Update app settings like groups, client config, etc.
Flag specifying if group permissions should be returned with the app group.
The App's role.
Operations allowed to be performed by an app.
SIGN:
VERIFY:
ENCRYPT:
DECRYPT:
WRAPKEY:
UNWRAPKEY:
DERIVEKEY:
MACGENERATE:
MACVERIFY:
EXPORT:
MANAGE:
AGREEKEY:
MASKDECRYPT:
AUDIT:
TRANSFORM:
CREATE_SOBJECTS:
COPY_SOBJECTS:
ROTATE_SOBJECTS:
ACTIVATE_SOBJECTS:
REVOKE_SOBJECTS:
REVERT_SOBJECTS:
MOVE_SOBJECTS:
UPDATE_SOBJECTS_PROFILE:
UPDATE_SOBJECTS_ENABLED_STATE:
UPDATE_SOBJECT_POLICIES:
UPDATE_KEY_OPS:
DELETE_KEY_MATERIAL:
DELETE_SOBJECTS:
DESTROY_SOBJECTS:
RESTORE_EXTERNAL_SOBJECTS:
CALCULATE_DIGEST:
ENCAPSULATE:
DECAPSULATE:
The user-defined type of this application.
Indicates whether waiting for quorum approval is activated or disabled
Time interval in seconds for client lib to check quorum status.
Maximum time in seconds for client lib to wait for quorum reply.
Use ignore_unknown_key_ops_for with [SECRET] instead of `ignore_unknown_key_ops_for_secrets``
Type of security object.
The operations to add to any key creation request (only supported in KMIP).
The following operations can be specified:
EXPORTAPPMANAGEABLEHIGHVOLUME
The operations specified cannot conflict with what's specified in the
key_ops field of account and/or group policies (where applicable).
Note: This is only enforced on (KMIP) creation requests since we assume updates removing key operations are intentional.
Operations allowed to be performed on a given key.
SIGN: If this is set, the key can be used to for signing.
VERIFY: If this is set, the key can used for verifying a signature.
ENCRYPT: If this is set, the key can be used for encryption.
DECRYPT: If this is set, the key can be used for decryption.
WRAPKEY: If this is set, the key can be used wrapping other keys. The key being wrapped must have the EXPORT operation enabled.
UNWRAPKEY: If this is set, the key can be used to unwrap a wrapped key.
DERIVEKEY: If this is set, the key can be used to derive another key.
TRANSFORM: If this is set, the key can be transformed.
MACGENERATE: If this is set, the key can be used to compute a cryptographic Message Authentication Code (MAC) on a message.
MACVERIFY: If they is set, the key can be used to verify a MAC.
EXPORT: If this is set, the value of the key can be retrieved with an authenticated request. This shouldn't be set unless required. It is more secure to keep the key's value inside DSM only.
APPMANAGEABLE: Without this operation, management operations like delete, destroy, rotate, activate, restore, revoke, revert, update, remove_private, etc. cannot be performed by a crypto App. A user with access or admin app can still perform these operations. This option is only relevant for crypto apps.
HIGHVOLUME: If this is set, audit logs will not be recorded for the key. High volume here tries to signify a key that is being used a lot and will produce lots of logs. Setting this operation disables audit logs for the key.
AGREEKEY: If this is set, the key can be used for key agreement. Both the private and public key should have this option enabled to perform an agree operation.
ENCAPSULATE: If this is set, the key can be used for key encapsulation. The result is a new symmetric key and a ciphertext.
DECAPSULATE: If this is set, the key can be used for key decapsulation. If decapsulation succeeds, the result is a new symmetric key.
Cipher mode used for symmetric key algorithms.
Using all, clients can specify a combination of two credentials:
- one must be a mutual TLS credential (either
certificateortrustedca), - the other must be a general app credential (one of
secret,awsiam,signedjwt, orldap)
Apps authenticating with this variant must present both forms of credentials, i.e., they must present a client certificate during TLS handshake, and also present the other form of credential in the HTTP request.
Size of the secret to be generated in bytes
PKI Certificate based authentication.
When true, revocation status of certificates is checked, and revoked
certificates are rejected
Set of allowed Google Access reasons.
An access reason provided by Google when making EKMS API calls.
Accept incoming requests which do not specify any access reasons.
Mapping for all groups an application is part of and the Gcp specific permissions it has within each of those groups.
CRYPTO_SPACE_GET_INFO:
CRYPTO_SPACE_GET_PUBLIC_KEY:
Signing keys used to validate JSON Web Signature objects including signed JSON Web Tokens.
Mapping key ids to DER-encoded public key.
Number of seconds that the service is allowed to cache the fetched keys.
LDAP credentials of an App used for authentication.
Size of the secret to be generated in bytes
PKI Certificate based authentication.
When true, revocation status of certificates is checked, and revoked
certificates are rejected
Set of allowed Google Access reasons.
An access reason provided by Google when making EKMS API calls.
Accept incoming requests which do not specify any access reasons.
Mapping for all groups an application is part of and the Gcp specific permissions it has within each of those groups.
CRYPTO_SPACE_GET_INFO:
CRYPTO_SPACE_GET_PUBLIC_KEY:
Signing keys used to validate JSON Web Signature objects including signed JSON Web Tokens.
Mapping key ids to DER-encoded public key.
Number of seconds that the service is allowed to cache the fetched keys.
LDAP credentials of an App used for authentication.
Migration period for which credentials(and its sessions) remain valid during api key regeneration.
The default group an application belongs to.
Groups an application no longer needs to be a part of. Array of UUID of groups.
Description of this application.
Whether this application is enabled.
Interface used with this application (PKCS11, CNG, JCE, KMIP, etc).
