Calculate Cryptographic Operation Latency SLIs

1.0 Introduction

This article describes how to use the Fortanix-Data-Security-Manager (DSM) Audit Logs API (/sys/v1/logs) and Get Key API (/crypto/v1/keys/{key_id}) to retrieve the information required to calculate Service Level Indicators (SLIs) for cryptographic operation latency. It explains how to obtain audit log information and key metadata to calculate latency statistics for cryptographic operations grouped by operation type, key type, and key size.

2.0 Retrieve Audit Logs

The Audit Logs API (/sys/v1/logs) retrieves audit log entries for cryptographic operations. The endpoint is paginated and returns up to 1000 log entries per request. Use the query parameters to define the time range and retrieve additional pages of results.

NOTE
Audit logs are returned in reverse chronological order.
The time range specified by range_from and range_to cannot exceed 30 days.
The maximum value for the size parameter is 1000.

2.1 Query Parameters

Parameter	Description
`range_from`	Unix timestamp that specifies the beginning of the time range.
`range_to`	Unix timestamp that specifies the end of the time range.
`size`	Maximum number of audit log entries to return. The value cannot exceed 1000.
`previous_id`	UUID of the last log returned by the previous request. Use this parameter to retrieve the next page of results.

2.2 Example: Retrieve the First Page of Audit Logs

The following request retrieves up to 1000 audit logs between July 1 and July 31, 2026.

GET {dsm_url}/sys/v1/logs?range_from=1782889200&range_to=1785499200&size=1000

2.3 Example: Retrieve the Next Page

Use the previous_id parameter to retrieve the next page. The last log entry returned by the previous request has the ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.

GET {dsm_url}/sys/v1/logs?range_from=1782889200&range_to=1785499200&size=1000&previous_id=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

2.4 Response Schema

The Audit Logs API returns a JSON document containing an array of audit log entries.

{
  "hits": [
    {
      "_id": "Uuid",
      "_source": {
        "action_type": "string",
        "object_id": "Uuid",
        "message": "string", // For crypto operations, this has the form:
        // “App "{app_name}" used key "{key_name}" to perform "{crypto_operation}" operation”
        // {crypto_operation} can be Encryption, Decryption, Signing, Verification, etc.
        "response_time": {
          "secs": "int",
          "nanos": "int",
        }
      }
    },
  ]
}

The Log API response has the following fields:

Field	Description
`_id`	Unique identifier for the audit log entry. Use this value with `previous_id` to retrieve the next page of results.
`action_type`	Type of audited action. Filter entries with the value `CRYPTOOPERATION` to calculate cryptographic operation latency.
`object_id`	Identifier of the key used for the cryptographic operation. Use this value to retrieve key metadata with the Keys API.
`message`	Describes the cryptographic operation, including the application name, key name, and operation type, such as encryption, decryption, signing, or verification.
`response_time.secs`	Whole seconds component of the operation latency.
`response_time.nanos`	Nanoseconds component of the operation latency.

3.0 Retrieve Key Metadata

Use the Get Key API (/crypto/v1/keys/{key_id}) to retrieve the key type and key size.

For audit log entries where action_type is CRYPTOOPERATION, the object_id field contains the ID of the key used to perform the operation.

Use the key ID from the audit log to retrieve the key metadata with the Get Key API.

GET /crypto/v1/keys/{key_id}

The response includes metadata for the specified key.

{
  "kid": "Uuid",
  "key_size": "int",
  "obj_type": "string",
}

Response fields

Field	Description
`kid`	Unique identifier of the key.
`key_size`	Size of the key, in bits.
`obj_type`	Cryptographic key type such as AES or RSA

Combine the following information to calculate latency SLIs for cryptographic operations:

Operation type (from the message field)
Operation latency (from response_time)
Key type (obj_type)
Key size (key_size)

Group the resulting latency statistics by operation type, key type, and key size to analyse the performance of different cryptographic operations.

Documentation Index