Get details of all apps accessible to requester.
Group for which the associated apps should be retrived.
Maximum number of apps to return. Default limit is 1001.
Number of apps to skip from the beginning/start.
Flag specifying if group permissions should be returned with the apps.
App's role.
User specified filter.
The following fields can be referenced in the filter:
nameapp_typecreated_atauth_typedescriptionenabledinterface
Continuation token to continue getting results. It must be the same token returned from the backend from a previous call, or empty.
Existence of this query parameter controls the response (and the backend behavior):
- If specified (including an empty value), the backend returns metadata alongside
the collection of apps. The metadata will potentially contain a fresh
continuation_token.
Note: If there is a limit specified in the request and DSM returns limit-many items in the
response, it will still include a fresh continuation token if there are more items in the collection.
Additionally, unlike other query parameters, limit is not required to remain unchanged in a chain of
requests with coninutation_tokens.
- If omitted, the backend returns just a collection of apps with no metadata.
Starting from a particular app_id.
Starting from a particular app_name.
Success result
The response of the get all apps API
The list of apps satisfying the request
The id of the Account that this application belongs to.
Unique id to identify the application.
The user-defined type of this application.
Certificate expiration date.
Indicates whether waiting for quorum approval is activated or disabled
Time interval in seconds for client lib to check quorum status.
Maximum time in seconds for client lib to wait for quorum reply.
Use ignore_unknown_key_ops_for with [SECRET] instead of `ignore_unknown_key_ops_for_secrets``
Type of security object.
The operations to add to any key creation request (only supported in KMIP).
The following operations can be specified:
EXPORTAPPMANAGEABLEHIGHVOLUME
The operations specified cannot conflict with what's specified in the
key_ops field of account and/or group policies (where applicable).
Note: This is only enforced on (KMIP) creation requests since we assume updates removing key operations are intentional.
Operations allowed to be performed on a given key.
SIGN: If this is set, the key can be used to for signing.
VERIFY: If this is set, the key can used for verifying a signature.
ENCRYPT: If this is set, the key can be used for encryption.
DECRYPT: If this is set, the key can be used for decryption.
WRAPKEY: If this is set, the key can be used wrapping other keys. The key being wrapped must have the EXPORT operation enabled.
UNWRAPKEY: If this is set, the key can be used to unwrap a wrapped key.
DERIVEKEY: If this is set, the key can be used to derive another key.
TRANSFORM: If this is set, the key can be transformed.
MACGENERATE: If this is set, the key can be used to compute a cryptographic Message Authentication Code (MAC) on a message.
MACVERIFY: If they is set, the key can be used to verify a MAC.
EXPORT: If this is set, the value of the key can be retrieved with an authenticated request. This shouldn't be set unless required. It is more secure to keep the key's value inside DSM only.
APPMANAGEABLE: Without this operation, management operations like delete, destroy, rotate, activate, restore, revoke, revert, update, remove_private, etc. cannot be performed by a crypto App. A user with access or admin app can still perform these operations. This option is only relevant for crypto apps.
HIGHVOLUME: If this is set, audit logs will not be recorded for the key. High volume here tries to signify a key that is being used a lot and will produce lots of logs. Setting this operation disables audit logs for the key.
AGREEKEY: If this is set, the key can be used for key agreement. Both the private and public key should have this option enabled to perform an agree operation.
ENCAPSULATE: If this is set, the key can be used for key encapsulation. The result is a new symmetric key and a ciphertext.
DECAPSULATE: If this is set, the key can be used for key decapsulation. If decapsulation succeeds, the result is a new symmetric key.
Cipher mode used for symmetric key algorithms.
Timestamp when the application was created.
A security principal.
OAuth scope.
The default group an application belongs to.
Description of this application.
Whether this application is enabled.
Operations allowed to be performed by an app.
SIGN:
VERIFY:
ENCRYPT:
DECRYPT:
WRAPKEY:
UNWRAPKEY:
DERIVEKEY:
MACGENERATE:
MACVERIFY:
EXPORT:
MANAGE:
AGREEKEY:
MASKDECRYPT:
AUDIT:
TRANSFORM:
CREATE_SOBJECTS:
COPY_SOBJECTS:
ROTATE_SOBJECTS:
ACTIVATE_SOBJECTS:
REVOKE_SOBJECTS:
REVERT_SOBJECTS:
MOVE_SOBJECTS:
UPDATE_SOBJECTS_PROFILE:
UPDATE_SOBJECTS_ENABLED_STATE:
UPDATE_SOBJECT_POLICIES:
UPDATE_KEY_OPS:
DELETE_KEY_MATERIAL:
DELETE_SOBJECTS:
DESTROY_SOBJECTS:
RESTORE_EXTERNAL_SOBJECTS:
CALCULATE_DIGEST:
ENCAPSULATE:
DECAPSULATE:
Interface used with this application (PKCS11, CNG, JCE, KMIP, etc).
The IPs that are allowed for an application. ipv4 or ipv6 both are acceptable types.