The IPs that are allowed for an application. ipv4 or ipv6 both are acceptable types.
Operations allowed to be performed by an app.
SIGN:
VERIFY:
ENCRYPT:
DECRYPT:
WRAPKEY:
UNWRAPKEY:
DERIVEKEY:
MACGENERATE:
MACVERIFY:
EXPORT:
MANAGE:
AGREEKEY:
MASKDECRYPT:
AUDIT:
TRANSFORM:
CREATE_SOBJECTS:
COPY_SOBJECTS:
ROTATE_SOBJECTS:
ACTIVATE_SOBJECTS:
REVOKE_SOBJECTS:
REVERT_SOBJECTS:
MOVE_SOBJECTS:
UPDATE_SOBJECTS_PROFILE:
UPDATE_SOBJECTS_ENABLED_STATE:
UPDATE_SOBJECT_POLICIES:
UPDATE_KEY_OPS:
DELETE_KEY_MATERIAL:
DELETE_SOBJECTS:
DESTROY_SOBJECTS:
RESTORE_EXTERNAL_SOBJECTS:
CALCULATE_DIGEST:
ENCAPSULATE:
DECAPSULATE:
Name of this application, which must be unique within an account.
OAuth settings for an app. If enabled, an app can request to act on behalf of a user.
App's role.
Size in bytes of app's secret.
Success result
The id of the Account that this application belongs to.
Unique id to identify the application.
The user-defined type of this application.
Certificate expiration date.
Indicates whether waiting for quorum approval is activated or disabled
Time interval in seconds for client lib to check quorum status.
Maximum time in seconds for client lib to wait for quorum reply.
Use ignore_unknown_key_ops_for with [SECRET] instead of `ignore_unknown_key_ops_for_secrets``
Type of security object.
The operations to add to any key creation request (only supported in KMIP).
The following operations can be specified:
EXPORTAPPMANAGEABLEHIGHVOLUME
The operations specified cannot conflict with what's specified in the
key_ops field of account and/or group policies (where applicable).
Note: This is only enforced on (KMIP) creation requests since we assume updates removing key operations are intentional.
Operations allowed to be performed on a given key.
SIGN: If this is set, the key can be used to for signing.
VERIFY: If this is set, the key can used for verifying a signature.
ENCRYPT: If this is set, the key can be used for encryption.
DECRYPT: If this is set, the key can be used for decryption.
WRAPKEY: If this is set, the key can be used wrapping other keys. The key being wrapped must have the EXPORT operation enabled.
UNWRAPKEY: If this is set, the key can be used to unwrap a wrapped key.
DERIVEKEY: If this is set, the key can be used to derive another key.
TRANSFORM: If this is set, the key can be transformed.
MACGENERATE: If this is set, the key can be used to compute a cryptographic Message Authentication Code (MAC) on a message.
MACVERIFY: If they is set, the key can be used to verify a MAC.
EXPORT: If this is set, the value of the key can be retrieved with an authenticated request. This shouldn't be set unless required. It is more secure to keep the key's value inside DSM only.
APPMANAGEABLE: Without this operation, management operations like delete, destroy, rotate, activate, restore, revoke, revert, update, remove_private, etc. cannot be performed by a crypto App. A user with access or admin app can still perform these operations. This option is only relevant for crypto apps.
HIGHVOLUME: If this is set, audit logs will not be recorded for the key. High volume here tries to signify a key that is being used a lot and will produce lots of logs. Setting this operation disables audit logs for the key.
AGREEKEY: If this is set, the key can be used for key agreement. Both the private and public key should have this option enabled to perform an agree operation.
ENCAPSULATE: If this is set, the key can be used for key encapsulation. The result is a new symmetric key and a ciphertext.
DECAPSULATE: If this is set, the key can be used for key decapsulation. If decapsulation succeeds, the result is a new symmetric key.
Cipher mode used for symmetric key algorithms.
Timestamp when the application was created.
A security principal.
OAuth scope.
The default group an application belongs to.
Description of this application.
Whether this application is enabled.
Operations allowed to be performed by an app.
SIGN:
VERIFY:
ENCRYPT:
DECRYPT:
WRAPKEY:
UNWRAPKEY:
DERIVEKEY:
MACGENERATE:
MACVERIFY:
EXPORT:
MANAGE:
AGREEKEY:
MASKDECRYPT:
AUDIT:
TRANSFORM:
CREATE_SOBJECTS:
COPY_SOBJECTS:
ROTATE_SOBJECTS:
ACTIVATE_SOBJECTS:
REVOKE_SOBJECTS:
REVERT_SOBJECTS:
MOVE_SOBJECTS:
UPDATE_SOBJECTS_PROFILE:
UPDATE_SOBJECTS_ENABLED_STATE:
UPDATE_SOBJECT_POLICIES:
UPDATE_KEY_OPS:
DELETE_KEY_MATERIAL:
DELETE_SOBJECTS:
DESTROY_SOBJECTS:
RESTORE_EXTERNAL_SOBJECTS:
CALCULATE_DIGEST:
ENCAPSULATE:
DECAPSULATE:
Interface used with this application (PKCS11, CNG, JCE, KMIP, etc).
The IPs that are allowed for an application. ipv4 or ipv6 both are acceptable types.
Timestamp when the application was most recently used.
If a requester is updating an App or retrieving its credentials, they must have the relevant permissions in all Groups that App has access to. But for legacy Apps, requester is required to have relevant permissions in any of the groups that App has access to.
Name of this application, which must be unique within an account.
OAuth settings for an app. If enabled, an app can request to act on behalf of a user.
App's role.
If auth_type is all, this field will include the list of individual auth
types for the app
Authentication method of an app.