API standards and multilingual preset SDKs
The OpenAPI of this product (Kms/2016-01-20) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
Service management
|
API |
Title |
Description |
| DescribeAccountKmsStatus | DescribeAccountKmsStatus | Queries the status of Key Management Service (KMS) within your Alibaba Cloud account. |
| OpenKmsService | OpenKmsService | Activates Key Management Service (KMS) for your Alibaba Cloud account. |
Instance management
|
API |
Title |
Description |
| ListKmsInstances | ListKmsInstances | Queries all KMS instances in the current region. |
| GetKmsInstance | GetKmsInstance | Retrieves the details of a KMS instance. |
| UpdateKmsInstanceBindVpc | UpdateKmsInstanceBindVpc | Updates the VPC bindings of a KMS instance. |
| ReleaseKmsInstance | ReleaseKmsInstance | Releases a pay-as-you-go KMS instance. |
| GetDefaultKmsInstance | GetDefaultKmsInstance | Queries the default KMS instance in a specified region. |
Key management
|
API |
Title |
Description |
| CreateKey | CreateKey | Creates a customer master key (CMK) for envelope encryption, digital signatures, or other cryptographic operations. |
| ListKeys | ListKeys | Queries the IDs and ARNs of all CMKs in the current region. |
| DescribeKey | DescribeKey | Queries the metadata of a CMK, such as the key state, usage, and rotation configuration. |
| UpdateKeyDescription | UpdateKeyDescription | Updates the description of a CMK. |
| GetPublicKey | GetPublicKey | Retrieves the public key of an asymmetric key. You can use the public key to encrypt data or verify a signature on your device. |
| ListAliases | ListAliases | Queries all aliases in the current region for the current account. |
| ImportKeyMaterial | ImportKeyMaterial | Imports externally generated key material into a CMK whose origin is EXTERNAL. |
| DeleteKeyMaterial | DeleteKeyMaterial | Deletes the imported key material from a CMK. After deletion, the CMK enters the PendingImport state until you re-import key material. |
| SetDeletionProtection | Set deletion protection | Enables or disables deletion protection for a customer master key (CMK). |
| UpdateRotationPolicy | UpdateRotationPolicy | Updates the automatic rotation policy of a CMK. |
| DescribeKeyVersion | DescribeKeyVersion | Queries the metadata of a specific CMK version. |
| CreateKeyVersion | CreateKeyVersion | Creates a version for a customer master key (CMK). |
| ListKeyVersions | ListKeyVersions | Queries all versions of a specified CMK. |
| SetKeyPolicy | SetKeyPolicy | Sets the key policy for a CMK in a KMS instance. |
| GetKeyPolicy | GetKeyPolicy | Queries the key policy of a CMK in a KMS instance. |
Cryptographic operations
|
API |
Title |
Description |
| GenerateDataKey | GenerateDataKey | Generates a random data key for envelope encryption. The data key is returned in both plaintext and ciphertext forms. |
| GenerateAndExportDataKey | GenerateAndExportDataKey | Generates a random data key, encrypts it by using a CMK and a public key that you specify, and returns both ciphertexts. |
| Encrypt | Encrypt | Encrypts plaintext by using a symmetric CMK. |
| Decrypt | Decrypt | Decrypts ciphertext that was encrypted by using a CMK. |
| ReEncrypt | ReEncrypt | Re-encrypts ciphertext under a different CMK without exposing the plaintext. |
| ExportDataKey | ExportDataKey | Exports a data key encrypted by a CMK. The data key is re-encrypted by a public key that you specify for secure transmission. |
| GenerateDataKeyWithoutPlaintext | GenerateDataKeyWithoutPlaintext | Generates a random data key in only ciphertext form, without the plaintext copy. |
| AsymmetricSign | AsymmetricSign | Generates a digital signature by using an asymmetric CMK. |
| AsymmetricVerify | AsymmetricVerify | Verifies a digital signature by using the public key of an asymmetric CMK. |
| AsymmetricEncrypt | AsymmetricEncrypt | Encrypts data by using the public key of an asymmetric CMK. |
| AsymmetricDecrypt | AsymmetricDecrypt | Decrypts data by using the private key of an asymmetric CMK. |
Secret management
|
API |
Title |
Description |
| UpdateSecretVersionStage | UpdateSecretVersionStage | Moves a version stage label to a different version of a secret. |
| ListSecretVersionIds | ListSecretVersionIds | Queries all version IDs and stage labels of a specified secret. |
| GetRandomPassword | GetRandomPassword | Generates a random password string. |
| PutSecretValue | PutSecretValue | Stores a new version of a secret value for a generic secret. |
| RotateSecret | RotateSecret | Immediately rotates a secret. |
