> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Batch encrypt with one or more keys.

> The order of batch items in the response matches that of the request.
An individual status code is returned for each batch item.

**Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.

## OpenAPI

````json POST /crypto/v1/keys/batch/encrypt
{
  "openapi": "3.0.0",
  "info": {
    "title": "Fortanix DSM REST API",
    "description": "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients.",
    "termsOfService": "https://www.fortanix.com/legal/terms/",
    "contact": {
      "name": "Fortanix Support",
      "url": "https://support.fortanix.com/",
      "email": "support@fortanix.com"
    },
    "license": {
      "name": "Apache 2.0",
      "url": "http://www.apache.org/licenses/LICENSE-2.0.html"
    },
    "version": "0.1.0-20260526"
  },
  "servers": [
    {
      "url": "https://amer.smartkey.io"
    }
  ],
  "paths": {
    "/crypto/v1/keys/batch/encrypt": {
      "post": {
        "operationId": "BatchEncrypt",
        "tags": [
          "Crypto"
        ],
        "security": [
          {
            "bearerToken": []
          },
          {
            "apiKeyAuth": []
          }
        ],
        "summary": "Batch encrypt with one or more keys.",
        "description": "The order of batch items in the response matches that of the request.\nAn individual status code is returned for each batch item.\n\n**Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "array",
                "items": {
                  "$ref": "#/components/schemas/BatchEncryptRequestItem"
                }
              }
            }
          }
        },
        "responses": {
          "2XX": {
            "description": "Success result",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/BatchEncryptResponseItem"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "BatchEncryptRequestItem": {
        "allOf": [
          {
            "type": "object",
            "description": "Request body of each item in batch encryption\n\n**Note** : Provide the key ID in the *`kid`* field. The *`key`* field within the *`request`* field should be omitted.",
            "properties": {
              "kid": {
                "type": "string",
                "format": "uuid",
                "description": "UUID of the sobject"
              },
              "request": {
                "$ref": "#/components/schemas/EncryptRequest"
              }
            },
            "required": [
              "kid",
              "request"
            ]
          }
        ]
      },
      "BatchEncryptResponseItem": {
        "oneOf": [
          {
            "title": "BatchEncryptResponseItemSuccess",
            "type": "object",
            "properties": {
              "status": {
                "type": "integer"
              },
              "body": {
                "$ref": "#/components/schemas/EncryptResponse"
              }
            }
          },
          {
            "title": "BatchEncryptResponseItemError",
            "type": "object",
            "properties": {
              "status": {
                "type": "integer"
              },
              "error": {
                "type": "string"
              }
            }
          }
        ]
      },
      "EncryptRequest": {
        "allOf": [
          {
            "type": "object",
            "description": "Request to encrypt data.",
            "properties": {
              "key": {
                "$ref": "#/components/schemas/SobjectDescriptor"
              },
              "alg": {
                "$ref": "#/components/schemas/Algorithm"
              },
              "plain": {
                "type": "string",
                "format": "byte",
                "description": "Plaintext bytes to be encrypted.\n\nNote that when performing format-preserving encryption (i.e.,\ntokenization), the plaintext should be encoded as UTF-8 bytes."
              },
              "mode": {
                "$ref": "#/components/schemas/CryptMode"
              },
              "iv": {
                "type": "string",
                "format": "byte",
                "description": "The initialization vector to use. This is only applicable to modes\nthat take IVs, and will be randomly generated if not specified."
              },
              "ad": {
                "type": "string",
                "format": "byte",
                "description": "The authenticated data to use. This is only applicable when using\nauthenticated encryption modes (like GCM or CCM)."
              },
              "tag_len": {
                "type": "integer",
                "nullable": true,
                "description": "The length of the authentication tag, in bits, for authenticated\nencryption modes (i.e., GCM or CCM). For other modes, this field\nis irrelevant."
              },
              "label": {
                "type": "string",
                "format": "byte",
                "description": "The optional label to use. Currently this field only serves as the\nrsa_oaep_label when the encryption algorithm is RSA and the mode is\nOaep. For other modes, providing this field causes a bad request error."
              }
            },
            "required": [
              "alg",
              "plain"
            ]
          }
        ]
      },
      "EncryptResponse": {
        "allOf": [
          {
            "type": "object",
            "description": "Response of an encryption request.",
            "properties": {
              "kid": {
                "type": "string",
                "format": "uuid",
                "nullable": true,
                "description": "The ID of the key used for encryption. Returned for non-transient keys."
              },
              "cipher": {
                "type": "string",
                "format": "byte",
                "description": "Encrypted ciphertext bytes.\n\nNote that when performing format-preserving encryption (i.e.,\ntokenization), the ciphertext is encoded as UTF-8 bytes."
              },
              "iv": {
                "type": "string",
                "format": "byte",
                "description": "The initialization vector used during encryption. This is only\napplicable for certain symmetric encryption modes."
              },
              "tag": {
                "type": "string",
                "format": "byte",
                "description": "When using the GCM or CCM modes, the tag is returned from\nauthenticated encryption."
              }
            },
            "required": [
              "cipher"
            ]
          }
        ]
      },
      "SobjectDescriptor": {
        "description": "Uniquely identifies a persisted or transient sobject.",
        "oneOf": [
          {
