EXexoscale
crypto

Generate Data Encryption Key

Changed on

Generate a Data Encryption Key from a given KMS Key.

post/kms-key/{id}/generate-data-key

Request

Path parameters

idstring uuid required

Request body

key-spec'AES-256'
bytes-countinteger
encryption-contextstring byte nullable

Base64-encoded Additional Authenticated Data binding key generation parameters securely to operational scope.

Response

Data Encryption Key in the clear and in its base64 encoded encrypted format.

plaintextstring byte required

The Base64-encoded raw symmetric data key payload. Expose only securely during active application setups.

ciphertextstring byte required

The identical symmetric data key, returned safely wrapped/encrypted using the designated root parent KMS key.

Changes