Sign in

v1

latestOpenAPI 3.0.0Creative Commons Attribution 3.02026-07-134796204.9 KB
projects

Create a new CryptoKeyVersion in a CryptoKey. The server will assign the next sequential id. If unset, state will be set to ENABLED.

post/v1/{+parent}/cryptoKeyVersions

Path parameters

parentstring required

Required. The name of the CryptoKey associated with the CryptoKeyVersions.

Request body

generationFailureReasonstring

Output only. The root cause of the most recent generation failure. Only present if state is GENERATION_FAILED.

namestring

Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.

destroyTimestring google-datetime

Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.

algorithm'CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED' | 'GOOGLE_SYMMETRIC_ENCRYPTION' | 'AES_128_GCM' | 'AES_256_GCM' | 'AES_128_CBC' | 'AES_256_CBC' | 'AES_128_CTR' | 'AES_256_CTR' | 'RSA_SIGN_PSS_2048_SHA256' | 'RSA_SIGN_PSS_3072_SHA256' | 'RSA_SIGN_PSS_4096_SHA256' | 'RSA_SIGN_PSS_4096_SHA512' | 'RSA_SIGN_PKCS1_2048_SHA256' | 'RSA_SIGN_PKCS1_3072_SHA256' | 'RSA_SIGN_PKCS1_4096_SHA256' | 'RSA_SIGN_PKCS1_4096_SHA512' | 'RSA_SIGN_RAW_PKCS1_2048' | 'RSA_SIGN_RAW_PKCS1_3072' | 'RSA_SIGN_RAW_PKCS1_4096' | 'RSA_DECRYPT_OAEP_2048_SHA256' | 'RSA_DECRYPT_OAEP_3072_SHA256' | 'RSA_DECRYPT_OAEP_4096_SHA256' | 'RSA_DECRYPT_OAEP_4096_SHA512' | 'RSA_DECRYPT_OAEP_2048_SHA1' | 'RSA_DECRYPT_OAEP_3072_SHA1' | 'RSA_DECRYPT_OAEP_4096_SHA1' | 'EC_SIGN_P256_SHA256' | 'EC_SIGN_P384_SHA384' | 'EC_SIGN_SECP256K1_SHA256' | 'EC_SIGN_ED25519' | 'HMAC_SHA256' | 'HMAC_SHA1' | 'HMAC_SHA384' | 'HMAC_SHA512' | 'HMAC_SHA224' | 'EXTERNAL_SYMMETRIC_ENCRYPTION' | 'ML_KEM_768' | 'ML_KEM_1024' | 'KEM_XWING' | 'PQ_SIGN_ML_DSA_44' | 'PQ_SIGN_ML_DSA_65' | 'PQ_SIGN_ML_DSA_87' | 'PQ_SIGN_SLH_DSA_SHA2_128S' | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256' | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU' | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU' | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU' | 'AES_256_KWP'

Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

destroyEventTimestring google-datetime

Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.

state'CRYPTO_KEY_VERSION_STATE_UNSPECIFIED' | 'PENDING_GENERATION' | 'ENABLED' | 'DISABLED' | 'DESTROYED' | 'DESTROY_SCHEDULED' | 'PENDING_IMPORT' | 'IMPORT_FAILED' | 'GENERATION_FAILED' | 'PENDING_EXTERNAL_DESTRUCTION' | 'EXTERNAL_DESTRUCTION_FAILED'

The current state of the CryptoKeyVersion.

trustedWrappingEnabledboolean

Immutable. Field indicating that the key may be wrapped by a trusted key. This field can be set for all key purposes except ENCRYPT_DECRYPT, and is only valid for keys with protection level HSM_SINGLE_TENANT. This field can only be set at creation or import time via CreateCryptoKeyVersion, or ImportCryptoKeyVersion.

importJobstring

Output only. The name of the ImportJob used in the most recent import of this CryptoKeyVersion. Only present if the underlying key material was imported.

createTimestring google-datetime

Output only. The time at which this CryptoKeyVersion was created.

externalDestructionFailureReasonstring

Output only. The root cause of the most recent external destruction failure. Only present if state is EXTERNAL_DESTRUCTION_FAILED.

generateTimestring google-datetime

Output only. The time this CryptoKeyVersion's key material was generated.

importTimestring google-datetime

Output only. The time at which this CryptoKeyVersion's key material was most recently imported.

protectionLevel'PROTECTION_LEVEL_UNSPECIFIED' | 'SOFTWARE' | 'HSM' | 'EXTERNAL' | 'EXTERNAL_VPC' | 'HSM_SINGLE_TENANT'

Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.

importFailureReasonstring

Output only. The root cause of the most recent import failure. Only present if state is IMPORT_FAILED.

reimportEligibleboolean

Output only. Whether or not this key version is eligible for reimport, by being specified as a target in ImportCryptoKeyVersionRequest.crypto_key_version.

hsmTrustedboolean

Output only. Field indicating that the key wrapping key is trusted. This field is only valid for key purpose AES_256_WRAPPING, and protection level HSM_SINGLE_TENANT.

Response

Successful response