Key Management Management Functions

Package: DBMS_CLOUD_OCI_KM_KMS_MANAGEMENT

BACKUP_KEY Function

Backs up an encrypted file that contains all key versions and metadata of the specified key so that you can restore the key later. The file also contains the metadata of the vault that the key belonged to.

Syntax

FUNCTION backup_key (
  key_id varchar2,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  backup_key_details dbms_cloud_oci_key_management_backup_key_details_t DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_backup_key_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`backup_key_details`	(optional) BackupKeyDetails
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

CANCEL_KEY_DELETION Function

Cancels the scheduled deletion of the specified key. Canceling a scheduled deletion restores the key's lifecycle state to what it was before its scheduled deletion. As a provisioning operation, this call is subject to a Key Management limit that applies to the total number of requests across all provisioning write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of provisioning write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION cancel_key_deletion (
  key_id varchar2,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_cancel_key_deletion_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

CANCEL_KEY_VERSION_DELETION Function

Cancels the scheduled deletion of the specified key version. Canceling a scheduled deletion restores the key version to its lifecycle state from before its scheduled deletion. As a provisioning operation, this call is subject to a Key Management limit that applies to the total number of requests across all provisioning write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of provisioning write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION cancel_key_version_deletion (
  key_id varchar2,
  key_version_id varchar2,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_cancel_key_version_deletion_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`key_version_id`	(required) The OCID of the key version.
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

CHANGE_KEY_COMPARTMENT Function

Moves a key into a different compartment within the same tenancy. For information about moving resources between compartments, see Moving Resources to a Different Compartment. When provided, if-match is checked against the ETag values of the key. As a provisioning operation, this call is subject to a Key Management limit that applies to the total number of requests across all provisioning write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of provisioning write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION change_key_compartment (
  key_id varchar2,
  change_key_compartment_details dbms_cloud_oci_key_management_change_key_compartment_details_t,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_change_key_compartment_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`change_key_compartment_details`	(required) Details of change key compartment.
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

CREATE_KEY Function

Creates a new master encryption key. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION create_key (
  create_key_details dbms_cloud_oci_key_management_create_key_details_t,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_create_key_response_t;

Parameters

Parameter	Description
`create_key_details`	(required) CreateKeyDetails
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

CREATE_KEY_VERSION Function

Generates a new KeyVersion resource that provides new cryptographic material for a master encryption key. The key must be in an `ENABLED` state to be rotated. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION create_key_version (
  key_id varchar2,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  create_key_metadata_details dbms_cloud_oci_key_management_external_key_version_reference_t DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_create_key_version_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`create_key_metadata_details`	(optional) CreateKeyMetadataDetails
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

DISABLE_KEY Function

Disables a master encryption key so it can no longer be used for encryption, decryption, or generating new data encryption keys. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION disable_key (
  key_id varchar2,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_disable_key_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

ENABLE_KEY Function

Enables a master encryption key so it can be used for encryption, decryption, or generating new data encryption keys. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION enable_key (
  key_id varchar2,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_enable_key_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

GET_KEY Function

Gets information about the specified master encryption key. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management read operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management read operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION get_key (
  key_id varchar2,
  opc_request_id varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_get_key_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

GET_KEY_VERSION Function

Gets information about the specified key version. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management read operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management read operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION get_key_version (
  key_id varchar2,
  key_version_id varchar2,
  opc_request_id varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_get_key_version_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`key_version_id`	(required) The OCID of the key version.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

GET_REPLICATION_STATUS Function

When a vault has a replica, each operation on the vault or its resources, such as keys, is replicated and has an associated replicationId. Replication status provides details about whether the operation associated with the given replicationId has been successfully applied across replicas.

Syntax

FUNCTION get_replication_status (
  replication_id varchar2,
  opc_request_id varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_get_replication_status_response_t;

Parameters

Parameter	Description
`replication_id`	(required) replicationId associated with an operation on a resource
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

GET_WRAPPING_KEY Function

Gets details about the public RSA wrapping key associated with the vault in the endpoint. Each vault has an RSA key-pair that wraps and unwraps AES key material for import into Key Management.

