openapi: 3.0.0
info:
  title: Key Manager API
  description: |-
    Scaleway's Key Manager allows you to create, manage and use cryptographic keys in a centralized and secure service. All your cryptographic operations can be delegated to the Key Manager, which in turn ensures the security and availability of your keys.

    Key Manager supports the following cryptographic operations: data encryption, data decryption, and data encryption key generation.

    (switchcolumn)
    (switchcolumn)

    ## Concepts

    Refer to our [dedicated concepts page](https://www.scaleway.com/en/docs/key-manager/concepts/) to find definitions of the different terms referring to Key Manager.

    (switchcolumn)
    (switchcolumn)
    ## Quickstart

    1. **Configure your environment variables.**

        <Message type="note">
          This is an optional step that seeks to simplify your usage of the API.
        </Message>

        ```bash
        export SCW_ACCESS_KEY="<API access key>"
        export SCW_SECRET_KEY="<API secret key>"
        export SCW_PROJECT_ID="<Scaleway Project ID>"
        ```
    2. **Create a key**. Run the following command to create a key that you can use to encrypt and decrypt your data:

        ```bash
        curl "https://api.scaleway.com/key-manager/v1alpha1/regions/$REGION/keys" \
          -H "Content-Type: application/json" \
          -H "X-Auth-Token: $SCW_SECRET_KEY" \
          -d '{
            "project_id": "$PROJECT_ID",
            "name": "my-key",
            "usage": {
                "symmetric_encryption": "aes_256_gcm"
            }
           }'
        ```
    3. **Rotate your key**. Run the following command to generate a new version of your key. This operation renders your previous key version obsolete.

        ```bash
        curl "https://api.scaleway.com/key-manager/v1alpha1/regions/$REGION/keys/<KEY_ID>/rotate" \
          -H "X-Auth-Token: $SCW_SECRET_KEY" \
          -d '{
            "key_id": "$KEY_ID"
          }'
        ```
    4. **Encrypt data**. Run the following command to encrypt data with the key you have created in step 2:

        ```bash
        curl "https://api.scaleway.com/key-manager/v1alpha1/regions/$REGION/keys/<KEY_ID>/encrypt" \
          -H "X-Auth-Token: $SCW_SECRET_KEY" \
          -d '{
            "key_id": "$KEY_ID",
            "plaintext": "'"$(echo -n "plaintext-data" | base64)"'"
          }'
        ```
    5. **Generate a data encryption key**. Run the following command to generate a data encryption key that you can use for cryptographic operations outside of Key Manager:

        ```bash
        curl "https://api.scaleway.com/key-manager/v1alpha1/regions/$REGION/keys/<KEY_ID>/generate-data-key" \
          -H "X-Auth-Token: $SCW_SECRET_KEY" \
          -d '{
            "key_id": "$KEY_ID",
            "algorithm": "aes_256_gcm"
          }'
        ```

    (switchcolumn)

    <Message type="requirement">
     To perform the following steps, you must first ensure that:

     - You have your [Organization and your Project ID](https://console.scaleway.com/project/settings)
     - You have a [Scaleway account](https://console.scaleway.com/)
     - You have created an [API key](https://www.scaleway.com/en/docs/identity-and-access-management/iam/how-to/create-api-keys/) and that the API key has sufficient [IAM permissions](https://www.scaleway.com/en/docs/identity-and-access-management/iam/reference-content/permission-sets/) to perform the actions described on this page
     - You have [installed `curl`](https://curl.se/download.html)
    </Message>

    (switchcolumn)

    ## Technical information

    ### Regions

    Scaleway's infrastructure spans different [regions and Availability Zones](https://www.scaleway.com/en/docs/console/account/reference-content/products-availability/).