| SetSecretPolicy | SetSecretPolicy | Sets the access policy for a secret in a KMS instance. |
| GetSecretPolicy | GetSecretPolicy | Queries the access policy of a specified secret in a KMS instance. |
Tag management
|
API |
Title |
Description |
| GetKmsInstanceQuotaInfos | GetKmsInstanceQuotaInfos | Queries the quota usage and limits for a KMS instance. |
| TagResource | TagResource | Adds tags to a CMK, secret, or certificate. |
| UntagResource | UntagResource | Removes tags from a CMK, secret, or certificate. |
Application management
|
API |
Title |
Description |
| ListNetworkRules | ListNetworkRules | Queries all network access rules in the current region. |
| DescribeNetworkRule | DescribeNetworkRule | Retrieves the details of a network access rule. |
| UpdateNetworkRule | UpdateNetworkRule | Updates a network access rule. |
| DeleteNetworkRule | DeleteNetworkRule | Deletes a network access rule. |
| ListPolicies | ListPolicies | Queries all permission policies in the current region. |
| DescribePolicy | DescribePolicy | Retrieves the details of a permission policy. |
| ListApplicationAccessPoints | ListApplicationAccessPoints | Queries all application access points (AAPs) in the current region. |
| DescribeApplicationAccessPoint | DescribeApplicationAccessPoint | Retrieves the details of an application access point (AAP). |
| DeleteApplicationAccessPoint | DeleteApplicationAccessPoint | Deletes an application access point (AAP). |
| ListClientKeys | ListClientKeys | Queries all client keys within an AAP. |
| GetClientKey | GetClientKey | Retrieves information about a client key. |
| DeleteClientKey | DeleteClientKey | Deletes a client key. |
Others
|
API |
Title |
Description |
| CreateSecret | CreateSecret | Creates a secret and stores its initial version. |
| DescribeRegions | DescribeRegions | Queries the regions where KMS is available. |
| GetSecretValue | Retrieve Credential Value | Retrieve the credential value. |
| ListSecrets | ListSecrets | Queries all secrets in the current region. |
| ListTagResources | ListTagResources | Lists the tags that are bound to a key or a secret. |
| TagResources | TagResources | Adds tags to one or more keys or secrets. |
| CancelKeyDeletion | CancelKeyDeletion | Cancels the deletion task of a CMK. |
| ConnectKmsInstance | ConnectKmsInstance | Enables a Key Management Service (KMS) instance. |
| CreateAlias | CreateAlias | Creates an alias for a key. |
| CreateApplicationAccessPoint | CreateApplicationAccessPoint | Creates an application access point (AAP) |
| CreateClientKey | CreateClientKey | Creates a client key. |
| CreateNetworkRule | CreateNetworkRule | Creates a network access rule to configure the private IP addresses or private CIDR blocks that are allowed to access a Key Management Service (KMS) instance. |
| CreatePolicy | CreatePolicy | Creates a permission policy to configure the keys and secrets that are allowed to access. |
| DeleteAlias | DeleteAlias | Deletes an alias. |
| DeletePolicy | DeletePolicy | Deletes a permission policy. |
| DeleteSecret | DeleteSecret | Deletes a secret. |
| DescribeSecret | DescribeSecret | Queries the metadata of a secret. |
| DisableKey | DisableKey | Disables a key. |
| EnableKey | EnableKey | Enables a key to encrypt and decrypt data. |
| GenerateMac | Generate HMAC message authentication code | Generates an HMAC message authentication code for a message by using a specified key. |
| GetParametersForImport | GetParametersForImport | Queries the parameters that are used to import key material for a customer master key (CMK). |
| ListAliasesByKeyId | ListAliasesByKeyId | Queries all aliases that are bound to a key. |
| ListResourceTags | ListResourceTags | Queries the tags of a customer master key (CMK). |
| RestoreSecret | RestoreSecret | Restores a deleted secret. |
| ScheduleKeyDeletion | ScheduleKeyDeletion | Deletes a specified customer master key (CMK). |
| UntagResources | UntagResources | Removes tags from keys or secrets. |
| UpdateAlias | UpdateAlias | Binds an existing alias to a different customer master key (CMK) ID. |
| UpdateApplicationAccessPoint | UpdateApplicationAccessPoint | Updates the information about an application access point (AAP). |
| UpdatePolicy | UpdatePolicy | Updates a permission policy. |
| UpdateSecret | UpdateSecret | Updates the metadata of a secret. |
| UpdateSecretRotationPolicy | UpdateSecretRotationPolicy | Updates the rotation policy of a secret. |
| VerifyMac | Verify HMAC message authentication code | Verifies the HMAC message authentication code of a specific message by using a specified key. |