Timestamp when the application was most recently used.
If a requester is updating an App or retrieving its credentials, they must have the relevant permissions in all Groups that App has access to. But for legacy Apps, requester is required to have relevant permissions in any of the groups that App has access to.
Name of this application, which must be unique within an account.
OAuth settings for an app. If enabled, an app can request to act on behalf of a user.
App's role.
If auth_type is all, this field will include the list of individual auth
types for the app
Authentication method of an app.
Continuation token to continue getting results. If the response contains a continuation_token, the results returned are partial. In that case, the client can make the same request with this continuation token to continue getting results.
Count of the items in the collection matching the request
An indicator of how accurate a count of objects is.
The id of the Account that this application belongs to.
Unique id to identify the application.
The user-defined type of this application.
Certificate expiration date.
Indicates whether waiting for quorum approval is activated or disabled
Time interval in seconds for client lib to check quorum status.
Maximum time in seconds for client lib to wait for quorum reply.
Use ignore_unknown_key_ops_for with [SECRET] instead of `ignore_unknown_key_ops_for_secrets``
Type of security object.
The operations to add to any key creation request (only supported in KMIP).
The following operations can be specified:
EXPORTAPPMANAGEABLEHIGHVOLUME
The operations specified cannot conflict with what's specified in the
key_ops field of account and/or group policies (where applicable).
Note: This is only enforced on (KMIP) creation requests since we assume updates removing key operations are intentional.
Operations allowed to be performed on a given key.
SIGN: If this is set, the key can be used to for signing.
VERIFY: If this is set, the key can used for verifying a signature.
ENCRYPT: If this is set, the key can be used for encryption.
DECRYPT: If this is set, the key can be used for decryption.
WRAPKEY: If this is set, the key can be used wrapping other keys. The key being wrapped must have the EXPORT operation enabled.
UNWRAPKEY: If this is set, the key can be used to unwrap a wrapped key.
DERIVEKEY: If this is set, the key can be used to derive another key.
TRANSFORM: If this is set, the key can be transformed.
MACGENERATE: If this is set, the key can be used to compute a cryptographic Message Authentication Code (MAC) on a message.
MACVERIFY: If they is set, the key can be used to verify a MAC.
EXPORT: If this is set, the value of the key can be retrieved with an authenticated request. This shouldn't be set unless required. It is more secure to keep the key's value inside DSM only.
APPMANAGEABLE: Without this operation, management operations like delete, destroy, rotate, activate, restore, revoke, revert, update, remove_private, etc. cannot be performed by a crypto App. A user with access or admin app can still perform these operations. This option is only relevant for crypto apps.
HIGHVOLUME: If this is set, audit logs will not be recorded for the key. High volume here tries to signify a key that is being used a lot and will produce lots of logs. Setting this operation disables audit logs for the key.
AGREEKEY: If this is set, the key can be used for key agreement. Both the private and public key should have this option enabled to perform an agree operation.
ENCAPSULATE: If this is set, the key can be used for key encapsulation. The result is a new symmetric key and a ciphertext.
DECAPSULATE: If this is set, the key can be used for key decapsulation. If decapsulation succeeds, the result is a new symmetric key.
Cipher mode used for symmetric key algorithms.
Timestamp when the application was created.
A security principal.
OAuth scope.
The default group an application belongs to.
Description of this application.
Whether this application is enabled.
Operations allowed to be performed by an app.
SIGN:
VERIFY:
ENCRYPT:
DECRYPT:
WRAPKEY:
UNWRAPKEY:
DERIVEKEY:
MACGENERATE:
MACVERIFY:
EXPORT:
MANAGE:
AGREEKEY:
MASKDECRYPT:
AUDIT:
TRANSFORM:
CREATE_SOBJECTS:
COPY_SOBJECTS:
ROTATE_SOBJECTS:
ACTIVATE_SOBJECTS:
REVOKE_SOBJECTS:
REVERT_SOBJECTS:
MOVE_SOBJECTS:
UPDATE_SOBJECTS_PROFILE:
UPDATE_SOBJECTS_ENABLED_STATE:
UPDATE_SOBJECT_POLICIES:
UPDATE_KEY_OPS:
DELETE_KEY_MATERIAL:
DELETE_SOBJECTS:
DESTROY_SOBJECTS:
RESTORE_EXTERNAL_SOBJECTS:
CALCULATE_DIGEST:
ENCAPSULATE:
DECAPSULATE:
Interface used with this application (PKCS11, CNG, JCE, KMIP, etc).
The IPs that are allowed for an application. ipv4 or ipv6 both are acceptable types.
Timestamp when the application was most recently used.
If a requester is updating an App or retrieving its credentials, they must have the relevant permissions in all Groups that App has access to. But for legacy Apps, requester is required to have relevant permissions in any of the groups that App has access to.
Name of this application, which must be unique within an account.
OAuth settings for an app. If enabled, an app can request to act on behalf of a user.
App's role.
If auth_type is all, this field will include the list of individual auth
types for the app
Authentication method of an app.