All Products
Search

This Product

    Key Management Service:GetParametersForImport

    Document Center

    Key Management Service:GetParametersForImport

    Last Updated:Aug 28, 2026

    Retrieves the import token and wrapping public key required to import key material into a CMK.

    Operation description

    Use the returned parameters to call the ImportKeyMaterial operation.

    • You can import key material only for CMKs whose Origin parameter is set to EXTERNAL.

    • The returned public key and token must be used together and apply only to the CMK specified in this call.

    • Each call returns a different public key and token.

    • Specify the public key type and encryption algorithm for encrypting key material. The following table lists supported combinations.

    Public key type Encryption algorithm Description
    RSA_2048 RSAES_PKCS1_V1_5

    RSAES_OAEP_SHA_1

    RSAES_OAEP_SHA_256 | CMKs of all regions and all protection levels are supported.

    Dedicated Key Management Service (KMS) does not support RSAES_OAEP_SHA_1. | | EC_SM2 | SM2PKE | CMKs whose ProtectionLevel is set to HSM are supported. The SM2 algorithm is developed and approved by the State Cryptography Administration of China. The SM2 algorithm can be used only to import key material for a CMK whose ProtectionLevel is set to HSM. You can use the SM2 algorithm only when you enable the Managed HSM feature for KMS in the Chinese mainland. For more information, see Overview of Managed HSM. | For more information, see Import key material. This topic provides an example on how to query the parameters that are used to import key material for a CMK. The ID of the CMK is 1234abcd-12ab-34cd-56ef-12345678****, the encryption algorithm is RSAES_PKCS1_V1_5, and the public key is of the RSA_2048 type. The parameters that are returned include the ID of the CMK, the public key that is used to encrypt the key material, the token that is used to import the key material, and the time when the token expires.

    For more information about the access policy required by a RAM user or RAM role to call this API, see Resource Access Management.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    No authorization for this operation. If you encounter issues with this operation, contact technical support.

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    KeyId

    string

    Yes

    The globally unique ID of the CMK.

    Note

    You can import key material only for CMKs whose Origin parameter is set to EXTERNAL.

    202b9877-5a25-46e3-a763-e20791b5****
    WrappingAlgorithm

    string

    Yes

    The encryption algorithm for key material.

    RSAES_PKCS1_V1_5
    WrappingKeySpec

    string

    Yes

    The public key type for encrypting key material.

    RSA_2048

    For more information about common request parameters, see Common parameters.

    Response elements

    Element

    Type

    Description

    Example

    object

    KeyId

    string

    The globally unique ID of the CMK.

    Required when calling the ImportKeyMaterial operation.

    202b9877-5a25-46e3-a763-e20791b5****
    ImportToken

    string

    The import token for key material.

    Valid for 24 hours. Required when calling the ImportKeyMaterial operation.

    Base64String
    RequestId

    string

    The request ID.

    8cdf51fd-bcd6-d79a-0ef4-e52c9b5466dc
    TokenExpireTime

    string

    The time when the token expires.

    2018-01-25T00:01:02Z
    PublicKey

    string

    The public key for encrypting key material.

    The public key is Base64-encoded.

    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlls4uIBxD0GG84C+lGBO6Dhpf1J3XimC6cPmPNaKKJMOzoX4tD+C+r7aZv8lZ3vnPfxuxvy/YwG+whUxTEEFUdqJTOIzhPfYucupqKM92crVHIuG+xtMVeHKjyTr+UrtKCsQikqHT+19yDRN/RMoo2HUx0gmEnRyXd8t3JyUXun9FdoxKA08GrsV7nodb9ZsoBLhnev7tTLcXvLyKW6XG1ZQCQm6dPnbnwLeDXR7uK0Lqn9PM28mBIdaiQUQxj2XbM1CoJA+JiyVX3Ptdb+4rqukb4Rb05B80Bs9xV/cf7FIku08l7xGhrGiQFq+DFXwQWtwihXHZxz3LhldU+4ZPwID****

    Examples

    Success response

    JSON format

    {
  "KeyId": "202b9877-5a25-46e3-a763-e20791b5****",
  "ImportToken": "Base64String",
  "RequestId": "8cdf51fd-bcd6-d79a-0ef4-e52c9b5466dc",
  "TokenExpireTime": "2018-01-25T00:01:02Z",
  "PublicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlls4uIBxD0GG84C+lGBO6Dhpf1J3XimC6cPmPNaKKJMOzoX4tD+C+r7aZv8lZ3vnPfxuxvy/YwG+whUxTEEFUdqJTOIzhPfYucupqKM92crVHIuG+xtMVeHKjyTr+UrtKCsQikqHT+19yDRN/RMoo2HUx0gmEnRyXd8t3JyUXun9FdoxKA08GrsV7nodb9ZsoBLhnev7tTLcXvLyKW6XG1ZQCQm6dPnbnwLeDXR7uK0Lqn9PM28mBIdaiQUQxj2XbM1CoJA+JiyVX3Ptdb+4rqukb4Rb05B80Bs9xV/cf7FIku08l7xGhrGiQFq+DFXwQWtwihXHZxz3LhldU+4ZPwID****"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 Unsupported.Origin This key origin is not valid for this api The key origin is not supported for this API operation.
    400 InvalidParameter The specified parameter is not valid. An invalid value is specified for the parameter.
    404 InvalidAccessKeyId.NotFound The Access Key ID provided does not exist in our records.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.