Syntax

FUNCTION get_wrapping_key (
  opc_request_id varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_get_wrapping_key_response_t;

Parameters

Parameter	Description
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

IMPORT_KEY Function

Imports AES and RSA keys to create a new key. The key material must be base64-encoded and wrapped by the vault's public RSA wrapping key before you can import it. Key Management supports both RSA and AES keys. The AES keys are symmetric keys of length 128 bits (16 bytes), 192 bits (24 bytes), or 256 bits (32 bytes), and the RSA keys are asymmetric keys of length 2048 bits (256 bytes), 3072 bits (384 bytes), and 4096 bits (512 bytes). Furthermore, the key length must match what you specify at the time of import. When importing an asymmetric key, only private key must be wrapped in PKCS8 format while the corresponding public key is generated internally by KMS.

Syntax

FUNCTION import_key (
  import_key_details dbms_cloud_oci_key_management_import_key_details_t,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_import_key_response_t;

Parameters

Parameter	Description
`import_key_details`	(required) ImportKeyDetails
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

IMPORT_KEY_VERSION Function

Imports AES key material to create a new key version and then rotate the key to begin using the new key version. The key material must be base64-encoded and wrapped by the vault's public RSA wrapping key before you can import it. Key Management supports AES symmetric keys that are exactly 16, 24, or 32 bytes. Furthermore, the key length must match the length of the specified key and what you specify as the length at the time of import. When importing an asymmetric key, only the private key must be wrapped in PKCS8 format while the corresponding public key is generated internally by KMS.

Syntax

FUNCTION import_key_version (
  key_id varchar2,
  import_key_version_details dbms_cloud_oci_key_management_import_key_version_details_t,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_import_key_version_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`import_key_version_details`	(required) ImportKeyVersionDetails
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

LIST_KEY_VERSIONS Function

Lists all KeyVersion resources for the specified master encryption key. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management read operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management read operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION list_key_versions (
  key_id varchar2,
  limit number DEFAULT NULL,
  page varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  sort_by varchar2 DEFAULT NULL,
  sort_order varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_list_key_versions_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`limit`	(optional) The maximum number of items to return in a paginated \"List\" call.
`page`	(optional) The value of the `opc-next-page` response header from the previous \"List\" call.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`sort_by`	(optional) The field to sort by. You can specify only one sort order. The default order for `TIMECREATED` is descending. The default order for `DISPLAYNAME` is ascending. Allowed values are: 'TIMECREATED', 'DISPLAYNAME'
`sort_order`	(optional) The sort order to use, either ascending (`ASC`) or descending (`DESC`). Allowed values are: 'ASC', 'DESC'
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

LIST_KEYS Function

Lists the master encryption keys in the specified vault and compartment. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management read operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management read operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION list_keys (
  compartment_id varchar2,
  limit number DEFAULT NULL,
  page varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  sort_by varchar2 DEFAULT NULL,
  sort_order varchar2 DEFAULT NULL,
  protection_mode varchar2 DEFAULT NULL,
  algorithm varchar2 DEFAULT NULL,
  length number DEFAULT NULL,
  curve_id varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_list_keys_response_t;

