---
title: "List KMS Keys"
method: GET
path: "/kms-key"
tags: ["kms-key"]
---

# List KMS Keys

`GET /kms-key`

## Request

- Base URL: `https://api-ch-gva-2.exoscale.com/v2`
- URL: `https://api-ch-gva-2.exoscale.com/v2/kms-key`
- Auth: none declared
- TypeScript: <https://skmtc.dev/exoscale/apis/exoscale-api/docs/kms-key/get.ts> (a function with typed inputs; its response is checked against the schema)

Lists all KMS Keys in your organization in a given zone.

## Response `200`

A list of all KMS keys in the target zone

- ListKmsKeysResponse
  - `kms-keys` ListKmsKeysResponseEntry[], required: An array containing metadata entries for all available keys for your organization in the requested zone.
    - `description` string: An optional detailed description providing additional context about the key's intended use case.
    - `rotation` KeyRotationConfig, required
      - `manual-count` integer, required: Total running tally of manual key rotation tasks executed by users over this key resource's lifecycle.
      - `automatic` boolean, required: When set to true, dictates that the system automatically rotates material periodically.
      - `rotation-period` integer, required: The set frequency period (measured in days) for triggers monitoring auto-rotation loops.
      - `next-at` string, date-time, required: Scheduled deadline calculation pinpointing the next automated rotational iteration target date.
    - `revision` RevisionStamp, required
      - `at` string, date-time, required: The timestamp recording exactly when this specific revision iteration occurred.
      - `seq` integer, required: Monotonically increasing sequencing value utilized for optimistic concurrency control locks.
    - `delete-at` string, date-time
    - `name` string, required: The display name of the KMS key.
    - `multi-zone` boolean, required: True if this is a multi-zone key.
    - `source` 'exoscale-kms', required
    - `usage` string, required: The cryptographic operation constraints allowed on this key.
    - `status` 'enabled' | 'disabled' | 'pending-deletion', required
    - `status-since` string, date-time, required: The precise time when the key entered its current configuration phase.
    - `id` string, uuid, required: The globally unique identifier (UUID) tracking this key entity.
    - `replicas` string[]: Array tracking target zones currently maintaining copies of this item.
    - `material` KeyMaterial, required
      - `version` integer, required: The incremental index tracing internal key rotation cycles for the key material.
      - `created-at` string, date-time, required: The UTC date-time indicating when this particular generation of physical cryptographic material was seeded.
      - `automatic` boolean, required: A boolean flag indicating whether this specific material version was created during an automated system rotation window.
    - `origin-zone` string, required: The creation zone of the KMS key.
    - `created-at` string, date-time, required: The UTC timestamp showing when the KMS key was originally provisioned.

## Other responses

- `400`: ### Errors Bad Request: The request was rejected because of an invalid request body or path parameter.

## Changes

- **2026-11-06** `63da6f74c845`: 2 breaking, 2 warning, 1 info
  - the response property `kms-keys/items/description` became optional for the status `200`
  - the response property `kms-keys/items/replicas` became optional for the status `200`
  - removed the optional property `errors` from the response with the `400` status
  - removed the optional property `instance` from the response with the `400` status
  - …1 more
- **2026-03-16** `e05707a7b346`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/exoscale/apis/exoscale-api/changes/kms-key/get.md)

---

[API](https://skmtc.dev/exoscale/apis/exoscale-api.md) - [All operations](https://skmtc.dev/exoscale/apis/exoscale-api/llms.txt) - [OpenAPI document](https://skmtc.dev/exoscale/apis/exoscale-api/revisions/63da6f74c845?raw)