API standards and multilingual preset SDKs
The OpenAPI of this product (Kms/2016-01-20) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
Service management
|
API |
Title |
Description |
| DescribeAccountKmsStatus | DescribeAccountKmsStatus | Queries the status of Key Management Service (KMS) within your Alibaba Cloud account. |
| OpenKmsService | OpenKmsService | Activates Key Management Service (KMS) for your Alibaba Cloud account. |
Instance management
|
API |
Title |
Description |
| ListKmsInstances | ListKmsInstances | Queries all KMS instances in the current region. |
| ConnectKmsInstance | ConnectKmsInstance | Enables a Key Management Service (KMS) instance. |
| GetKmsInstance | GetKmsInstance | Retrieves the details of a KMS instance. |
| UpdateKmsInstanceBindVpc | UpdateKmsInstanceBindVpc | Updates the VPC bindings of a KMS instance. |
| ReleaseKmsInstance | ReleaseKmsInstance | Releases a pay-as-you-go KMS instance. |
| GetDefaultKmsInstance | GetDefaultKmsInstance | Queries the default KMS instance in a specified region. |
Key management
|
API |
Title |
Description |
| CreateKey | CreateKey | Creates a customer master key (CMK) for envelope encryption, digital signatures, or other cryptographic operations. |
| ListKeys | ListKeys | Queries the IDs and ARNs of all CMKs in the current region. |
| DescribeKey | DescribeKey | Queries the metadata of a CMK, such as the key state, usage, and rotation configuration. |
| UpdateKeyDescription | UpdateKeyDescription | Updates the description of a CMK. |
| EnableKey | EnableKey | Enables a key to encrypt and decrypt data. |
| DisableKey | DisableKey | Disables a key. |
| GetPublicKey | GetPublicKey | Retrieves the public key of an asymmetric key. You can use the public key to encrypt data or verify a signature on your device. |
| CreateAlias | CreateAlias | Creates an alias for a key. |
| ListAliases | ListAliases | Queries all aliases in the current region for the current account. |
| ListAliasesByKeyId | ListAliasesByKeyId | Queries all aliases that are bound to a key. |
| DeleteAlias | DeleteAlias | Deletes an alias. |
| UpdateAlias | UpdateAlias | Binds an existing alias to a different customer master key (CMK) ID. |
| GetParametersForImport | GetParametersForImport | Queries the parameters that are used to import key material for a customer master key (CMK). |
| ImportKeyMaterial | ImportKeyMaterial | Imports externally generated key material into a CMK whose origin is EXTERNAL. |
| DeleteKeyMaterial | DeleteKeyMaterial | Deletes the imported key material from a CMK. After deletion, the CMK enters the PendingImport state until you re-import key material. |
| ScheduleKeyDeletion | ScheduleKeyDeletion | Deletes a specified customer master key (CMK). |
| CancelKeyDeletion | CancelKeyDeletion | Cancels the deletion task of a CMK. |
| SetDeletionProtection | Set deletion protection | Enables or disables deletion protection for a customer master key (CMK). |
| UpdateRotationPolicy | UpdateRotationPolicy | Updates the automatic rotation policy of a CMK. |
| DescribeKeyVersion | DescribeKeyVersion | Queries the metadata of a specific CMK version. |
| CreateKeyVersion | CreateKeyVersion | Creates a version for a customer master key (CMK). |
| ListKeyVersions | ListKeyVersions | Queries all versions of a specified CMK. |
| SetKeyPolicy | SetKeyPolicy | Sets the key policy for a CMK in a KMS instance. |
| GetKeyPolicy | GetKeyPolicy | Queries the key policy of a CMK in a KMS instance. |
Cryptographic operations
|
API |
Title |
Description |
| GenerateDataKey | GenerateDataKey | Generates a random data key for envelope encryption. The data key is returned in both plaintext and ciphertext forms. |
| GenerateAndExportDataKey | GenerateAndExportDataKey | Generates a random data key, encrypts it by using a CMK and a public key that you specify, and returns both ciphertexts. |
| Encrypt | Encrypt | Encrypts plaintext by using a symmetric CMK. |
| Decrypt | Decrypt | Decrypts ciphertext that was encrypted by using a CMK. |
| ReEncrypt | ReEncrypt | Re-encrypts ciphertext under a different CMK without exposing the plaintext. |
| ExportDataKey | ExportDataKey | Exports a data key encrypted by a CMK. The data key is re-encrypted by a public key that you specify for secure transmission. |
| GenerateDataKeyWithoutPlaintext | GenerateDataKeyWithoutPlaintext | Generates a random data key in only ciphertext form, without the plaintext copy. |
| AsymmetricSign | AsymmetricSign | Generates a digital signature by using an asymmetric CMK. |
| AsymmetricVerify | AsymmetricVerify | Verifies a digital signature by using the public key of an asymmetric CMK. |
| AsymmetricEncrypt | AsymmetricEncrypt | Encrypts data by using the public key of an asymmetric CMK. |