Parameters

Parameter	Description
`compartment_id`	(required) The OCID of the compartment.
`limit`	(optional) The maximum number of items to return in a paginated \"List\" call.
`page`	(optional) The value of the `opc-next-page` response header from the previous \"List\" call.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`sort_by`	(optional) The field to sort by. You can specify only one sort order. The default order for `TIMECREATED` is descending. The default order for `DISPLAYNAME` is ascending. Allowed values are: 'TIMECREATED', 'DISPLAYNAME'
`sort_order`	(optional) The sort order to use, either ascending (`ASC`) or descending (`DESC`). Allowed values are: 'ASC', 'DESC'
`protection_mode`	(optional) A key's protection mode indicates how the key persists and where cryptographic operations that use the key are performed. A protection mode of `HSM` means that the key persists on a hardware security module (HSM) and all cryptographic operations are performed inside the HSM. A protection mode of `SOFTWARE` means that the key persists on the server, protected by the vault's RSA wrapping key which persists on the HSM. All cryptographic operations that use a key with a protection mode of `SOFTWARE` are performed on the server. A protection mode of `EXTERNAL` mean that the key persists on the customer's external key manager which is hosted externally outside of oracle. Oracle only hold a reference to that key. All cryptographic operations that use a key with a protection mode of `EXTERNAL` are performed by external key manager. Allowed values are: 'HSM', 'SOFTWARE', 'EXTERNAL'
`algorithm`	(optional) The algorithm used by a key's key versions to encrypt or decrypt data. Currently, support includes AES, RSA, and ECDSA algorithms. Allowed values are: 'AES', 'RSA', 'ECDSA'
`length`	(optional) The length of the key in bytes, expressed as an integer. Supported values include 16, 24, or 32.
`curve_id`	(optional) The curve ID of the keys. (This pertains only to ECDSA keys.) Allowed values are: 'NIST_P256', 'NIST_P384', 'NIST_P521'
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

RESTORE_KEY_FROM_FILE Function

Restores the specified key to the specified vault, based on information in the backup file provided. If the vault doesn't exist, the operation returns a response with a 404 HTTP status error code. You need to first restore the vault associated with the key.

Syntax

FUNCTION restore_key_from_file (
  content_length number DEFAULT NULL,
  restore_key_from_file_details blob,
  if_match varchar2 DEFAULT NULL,
  content_md5 varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_restore_key_from_file_response_t;

Parameters

Parameter	Description
`content_length`	(optional) The content length of the body.
`restore_key_from_file_details`	(required) The encrypted backup file to upload to restore the key.
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`content_md5`	(optional) The base64-encoded MD5 hash value of the body, as described in RFC 2616, section 14.15. If the Content-MD5 header is present, Key Management performs an integrity check on the body of the HTTP request by computing the MD5 hash for the body and comparing it to the MD5 hash supplied in the header. If the two hashes don't match, the object is rejected and a response with 400 Unmatched Content MD5 error is returned, along with the message: \"The computed MD5 of the request body (ACTUAL_MD5) does not match the Content-MD5 header (HEADER_MD5).\"
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

RESTORE_KEY_FROM_OBJECT_STORE Function

Restores the specified key to the specified vault from an Oracle Cloud Infrastructure Object Storage location. If the vault doesn't exist, the operation returns a response with a 404 HTTP status error code. You need to first restore the vault associated with the key.

Syntax

FUNCTION restore_key_from_object_store (
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  restore_key_from_object_store_details dbms_cloud_oci_key_management_restore_key_from_object_store_details_t DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_restore_key_from_object_store_response_t;

Parameters

Parameter	Description
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`restore_key_from_object_store_details`	(optional) Location to restore the backup from
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

SCHEDULE_KEY_DELETION Function

Schedules the deletion of the specified key. This sets the lifecycle state of the key to `PENDING_DELETION` and then deletes it after the specified retention period ends. As a provisioning operation, this call is subject to a Key Management limit that applies to the total number of requests across all provisioning write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of provisioning write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION schedule_key_deletion (
  key_id varchar2,
  schedule_key_deletion_details dbms_cloud_oci_key_management_schedule_key_deletion_details_t,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_schedule_key_deletion_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`schedule_key_deletion_details`	(required) ScheduleKeyDeletionDetails
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

