platform. **Authorization**: requires scope `admin.keys.read`. The tenant boundary is enforced from the path `tenantId` (platform-admin-on-ROOT or `tenantId == jwtTenantId`).
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      RotationAdmissibilityResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • rotationAdmissibilityWithHttpInfo

      public ApiResponse<RotationAdmissibilityResponse> rotationAdmissibilityWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid) throws ApiException
      Preview rotation admissibility for a source key (console-facing) Returns the server-authoritative rotation admissibility verdict for the source key {kid}: for every algorithm in the tenant catalogue, whether the key may rotate to it and why. The verdict is computed by the cryptographic service (the single rule authority) and relayed 1:1 — this service recomputes no rule and reorders no candidate. The endpoint performs ZERO writes (no database, HSM, cache, event or audit write). Clients read the verdict through this endpoint: the cryptographic service computes it, and that computation is reachable only service-to-service, never from outside the platform. **Authorization**: requires scope `admin.keys.read`. The tenant boundary is enforced from the path `tenantId` (platform-admin-on-ROOT or `tenantId == jwtTenantId`).
      Parameters:
      tenantId - (required)
      kid - (required)
      Returns:
      ApiResponse<RotationAdmissibilityResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • rotationAdmissibilityAsync

      public okhttp3.Call rotationAdmissibilityAsync(@Nonnull UUID tenantId, @Nonnull String kid, ApiCallback<RotationAdmissibilityResponse> _callback) throws ApiException
      Preview rotation admissibility for a source key (console-facing) (asynchronously) Returns the server-authoritative rotation admissibility verdict for the source key {kid}: for every algorithm in the tenant catalogue, whether the key may rotate to it and why. The verdict is computed by the cryptographic service (the single rule authority) and relayed 1:1 — this service recomputes no rule and reorders no candidate. The endpoint performs ZERO writes (no database, HSM, cache, event or audit write). Clients read the verdict through this endpoint: the cryptographic service computes it, and that computation is reachable only service-to-service, never from outside the platform. **Authorization**: requires scope `admin.keys.read`. The tenant boundary is enforced from the path `tenantId` (platform-admin-on-ROOT or `tenantId == jwtTenantId`).
      Parameters:
      tenantId - (required)
      kid - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • suspendKeyCall

      public okhttp3.Call suspendKeyCall(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull SuspendKeyRequest suspendKeyRequest, ApiCallback _callback) throws ApiException
      Build call for suspendKey
      Parameters:
      tenantId - (required)
      kid - (required)
      suspendKeyRequest - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • suspendKey

      public void suspendKey(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull SuspendKeyRequest suspendKeyRequest) throws ApiException
      Suspend a cryptographic key Temporarily suspends a key for security incident investigation. Unlike revocation, suspension is **reversible**: the key can be reactivated once the investigation is cleared (POST .../reactivate), or permanently revoked if compromise is confirmed (POST .../revoke). A request body is REQUIRED and must carry BOTH members. `reason` is the operator's own justification, recorded at canonical position 21 of the signed audit event. `cause` is the platform's classification and is MANDATORY with no default. During suspension encrypt/sign are denied under both shipped lifecycle-policy templates (DEFAULT and STRICT); a custom tenant policy decides for itself, and SECURITY_COMPROMISE denies them regardless of policy. Whether decrypt/verify — and the REENCRYPT / RESIGN source legs — remain allowed is decided by `cause`: SECURITY_COMPROMISE stops every operation on the key, and every other cause does not stop historical decrypt/verify (the tenant's lifecycle policy still applies and may deny them on its own). Reactivating the key clears the cause. Valid source state: a key stored ACTIVE, which reads `active` or, once its current material has reached its `expiresAt` or used up its `maxUsageLimit`, `expired`. An expired key still decrypts and verifies, so it can be suspended like an active one. State transition: ACTIVE or EXPIRED → SUSPENDED; reactivating it restores the stored ACTIVE, which reads `expired` again while the limit stays reached. **Authorization**: requires scope `admin.keys.suspend`.
      Parameters:
      tenantId - (required)
      kid - (required)
      suspendKeyRequest - (required)
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • suspendKeyWithHttpInfo

      public ApiResponse<Void> suspendKeyWithHttpInfo(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull SuspendKeyRequest suspendKeyRequest) throws ApiException
      Suspend a cryptographic key Temporarily suspends a key for security incident investigation. Unlike revocation, suspension is **reversible**: the key can be reactivated once the investigation is cleared (POST .../reactivate), or permanently revoked if compromise is confirmed (POST .../revoke). A request body is REQUIRED and must carry BOTH members. `reason` is the operator's own justification, recorded at canonical position 21 of the signed audit event. `cause` is the platform's classification and is MANDATORY with no default. During suspension encrypt/sign are denied under both shipped lifecycle-policy templates (DEFAULT and STRICT); a custom tenant policy decides for itself, and SECURITY_COMPROMISE denies them regardless of policy. Whether decrypt/verify — and the REENCRYPT / RESIGN source legs — remain allowed is decided by `cause`: SECURITY_COMPROMISE stops every operation on the key, and every other cause does not stop historical decrypt/verify (the tenant's lifecycle policy still applies and may deny them on its own). Reactivating the key clears the cause. Valid source state: a key stored ACTIVE, which reads `active` or, once its current material has reached its `expiresAt` or used up its `maxUsageLimit`, `expired`. An expired key still decrypts and verifies, so it can be suspended like an active one. State transition: ACTIVE or EXPIRED → SUSPENDED; reactivating it restores the stored ACTIVE, which reads `expired` again while the limit stays reached. **Authorization**: requires scope `admin.keys.suspend`.
      Parameters:
      tenantId - (required)
      kid - (required)
      suspendKeyRequest - (required)
      Returns:
      ApiResponse<Void>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • suspendKeyAsync

      public okhttp3.Call suspendKeyAsync(@Nonnull UUID tenantId, @Nonnull String kid, @Nonnull SuspendKeyRequest suspendKeyRequest, ApiCallback<Void> _callback) throws ApiException
      Suspend a cryptographic key (asynchronously) Temporarily suspends a key for security incident investigation. Unlike revocation, suspension is **reversible**: the key can be reactivated once the investigation is cleared (POST .../reactivate), or permanently revoked if compromise is confirmed (POST .../revoke). A request body is REQUIRED and must carry BOTH members. `reason` is the operator's own justification, recorded at canonical position 21 of the signed audit event. `cause` is the platform's classification and is MANDATORY with no default. During suspension encrypt/sign are denied under both shipped lifecycle-policy templates (DEFAULT and STRICT); a custom tenant policy decides for itself, and SECURITY_COMPROMISE denies them regardless of policy. Whether decrypt/verify — and the REENCRYPT / RESIGN source legs — remain allowed is decided by `cause`: SECURITY_COMPROMISE stops every operation on the key, and every other cause does not stop historical decrypt/verify (the tenant's lifecycle policy still applies and may deny them on its own). Reactivating the key clears the cause. Valid source state: a key stored ACTIVE, which reads `active` or, once its current material has reached its `expiresAt` or used up its `maxUsageLimit`, `expired`. An expired key still decrypts and verifies, so it can be suspended like an active one. State transition: ACTIVE or EXPIRED → SUSPENDED; reactivating it restores the stored ACTIVE, which reads `expired` again while the limit stays reached. **Authorization**: requires scope `admin.keys.suspend`.
      Parameters:
      tenantId - (required)
      kid - (required)
      suspendKeyRequest - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object