---
title: "Get KMS Key"
method: GET
path: "/kms-key/{id}"
tags: ["kms-key"]
---

# Get KMS Key

`GET /kms-key/{id}`

## Request

- Base URL: `https://api-ch-gva-2.exoscale.com/v2`
- URL: `https://api-ch-gva-2.exoscale.com/v2/kms-key/{id}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/exoscale/apis/exoscale-api/docs/kms-key/:id/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieve KMS Key details.

## Path parameters

- `id` string, uuid, required

## Response `200`

KMS Key Details

- GetKmsKeyResponse
  - `description` string: An optional detailed description providing additional context about the key's intended use case.
  - `rotation` KeyRotationConfig, required
    - `manual-count` integer, required: Total running tally of manual key rotation tasks executed by users over this key resource's lifecycle.
    - `automatic` boolean, required: When set to true, dictates that the system automatically rotates material periodically.
    - `rotation-period` integer, required: The set frequency period (measured in days) for triggers monitoring auto-rotation loops.
    - `next-at` string, date-time, required: Scheduled deadline calculation pinpointing the next automated rotational iteration target date.
  - `revision` RevisionStamp, required
    - `at` string, date-time, required: The timestamp recording exactly when this specific revision iteration occurred.
    - `seq` integer, required: Monotonically increasing sequencing value utilized for optimistic concurrency control locks.
  - `delete-at` string, date-time
  - `name` string, required: The display name of the KMS key.
  - `multi-zone` boolean, required: True if this is a multi-zone key.
  - `source` 'exoscale-kms', required
  - `usage` string, required: The cryptographic operation constraints allowed on this key.
  - `replicas-status` ReplicaState[]: Detailed synchronization metrics for each regional replica mirror.
    - `zone` string, required: The destination target zone tracking this specific replica instance.
    - `last-applied-watermark` integer, required: The latest logical sequence number or state watermark successfully synced to this regional replica.
    - `last-failure` ReplicaFailure
      - `attempted-watermark` integer, required: The target sync sequence watermark that triggered the replication failure.
      - `error` string, required: A descriptive message containing error logs or system details regarding the sync failure.
      - `failed-at` string, date-time, required: The UTC timestamp showing exactly when the replication sync window failed.
  - `status` 'enabled' | 'disabled' | 'pending-deletion', required
  - `status-since` string, date-time, required: The timestamp indicating exactly when the current key status was last transitioned.
  - `id` string, uuid, required: The globally unique identifier (UUID) of the retrieved KMS key.
  - `replicas` string[]: A list of availability zones where this specific key has active replica mirrors.
  - `material` KeyMaterial, required
    - `version` integer, required: The incremental index tracing internal key rotation cycles for the key material.
    - `created-at` string, date-time, required: The UTC date-time indicating when this particular generation of physical cryptographic material was seeded.
    - `automatic` boolean, required: A boolean flag indicating whether this specific material version was created during an automated system rotation window.
  - `origin-zone` string, required: The creation zone of the KMS key.
  - `created-at` string, date-time, required: The UTC timestamp showing when the KMS key was originally provisioned.

## Other responses

- `400`: ### Errors Key Not Found: The request was rejected because the specified KMS Key could not be found.

## Changes

- **2026-11-06** `63da6f74c845`: 3 breaking, 2 warning, 2 info
  - the response property `description` became optional for the status `200`
  - the response property `replicas` became optional for the status `200`
  - removed the required property `policy` from the response with the `200` status
  - removed the optional property `errors` from the response with the `400` status
  - …3 more
- **2026-03-16** `e05707a7b346`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/exoscale/apis/exoscale-api/changes/kms-key/:id/get.md)

---

[API](https://skmtc.dev/exoscale/apis/exoscale-api.md) - [All operations](https://skmtc.dev/exoscale/apis/exoscale-api/llms.txt) - [OpenAPI document](https://skmtc.dev/exoscale/apis/exoscale-api/revisions/63da6f74c845?raw)