| AsymmetricDecrypt | AsymmetricDecrypt | Decrypts data by using the private key of an asymmetric CMK. |
| GenerateMac | Generate HMAC message authentication code | Generates an HMAC message authentication code for a message by using a specified key. |
| VerifyMac | Verify HMAC message authentication code | Verifies the HMAC message authentication code of a specific message by using a specified key. |
Secret management
|
API |
Title |
Description |
| ListSecrets | ListSecrets | Queries all secrets in the current region. |
| GetSecretValue | Retrieve a secret value | Retrieves a secret value. |
| BatchGetSecretValue | Retrieve secret values in batches | Retrieves secret values in batches. |
| DeleteSecret | DeleteSecret | Deletes a secret. |
| CreateSecret | CreateSecret | Creates a secret and stores its initial version. |
| UpdateSecret | UpdateSecret | Updates the metadata of a secret. |
| UpdateSecretVersionStage | UpdateSecretVersionStage | Moves a version stage label to a different version of a secret. |
| UpdateSecretRotationPolicy | UpdateSecretRotationPolicy | Updates the rotation policy of a secret. |
| DescribeSecret | DescribeSecret | Queries the metadata of a secret. |
| ListSecretVersionIds | Query all version information of a secret | Queries all version information of a secret. |
| GetRandomPassword | GetRandomPassword | Generates a random password string. |
| PutSecretValue | PutSecretValue | Stores a new version of a secret value for a generic secret. |
| RestoreSecret | RestoreSecret | Restores a deleted secret. |
| RotateSecret | RotateSecret | Immediately rotates a secret. |
| SetSecretPolicy | SetSecretPolicy | Sets the access policy for a secret in a KMS instance. |
| GetSecretPolicy | GetSecretPolicy | Queries the access policy of a specified secret in a KMS instance. |
Tag management
|
API |
Title |
Description |
| UntagResources | UntagResources | Removes tags from keys or secrets. |
| TagResources | TagResources | Adds tags to one or more keys or secrets. |
| ListTagResources | ListTagResources | Lists the tags that are bound to a key or a secret. |
| GetKmsInstanceQuotaInfos | GetKmsInstanceQuotaInfos | Queries the quota usage and limits for a KMS instance. |
| ListResourceTags | ListResourceTags | Queries the tags of a customer master key (CMK). |
| TagResource | TagResource | Adds tags to a CMK, secret, or certificate. |
| UntagResource | UntagResource | Removes tags from a CMK, secret, or certificate. |
Application management
|
API |
Title |
Description |
| CreateNetworkRule | CreateNetworkRule | Creates a network access rule to configure the private IP addresses or private CIDR blocks that are allowed to access a Key Management Service (KMS) instance. |
| ListNetworkRules | ListNetworkRules | Queries all network access rules in the current region. |
| DescribeNetworkRule | DescribeNetworkRule | Retrieves the details of a network access rule. |
| UpdateNetworkRule | UpdateNetworkRule | Updates a network access rule. |
| DeleteNetworkRule | DeleteNetworkRule | Deletes a network access rule. |
| CreatePolicy | CreatePolicy | Creates a permission policy to configure the keys and secrets that are allowed to access. |
| ListPolicies | ListPolicies | Queries all permission policies in the current region. |
| DescribePolicy | DescribePolicy | Retrieves the details of a permission policy. |
| UpdatePolicy | UpdatePolicy | Updates a permission policy. |
| DeletePolicy | DeletePolicy | Deletes a permission policy. |
| CreateApplicationAccessPoint | CreateApplicationAccessPoint | Creates an application access point (AAP) |
| ListApplicationAccessPoints | ListApplicationAccessPoints | Queries all application access points (AAPs) in the current region. |
| DescribeApplicationAccessPoint | DescribeApplicationAccessPoint | Retrieves the details of an application access point (AAP). |
| UpdateApplicationAccessPoint | UpdateApplicationAccessPoint | Updates the information about an application access point (AAP). |
| DeleteApplicationAccessPoint | DeleteApplicationAccessPoint | Deletes an application access point (AAP). |
| CreateClientKey | CreateClientKey | Creates a client key. |
| ListClientKeys | ListClientKeys | Queries all client keys within an AAP. |
| GetClientKey | GetClientKey | Retrieves information about a client key. |
| DeleteClientKey | DeleteClientKey | Deletes a client key. |
Others
|
API |
Title |
Description |
| DescribeRegions | DescribeRegions | Queries the regions where KMS is available. |
| GetManagedDataKey | Retrieve managed data key plaintext | Retrieves the plaintext of a managed data key (DK). |
| ListManagedDataKeyVersions | List key versions of a managed data key | Lists the key versions of a specified managed data key (DK). |