            "title": "SobjectDescriptorVariantKid",
            "type": "object",
            "properties": {
              "kid": {
                "type": "string",
                "format": "uuid"
              }
            },
            "required": [
              "kid"
            ]
          },
          {
            "title": "SobjectDescriptorVariantName",
            "type": "object",
            "properties": {
              "name": {
                "type": "string",
                "maxLength": 4096,
                "pattern": "^[^\\n]*[^\\s\\n][^\\n]*$"
              }
            },
            "required": [
              "name"
            ]
          },
          {
            "title": "SobjectDescriptorVariantTransientKey",
            "type": "object",
            "properties": {
              "transient_key": {
                "type": "string",
                "format": "byte"
              }
            },
            "required": [
              "transient_key"
            ]
          },
          {
            "title": "SobjectDescriptorVariantInline",
            "type": "object",
            "properties": {
              "inline": {
                "$ref": "#/components/schemas/SobjectDescriptorInline"
              }
            },
            "required": [
              "inline"
            ]
          }
        ]
      },
      "Algorithm": {
        "description": "A cryptographic algorithm.",
        "type": "string",
        "enum": [
          "AES",
          "ARIA",
          "DES",
          "DES3",
          "SEED",
          "RSA",
          "DSA",
          "KCDSA",
          "EC",
          "ECKCDSA",
          "BIP32",
          "SLIP10",
          "BLS",
          "LMS",
          "XMSS",
          "MLDSA",
          "MLDSABETA",
          "MLKEM",
          "MLKEMBETA",
          "HMAC",
          "LEDABETA",
          "ROUND5BETA",
          "PBE"
        ]
      },
      "CryptMode": {
        "description": "`CipherMode` or `RsaEncryptionPadding`, depending on the encryption algorithm.",
        "oneOf": [
          {
            "$ref": "#/components/schemas/CipherMode"
          },
          {
            "$ref": "#/components/schemas/RsaEncryptionPadding"
          }
        ]
      },
      "SobjectDescriptorInline": {
        "allOf": [
          {
            "type": "object",
            "properties": {
              "value": {
                "type": "string",
                "format": "byte"
              },
              "obj_type": {
                "$ref": "#/components/schemas/ObjectType"
              }
            },
            "required": [
              "value",
              "obj_type"
            ]
          }
        ]
      },
      "CipherMode": {
        "description": "Cipher mode used for symmetric key algorithms.",
        "type": "string",
        "enum": [
          "ECB",
          "CBC",
          "CBCNOPAD",
          "CFB",
          "OFB",
          "CTR",
          "GCM",
          "CCM",
          "KW",
          "KWP",
          "FF1"
        ]
      },
      "RsaEncryptionPadding": {
        "description": "Type of padding to use for RSA encryption. The use of PKCS#1 v1.5 padding is strongly\ndiscouraged, because of its susceptibility to Bleichenbacher's attack. The padding specified\nmust adhere to the key's encryption policy. If not specified, the default based on the key's\npolicy will be used.",
        "oneOf": [
          {
            "title": "RsaEncryptionPaddingVariantOaep",
            "type": "object",
            "properties": {
              "OAEP": {
                "$ref": "#/components/schemas/RsaEncryptionPaddingOaep"
              }
            },
            "required": [
              "OAEP"
            ]
          },
          {
            "title": "RsaEncryptionPaddingVariantPkcs1V15",
            "type": "object",
            "properties": {
              "PKCS1_V15": {
                "type": "object",
                "properties": {}
              }
            },
            "required": [
              "PKCS1_V15"
            ]
          },
          {
            "title": "RsaEncryptionPaddingVariantRawDecrypt",
            "type": "object",
            "properties": {
              "RAW_DECRYPT": {
                "type": "object",
                "properties": {}
              }
            },
            "required": [
              "RAW_DECRYPT"
            ]
          }
        ]
      },
      "ObjectType": {
        "description": "Type of security object.",
        "type": "string",
        "enum": [
          "AES",
          "ARIA",
          "DES",
          "DES3",
          "SEED",
          "RSA",
          "DSA",
          "EC",
          "KCDSA",
          "ECKCDSA",
          "BIP32",
          "SLIP10",
          "BLS",
          "OPAQUE",
          "HMAC",
          "LEDABETA",
          "ROUND5BETA",
          "SECRET",
          "LMS",
          "XMSS",
          "MLDSA",
          "MLDSABETA",
          "MLKEM",
          "MLKEMBETA",
          "CERTIFICATE",
          "PBE"
        ]
      },
      "RsaEncryptionPaddingOaep": {
        "allOf": [
          {
            "type": "object",
            "description": "Optimal Asymmetric Encryption Padding (PKCS#1 v2.1).",
            "properties": {
              "mgf": {
                "$ref": "#/components/schemas/Mgf"
              }
            },
            "required": [
              "mgf"
            ]
          }
        ]
      },
      "Mgf": {
        "description": "Specifies the Mask Generating Function (MGF) to use.",
        "oneOf": [
          {
            "title": "MgfVariantMgf1",
            "type": "object",
            "properties": {
              "mgf1": {
                "$ref": "#/components/schemas/MgfMgf1"
              }
            },
            "required": [
              "mgf1"
            ]
          }
        ]
      },
      "MgfMgf1": {
        "allOf": [
          {
            "type": "object",
            "description": "MGF1 algorithm",
            "properties": {
              "hash": {
                "$ref": "#/components/schemas/DigestAlgorithm"
              }
            },
            "required": [
              "hash"
            ]
          }
        ]
      },
      "DigestAlgorithm": {
        "description": "A hash algorithm.",
        "type": "string",
        "enum": [
          "BLAKE2B256",
          "BLAKE2B384",
          "BLAKE2B512",
          "BLAKE2S256",
          "RIPEMD160",
          "SSL3",
          "SHA1",
          "SHA224",
          "SHA256",
          "SHA384",
          "SHA512",
          "STREEBOG256",
          "STREEBOG512",
          "SHA3_224",
          "SHA3_256",
          "SHA3_384",
          "SHA3_512"
        ]
      }
    }
  }
}
````