SCHEDULE_KEY_VERSION_DELETION Function

Schedules the deletion of the specified key version. This sets the lifecycle state of the key version to `PENDING_DELETION` and then deletes it after the specified retention period ends. As a provisioning operation, this call is subject to a Key Management limit that applies to the total number of requests across all provisioning write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of provisioning write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION schedule_key_version_deletion (
  key_id varchar2,
  key_version_id varchar2,
  schedule_key_version_deletion_details dbms_cloud_oci_key_management_schedule_key_version_deletion_details_t,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  opc_retry_token varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_schedule_key_version_deletion_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`key_version_id`	(required) The OCID of the key version.
`schedule_key_version_deletion_details`	(required) ScheduleKeyVersionDeletionDetails
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`opc_retry_token`	(optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

UPDATE_KEY Function

Updates the properties of a master encryption key. Specifically, you can update the `displayName`, `freeformTags`, and `definedTags` properties. Furthermore, the key must be in an `ENABLED` or `CREATING` state to be updated. As a management operation, this call is subject to a Key Management limit that applies to the total number of requests across all management write operations. Key Management might throttle this call to reject an otherwise valid request when the total rate of management write operations exceeds 10 requests per second for a given tenancy.

Syntax

FUNCTION update_key (
  key_id varchar2,
  update_key_details dbms_cloud_oci_key_management_update_key_details_t,
  if_match varchar2 DEFAULT NULL,
  opc_request_id varchar2 DEFAULT NULL,
  region varchar2 DEFAULT NULL, 
  endpoint varchar2 DEFAULT NULL,
  credential_name varchar2 DEFAULT NULL
) RETURN dbms_cloud_oci_km_kms_management_update_key_response_t;

Parameters

Parameter	Description
`key_id`	(required) The OCID of the key.
`update_key_details`	(required) UpdateKeyDetails
`if_match`	(optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
`opc_request_id`	(optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
`region`	(optional) OCI region id. e.g us-phoenix-1 for US West (Phoenix).
`endpoint`	(optional) The endpoint of the service to call using this function. e.g https://kms.{region}.{secondLevelDomain}.If both endpoint and region are given, then endpoint takes precedence.
`credential_name`	(optional) The name of the credential for authenticating with the corresponding cloud native API.

Oracle Cloud Infrastructure Documentation Try Free Tier

BACKUP_KEY Function 🔗

CANCEL_KEY_DELETION Function 🔗

CANCEL_KEY_VERSION_DELETION Function 🔗

CHANGE_KEY_COMPARTMENT Function 🔗

CREATE_KEY Function 🔗

CREATE_KEY_VERSION Function 🔗

DISABLE_KEY Function 🔗

ENABLE_KEY Function 🔗

GET_KEY Function 🔗

GET_KEY_VERSION Function 🔗

GET_REPLICATION_STATUS Function 🔗

GET_WRAPPING_KEY Function 🔗

IMPORT_KEY Function 🔗

IMPORT_KEY_VERSION Function 🔗

LIST_KEY_VERSIONS Function 🔗

LIST_KEYS Function 🔗

RESTORE_KEY_FROM_FILE Function 🔗

RESTORE_KEY_FROM_OBJECT_STORE Function 🔗

SCHEDULE_KEY_DELETION Function 🔗

SCHEDULE_KEY_VERSION_DELETION Function 🔗

UPDATE_KEY Function 🔗

Oracle Cloud Infrastructure Documentation
Try Free Tier

BACKUP_KEY Function

CANCEL_KEY_DELETION Function

CANCEL_KEY_VERSION_DELETION Function

CHANGE_KEY_COMPARTMENT Function

CREATE_KEY Function

CREATE_KEY_VERSION Function

DISABLE_KEY Function

ENABLE_KEY Function

GET_KEY Function

GET_KEY_VERSION Function

GET_REPLICATION_STATUS Function

GET_WRAPPING_KEY Function

IMPORT_KEY Function

IMPORT_KEY_VERSION Function

LIST_KEY_VERSIONS Function

LIST_KEYS Function

RESTORE_KEY_FROM_FILE Function

RESTORE_KEY_FROM_OBJECT_STORE Function

SCHEDULE_KEY_DELETION Function

SCHEDULE_KEY_VERSION_DELETION Function

UPDATE_KEY Function