---
title: "Importing a Security Object"
slug: "dsm-example-code-importing-a-security-object"
updated: 2025-09-11T11:17:02Z
published: 2025-09-11T11:17:02Z
canonical: "support.fortanix.com/dsm-example-code-importing-a-security-object"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Importing a Security Object

Fortanix-Data-Security-Manager (DSM) can import keys, certificates, and secrets that were created outside of Fortanix DSM. Note that except for public keys and certificates, it is generally more secure to create keys inside of Fortanix DSM as described in [*Creating a Security Object*](/v1/docs/creating-a-security-object) *example*.

The key value must be unencrypted (that is, not encrypted or password-protected). If the key you are importing is an encrypted key, you must first decrypt the key, either in your application or using a program such as `openssl`. Alternatively, you may import wrapped keys into Fortanix DSM as described in [*Unwrapping a Key*](/v1/docs/unwrapping-a-key) *example*.

Importing keys is performed with an `importSecurityObject` API. The `SobjectRequest` object defines the properties of the key that will be imported, including the key material to be used for the key. The `ObjectType` property of the `SobjectRequest` determine what type of Security-object will be imported. Use type `SECRET` to import Secrets. The `KeySize` and `ellipticCurve` properties of the `SobjectRequest` are ignored, as the key size or curve can be determined from the key material. The `name` property is required and must be unique. The `value` property provides the key material. The required format of value depends on what type of object is being imported.

If you do not override the default enabled operations, the imported key will be supporting all operations that make sense for the type of key. By default, imported keys will have the Export operation enabled too. So, for example, RSA keys will have the Sign, Verify, Encrypt, Decrypt, WrapKey, UnwrapKey, DeriveKey, and AppManageable operations. They will not have the MacGenerate or MacVerify operations, since those operations are not defined for RSA keys.

> [!WARNING]
> WARNING
> 
> Enabled operations may be removed from keys, but they cannot be added.

The enabled operations are specified using the `keyOps` property of the `SobjectRequest`. This property is a List. The imported key will be created with its enabled operations equal to the list provided.

If you want to import keys that can be exported from Fortanix DSM, you will need to request that the key be imported with the Export operation enabled along with any other operations you wish to enable on the key.

For example, to create a 2048 RSA key that is exportable and may only be used for signing and verifying the signature, use this `SobjectRequest`:

- [C#](/docs/dsm-example-code-importing-a-security-object#tabs-1)
- [Go](/docs/dsm-example-code-importing-a-security-object#tabs-2)
- [Java](/docs/dsm-example-code-importing-a-security-object#tabs-3)
- [Python](/docs/dsm-example-code-importing-a-security-object#tabs-4)
- [REST API using curl](/docs/dsm-example-code-importing-a-security-object#tabs-5)

### C#

```bash
SecurityObjectsApi securityObjectsApi = new SecurityObjectsApi(apiClient);
#Import RSA Key
SobjectRequest sobjectRequest = new SobjectRequest(
          Name: "Name"),
          Value: (<key value as bytes[]>),
          ObjType: ObjectType.RSA);
KeyObject keyObject = securityObjectsApi.ImportSecurityObject(sobjectRequest);

#Import Secret
SobjectRequest sobjectRequest = new SobjectRequest(
        Name: "Name"),
        Value: (<secret value as bytes[]>),
        ObjType: ObjectType.SECRET);
KeyObject keyObject = securityObjectsApi.ImportSecurityObject(sobjectRequest);
```

### Go

```bash
#Import RSA Key
objType := sdkms.ObjectTypeRsa
value := []byte(<key value as bytes>)
sobjectReq := sdkms.SobjectRequest{
Name: &name,
ObjType: &objType,
Value: &value,
}
sobject, err := client.ImportSobject(ctx, sobjectReq)
```

### Java

```bash
//Import RSA Key
SobjectRequest sobjectRequest = new SobjectRequest()          
          .name("Name").value(<key value as bytes[]>)
          .objType(ObjectType.RSA);
          .keyOps(Arrays.asList(KeyOperations.SIGN, KeyOperations.VERIFY, KeyOperations.EXPORT)); 
SecurityObjectsApi securityObjectsApi = new SecurityObjectsApi(apiClient);
KeyObject keyObject = securityObjectsApi.importSecurityObject(sobjectRequest);

// Import Certificate
SobjectRequest sobjectRequest = new SobjectRequest()
          .name("Name").value(<certificate value as bytes[]>)
          .objType(ObjectType.CERTIFICATE);
SecurityObjectsApi securityObjectsApi = new SecurityObjectsApi(apiClient);
KeyObject keyObject = securityObjectsApi.importSecurityObject (sobjectRequest);

// Import Secret
SobjectRequest sobjectRequest = new SobjectRequest()
          .name("Name").value(<secret value as bytes[]>)
          .objType(ObjectType.SECRET);
SecurityObjectsApi securityObjectsApi = new SecurityObjectsApi(apiClient);
KeyObject keyObject = securityObjectsApi.importSecurityObject (sobjectRequest);
```

### Python

```bash
api_instance = sdkms.v1.SecurityObjectsApi(api_client=client)

#Import RSA Key
request = sdkms.v1.SobjectRequest(name='Name', value=<key value as bytes>, obj_type= sdkms.v1.ObjectType.RSA)
key = api_instance.import_security_object(request)
```

### REST API using curl

```bash
#Generate RSA Key
curl <Endpoint URL>/crypto/v1/key -H 'Authorization: Bearer YhXwwa-6C...ig5g' -d '{"name": "Name", "key_size": 2048, "obj_type": "RSA"}'
```

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

A security object is any datum stored in DSM (for example a key, a certificate, a password, or other security objects). Each security object is assigned to exactly one group. users and applications assigned to the group have permission to see the security object and to perform operations on it.