---
title: "POST /#X-Amz-Target=TrentService.GenerateRandom"
method: POST
path: "/#X-Amz-Target=TrentService.GenerateRandom"
---

# POST /#X-Amz-Target=TrentService.GenerateRandom

`POST /#X-Amz-Target=TrentService.GenerateRandom`

Returns a random byte string that is cryptographically secure.

You must use the `NumberOfBytes` parameter to specify the length of the random byte string. There is no default value for string length.

By default, the random byte string is generated in KMS. To generate the byte string in the CloudHSM cluster associated with an CloudHSM key store, use the `CustomKeyStoreId` parameter.

Applications in Amazon Web Services Nitro Enclaves can call this operation by using the [Amazon Web Services Nitro Enclaves Development Kit](https://github.com/aws/aws-nitro-enclaves-sdk-c). For information about the supporting parameters, see [How Amazon Web Services Nitro Enclaves use KMS](https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html) in the _Key Management Service Developer Guide_.

For more information about entropy and random number generation, see [Key Management Service Cryptographic Details](https://docs.aws.amazon.com/kms/latest/cryptographic-details/).

**Cross-account use**: Not applicable. `GenerateRandom` does not use any account-specific resources, such as KMS keys.

**Required permissions**: [kms:GenerateRandom](https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html) (IAM policy)

## Headers

- `X-Amz-Target` 'TrentService.GenerateRandom', required

## Request body

- GenerateRandomRequest
  - `NumberOfBytes` integer — The length of the random byte string. This parameter is required.
  - `CustomKeyStoreId` string — <p>Generates the random byte string in the CloudHSM cluster that is associated with the specified CloudHSM key store. To find the ID of a custom key store, use the <a>DescribeCustomKeyStores</a> operation.</p> <p>External key store IDs are not valid for this parameter. If you specify the ID of an external key store, <code>GenerateRandom</code> throws an <code>UnsupportedOperationException</code>.</p>

## Response `200`

Success

- GenerateRandomResponse
  - `Plaintext` string, password — The random byte string. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.

## Other responses

- `480` — DependencyTimeoutException
- `481` — KMSInternalException
- `482` — UnsupportedOperationException
- `483` — CustomKeyStoreNotFoundException
- `484` — CustomKeyStoreInvalidStateException

---

[API](https://skmtc.net/aws/apis/kms.md) · [All operations](https://skmtc.net/aws/apis/kms/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/kms/versions/f92d678d2025/schema)