---
title: "Updating Security Objects"
slug: "dsm-updating-security-objects"
updated: 2025-07-22T13:15:38Z
published: 2025-07-22T13:15:38Z
canonical: "support.fortanix.com/dsm-updating-security-objects"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Updating Security Objects

## 1.0 Overview

Metadata for security objects, including their name, description, enabled operations, and custom metadata may be altered. The UUID of the Security-object, the group it belongs to, and the security object cryptographic material cannot be changed.

## 2.0 Prerequisites

Modifying security objects metadata requires a Fortanix-Data-Security-Manager (DSM) account, a group, and a user or application configured in that group, and a security object to update. *For more information, refer to the* [*User's Guide: Getting Started with Fortanix Data Security Manager - UI*](/v1/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

## 3.0 Authorization and Configuration

You must first authenticate and optionally configure a default API client as described in [*Configure API Client and Client Authentication*](/v1/docs/configure-api-client-and-client-authentication). You may authenticate as a user or as an app. Both users and applications may modify security objects.

## 4.0 Create a SecurityObjectsApi Client Object

Modifying security objects is performed with a SecurityObjectsApi object.

```bash
import com.fortanix.sdkms.v1.api.SecurityObjectsApi();

SecurityObjectsApi sobjectsApi = new SecurityObjectsApi();
```

## 5.0 Construct an SobjectRequest Object

The new properties are passed via properties of an SobjectRequest object. The properties that may be updated are:

- customMetadata
- description
- enabled
- keyOps
- name

Properties provided in the update request will be updated. Properties not provided will be not be updated.

Enabled operations may be deleted from a security object but may not be added. The keyOps field of the SobjectRequest is a list of the operations that will be enabled in the object after the update request succeeds.

For example, to update the name and description of a key, use the following SobjectRequest:

```bash
import com.fortanix.sdkms.v1.model.SobjectRequest;

SobjectRequest updateRequest = new SobjectRequest().name("New key name").description("New key description");
```

For example, to update a security object so it only has the Encrypt and Decrypt operations, use the following SobjectRequest:

```bash
import java.util.Arrays;
import com.fortanix.sdkms.v1.model.KeyOperations;
import com.fortanix.sdkms.v1.model.SobjectRequest;

SobjectRequest updateRequest = new SobjectRequest().keyOps(Arrays.asList(KeyOperations.ENCRYPT,  KeyOperations.DECRYPT));
```

Note that the above update will fail if the object does not currently have at least the Encrypt and Decrypt operations enabled, since operations can only be removed and not added.

## 6.0 Make the Update Security Object Call

The security object is updated by calling the updateSecurityObject() method of the SecurityObjectsApi object with the UUID of the key to update and the SobjectRequest. This method returns a KeyObject with the new metadatda of the security object.

```bash
KeyObject newKeyDetails = sobjectsApi.updateSecurityObject(<UUID of object to update>, updateRequest);
```

A security object is any datum stored in DSM (for example a key, a certificate, a password, or other security objects). Each security object is assigned to exactly one group. users and applications assigned to the group have permission to see the security object and to perform operations on it.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Symmetric Cryptography](/dsm-symmetric-cryptography.md)