---
title: "KMS Config Get"
method: GET
path: "/1/kms/configs/{kmsConfigId}"
tags: ["KMS Configuration"]
---

# KMS Config Get

`GET /1/kms/configs/{kmsConfigId}`

## Request

- Base URL: `http://localhost:3000/api`
- URL: `http://localhost:3000/api/1/kms/configs/{kmsConfigId}`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/docs/1/kms/configs/:kmsConfigId/get.ts> (a function with typed inputs; its response is checked against the schema)

Get the specified KMS configuration. 
Returns metadata and, if your organization owns the configuration, the decrypted data.

## Headers

- `icl-requestor-id` string, required

## Response `200`

Result of decrypting a KMS configuration

- object
  - `id` integer, required: KMS configuration ID
  - `decryptedConfig` union, required: KMS configuration without sensitive credentials
    - AwsKmsConfigNonsensitive: AWS configuration without sensitive credentials
      - `keyPath` object, required: AWS keypath
        - `keyID` string, required: AWS Key ID
        - `region` string, required: AWS Region
      - `type` 'AWS', required: KMS type: AWS
      - `version` integer, required: Config version
    - AzureKmsConfigNonsensitive: Azure configuration without sensitive credentials
      - `keyPath` object, required: Azure keypath
        - `keyName` string, required: Azure Key Name
        - `vaultBaseUrl` string, required: Azure Vault Base URL
      - `type` 'AZURE', required: KMS type: Azure
      - `version` integer, required: Config version
    - GcpKmsConfigNonsensitive: GCP configuration without sensitive credentials
      - `keyPath` object, required: GCP keypath
        - `cryptoKeyId` string, required: GCP crypto key ID
        - `keyRingId` string, required: GCP key ring ID
        - `locationId` string, required: GCP location ID
        - `projectId` string, required: GCP project ID
      - `type` 'GCP', required: KMS type: GCP
      - `version` integer, required: Config version
    - ThalesKmsConfigNonsensitive: Thales configuration without sensitive credentials
      - `keyPath` object, required: Thales key path. Cannot be changed later
        - `keyId` string, required: Thales key ID
        - `serviceUrl` string, required: Thales service URL
      - `type` 'THALES', required: KMS type: THALES
      - `version` integer, required: Config version
  - `createdBy` CreatedBy, required: Metadata about creating user/service
    - `id` string, required: Creator ID
    - `name` string, required: Creator name
    - `type` 'Tsp' | 'Admin' | 'Va', required: Creator type
  - `leasingAllowed` boolean, required: Is key leasing enabled?
  - `assignmentCount` integer, required: Number of consumers of the configuration.
  - `secretCount` integer, required: Number of active secrets associated with this configuration
  - `created` string, required: RFC3339 timestamp
  - `updated` string, required: RFC3339 timestamp

## Other responses

- `401`: Unauthorized
- `422`: Unprocessable Entity Possible causes: \- Invalid KMS configuration ID provided \- Kms configuration not owned by calling vendor

---

[API](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge.md) - [All operations](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/llms.txt) - [OpenAPI document](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/revisions/5c0e553ffa21?raw)