---
title: "Read a Key"
method: GET
path: "/byok/v1/keys/{id}"
tags: ["Keys (byok/v1)"]
---

# Read a Key

`GET /byok/v1/keys/{id}`

[![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](#section/Versioning/API-Lifecycle-Policy)

Make a request to read a key.

## Path parameters

- `id` string, required

## Response `200`

Key.

- object — `Key` objects represent customer managed keys on dedicated Confluent Cloud clusters. Keys are used to protect data at rest stored in your dedicated Confluent Cloud clusters on AWS, Azure, and GCP. This API allows you to upload and retrieve self-managed keys on Confluent Cloud. Related guide: [Confluent Cloud Bring Your Own Key (BYOK) Management API](https://docs.confluent.io/cloud/current/clusters/byok/index.html). ## The Keys Model <SchemaDefinition schemaRef="#/components/schemas/byok.v1.Key" /> ## Quotas and Limits This resource is subject to the [following quotas](https://docs.confluent.io/cloud/current/quotas/overview.html): | Quota | Description | | --- | --- | | `byok.max_keys.per_org` | BYOK keys in one Confluent Cloud organisation. |
  - `api_version` 'byok/v1', required — APIVersion defines the schema version of this representation of a resource.
  - `kind` 'Key', required — Kind defines the object this REST resource represents.
  - `id` string, required — ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object `kinds` or objects of the same `kind` within a different scope/namespace ("space").
  - `metadata` object — ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
    - `self` string, uri, required — Self is a Uniform Resource Locator (URL) at which an object can be addressed. This URL encodes the service location, API version, and other particulars necessary to locate the resource at a point in time
    - `resource_name` string, uri — Resource Name is a Uniform Resource Identifier (URI) that is globally unique across space and time. It is represented as a Confluent Resource Name
    - `created_at` string, date-time — The date and time at which this object was created. It is represented in RFC3339 format and is in UTC.
    - `updated_at` string, date-time — The date and time at which this object was last updated. It is represented in RFC3339 format and is in UTC.
    - `deleted_at` string, date-time — The date and time at which this object was (or will be) deleted. It is represented in RFC3339 format and is in UTC.
  - `key` union, required — The cloud-specific key details. For AWS, provide the corresponding `key_arn`. For Azure, provide the corresponding `key_id`. For GCP, provide the corresponding `key_id`.
    - object — The AWS BYOK details
      - `key_arn` string, required — The Amazon Resource Name (ARN) of an AWS KMS key.
      - `roles` string[] — The Amazon Resource Names (ARNs) of IAM Roles created for this key-environment combination.
      - `kind` 'AwsKey', required — BYOK kind type.
    - object — The Azure BYOK details.
      - `application_id` string — The Application ID created for this key-environment combination.
      - `key_id` string, required — The unique Key Object Identifier URL without version of an Azure Key Vault key.
      - `key_vault_id` string, required — Key Vault ID containing the key
      - `kind` 'AzureKey', required — BYOK kind type.
      - `tenant_id` string, required — Tenant ID (uuid) hosting the Key Vault containing the key
    - object — The GCP BYOK details
      - `key_id` string, required — The Google Cloud Platform key ID.
      - `security_group` string — The Google security group created for this key.
      - `kind` 'GcpKey', required — BYOK kind type.
  - `display_name` string — The human-readable name of the key object.
  - `provider` string, required — The cloud provider of the Key.
  - `state` string, required — The state of the key: AVAILABLE: key can be used for a Kafka cluster provisioning. IN_USE: key is already in use by a Kafka cluster provisioning.
  - `validation` ByokV1KeyValidation, required — The validation details of the key.
    - `phase` string, required — The validation phase of the key: INITIALIZING: Initial phase for new keys awaiting first successful validation. VALID: Last validation attempt succeeded. INVALID: Last validation attempt failed.
    - `message` string — A message describing validation events.
    - `since` string, date-time, required — The timestamp since which the key is in the current validation phase. Changes to the validation message or phase will update this timestamp.
    - `region` string — The cloud region where the key is deployed. This value is computed by the API after the key is successfully validated.

## Other responses

- `400` — Bad Request
- `401` — The request lacks valid authentication credentials for this resource.
- `403` — The access credentials were considered insufficient to grant access
- `404` — Not Found
- `429` — Rate Limit Exceeded
- `500` — Oops, something went wrong!

---

[API](https://skmtc.dev/confluent/apis/confluent-cloud-apis.md) · [All operations](https://skmtc.dev/confluent/apis/confluent-cloud-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/confluent/confluent-cloud-apis/revisions/a6a73f98a698/schema)