VerifyMac - Key Management Service - Alibaba Cloud Documentation Center

Operation description

For details about the access policy required when a RAM user or RAM role invokes this operation, refer to access control.

This operation can be invoked through a shared gateway or a dedicated gateway. For more information, refer to Alibaba Cloud SDK.

Shared gateway: Access KMS through a public or VPC endpoint. This method requires you to enable the public network access switch. For more information, refer to accessing keys in a KMS instance over the Internet.
Dedicated gateway: Access KMS through a KMS private endpoint (<YOUR_KMS_INSTANCE_ID>.cryptoservice.kms.aliyuncs.com).

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request syntax

POST  HTTP/1.1

Request parameters

Parameter	Type	Required	Description	Example
KeyId	string	Yes	The ID of the key. You can also specify a key alias or key Amazon Resource Name (ARN). For more information about aliases, refer to Manage key aliases. Note To access a key in a different Alibaba Cloud account, you must specify the key ARN. The key ARN is in the format of `acs:kms:${region}:${account}:key/${keyid}`.	key-hzz630494463ejqjx****
Mac	string	Yes	The Base64-encoding message authentication code to verify.	vz1Snp+jGJbgydCFRWVWxAwIMdyfKCSp+jnMWQ==
Message	string	Yes	The original message data. Use Base64 encoding. For example, if the hexadecimal content of the message for which you want to generate a message authentication code is `[0x31, 0x32, 0x33, 0x34]`, the corresponding Base64-encoded value is `MTIzNA==`.	VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZy4=
Algorithm	string	Yes	The algorithm used to generate the message authentication code. Valid values vary based on the key specification: HMAC_SM3 HMAC_SHA_224 HMAC_SHA_256 HMAC_SHA_384 HMAC_SHA_512	HMAC_SHA_256
DryRun	string	No	Specifies whether to enable DryRun mode. Valid values: true: enables DryRun mode. false (default): disables DryRun mode. DryRun mode is used to test API calls and verify whether you have the required permissions on the corresponding resources and whether the request parameters are correctly configured. When DryRun mode is enabled, KMS always returns a failure and provides the failure reason. Failure reasons include: DryRunOperationError: The request would succeed if the DryRun parameter is not specified. ValidationError: The parameters specified in the request are invalid. AccessDeniedError: You are not authorized to perform this operation on the KMS resource.	false

Response elements

Element	Type	Description	Example
	object	Schema of Response
RequestId	string	The request ID. It is a unique identifier generated by Alibaba Cloud for the request and can be used to troubleshoot issues.	f94ec9d3-2d10-4922-9a5c-5dcd5ebcb5e8
KeyId	string	The globally unique identifier of the customer master key (CMK). Note If the KeyId parameter in the request is set to an alias of the CMK, the CMK ID corresponding to the alias is returned in the response.	key-hzz62f1cb66fa42qo***
Algorithm	string	The algorithm used to generate the message authentication code. Valid values vary based on the key specification: HMAC_SM3 HMAC_SHA_224 HMAC_SHA_256 HMAC_SHA_384 HMAC_SHA_512	HMAC_SHA_256
Value	boolean	Indicates whether the message authentication code verification is successful.	true

Examples

Success response

JSON format

{
  "RequestId": "f94ec9d3-2d10-4922-9a5c-5dcd5ebcb5e8",
  "KeyId": "key-hzz62f1cb66fa42qo***",
  "Algorithm": "HMAC_SHA_256",
  "Value": true
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.