---
title: "KMS Config Update"
method: PUT
path: "/1/kms/configs/{kmsConfigId}"
tags: ["KMS Configuration"]
---

# KMS Config Update

`PUT /1/kms/configs/{kmsConfigId}`

## Request

- Base URL: `http://localhost:3000/api`
- URL: `http://localhost:3000/api/1/kms/configs/{kmsConfigId}`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/docs/1/kms/configs/:kmsConfigId/put.ts> (a function with typed inputs; its response is checked against the schema)

Update the specified KMS configuration's encrypted data or enable/disable key leasing for the configuration. The configuration must be owned by the calling vendor.

## Headers

- `icl-requestor-id` string, required

## Request body

- object
  - `config` union: KMS configuration update. `keyPath` cannot be updated
    - AwsKmsConfigUpdate: AWS configuration update. `keyPath` cannot be updated
      - `credentials` AwsCredentialsV1, required: AWS credentials
        - `accessKeyId` string, required: AWS Accesss Key ID
        - `secretAccessKey` string, required: AWS Secret Access Key
      - `type` 'AWS', required: KMS type: AWS
      - `version` integer, required: Config version
    - AzureKmsConfigUpdate: Azure configuration update. `keyPath` cannot be updated
      - `credentials` AzureCredentialsV1, required: Azure credentials
        - `clientId` string, required: Azure Client ID
        - `clientSecret` string, required: Azure Client Secret
        - `tenantGuid` string, required: Azure Tenant GUID
      - `type` 'AZURE', required: KMS type: Azure
      - `version` integer, required: Config version
    - GcpKmsConfigUpdate: GCP configuration update. `keyPath` cannot be updated
      - `credentials` GcpCredentialsV1, required: GCP credentials
        - `client_email` string, required: GCP client email
        - `private_key` string, required: GCP private key
      - `type` 'GCP', required: KMS type: GCP
      - `version` integer, required: Config version
    - ThalesKmsConfigUpdate: Thales configuration update. `keyPath` cannot be updated
      - `credentials` ThalesCredentialsV1, required: Thales credentials
        - `authDomain` string, required: Thales auth domain. May default to root
        - `connection` string, required: Thales connection. May default to local_account
        - `username` string, required: Thales username
        - `password` string, required: Thales password
      - `type` 'THALES', required: KMS type: THALES
      - `version` integer, required: Config version
  - `leasingAllowed` boolean: Wheather to allow key leasing for this configuration.

## Response `200`

Result of updating a KMS configuration

- object
  - `id` integer, required: KMS configuration ID
  - `encryptedConfig` string, required: Base 64 string
  - `kmsType` 'AZURE' | 'AWS' | 'GCP', required: KMS type: AWS, Azure, or GCP
  - `version` integer, required: Config version
  - `createdBy` CreatedBy, required: Metadata about creating user/service
    - `id` string, required: Creator ID
    - `name` string, required: Creator name
    - `type` 'Tsp' | 'Admin' | 'Va', required: Creator type
  - `leasingAllowed` boolean, required: Is key leasing enabled?
  - `assignmentCount` integer, required: Number of consumers of this configuration
  - `secretCount` integer, required: Number of active secrets associated with this configuration
  - `created` string, required: RFC3339 timestamp
  - `updated` string, required: RFC3339 timestamp

## Other responses

- `401`: Unauthorized
- `422`: Unprocessable Entity Possible causes: \- Invalid KMS configuration ID provided \- Kms configuration not owned by calling vendor

---

[API](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge.md) - [All operations](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/llms.txt) - [OpenAPI document](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/revisions/5c0e553ffa21?raw)