    Key Manager is available in the Paris, Amsterdam and Warsaw regions, which are represented by the following path parameters:

    - fr-par
    - nl-ams
    - pl-waw

    ## Technical limitations

    - The maximum payload size that can be encrypted is 64KB of plaintext
    - The maximum payload size that can be decrypted is around 131KB of data
    - The only key algorithm currently supported by Key Manager is `AES-256-GCM`.
    - While Scaleway Key Manager is responsible for generating, encrypting, and decrypting [data encryption keys](https://www.scaleway.com/en/docs/key-manager/concepts/#data-encryption-key-dek/), it does not store, manage, or monitor them, nor does it engage in cryptographic operations with these keys. **You must use and manage data encryption keys outside of Key Manager**. Read our [documentation](https://www.scaleway.com/en/docs/key-manager/reference-content/security-recommendations/) to find out about security measures to be aware of while using Key Manager.

    ## Going further

    For more information about Key Manager, you can check out the following pages:

    * [Key Manager Documentation](https://www.scaleway.com/en/docs/key-manager/)
    * [Contact our support team](https://console.scaleway.com/support/tickets).
  version: v1alpha1
servers:
- url: https://api.scaleway.com
tags:
- name: Keys
  description: Keys are logical containers you create in Key Manager to store cryptographic
    keys. They support encryption, decryption, and the generation of data encryption
    keys.
components:
  schemas:
    google.protobuf.Int32Value:
      type: integer
      format: int32
      nullable: true
    scaleway.key_manager.v1alpha1.DataKey:
      type: object
      properties:
        key_id:
          type: string
          description: ID of the data encryption key. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
        algorithm:
          type: string
          description: Symmetric encryption algorithm of the data encryption key (`AES-256-GCM`).
          enum:
          - unknown_symmetric_encryption
          - aes_256_gcm
          x-enum-descriptions:
            values:
              aes_256_gcm: Key Manager currently only supports the `AES-GCM` (256-bits)
                data key algorithm.
          default: unknown_symmetric_encryption
        ciphertext:
          type: string
          description: |-
            Data encryption key ciphertext.
            Your data encryption key's ciphertext can be stored safely. It can only be decrypted through the keys you create in Key Manager, using the relevant key ID.
        plaintext:
          type: object
          description: |-
            Data encryption key plaintext.
            (Optional) Your data encryption key's plaintext allows you to use the key immediately upon creation. It must neither be stored or shared.
          properties:
            value:
              type: string
          x-properties-order:
          - value
        created_at:
          type: string
          description: Data encryption key creation date. (RFC 3339 format)
          format: date-time
          example: "2022-03-22T12:34:56.123456Z"
          nullable: true
      x-properties-order:
      - key_id
      - algorithm
      - ciphertext
      - plaintext
      - created_at
    scaleway.key_manager.v1alpha1.DecryptResponse:
      type: object
      properties:
        key_id:
          type: string
          description: ID of the key used for decryption. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
        plaintext:
          type: string
          description: Key's decrypted data.
        ciphertext:
          type: object
          description: |-
            (Optional) Data encrypted with the latest key rotation.
            If the data was already encrypted with the latest key rotation, no output will be returned in the response object.
          properties:
            value:
              type: string
          x-properties-order:
          - value
      x-properties-order:
      - key_id
      - plaintext
      - ciphertext
    scaleway.key_manager.v1alpha1.EncryptResponse:
      type: object
      properties:
        key_id:
          type: string
          description: ID of the key used for encryption. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
        ciphertext:
          type: string
          description: Key's encrypted data.
      x-properties-order:
      - key_id
      - ciphertext
    scaleway.key_manager.v1alpha1.Key:
      type: object
      properties:
        id:
          type: string
          description: ID of the key. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
        project_id:
          type: string
          description: ID of the Project containing the key. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
        name:
          type: string
          description: Name of the key.
        usage:
          type: object
          description: |-
            Key usage.
            Keys with a usage set to `symmetric_encryption` can encrypt and decrypt data using the `AES-256-GCM` key algorithm. Key Manager currently only supports `AES-256-GCM`.
          properties:
            symmetric_encryption:
              type: string
              description: |-
                Algorithm used to encrypt and decrypt arbitrary payloads.
                See the `Key.Algorithm.SymmetricEncryption` enum for a description of values.
              enum:
              - unknown_symmetric_encryption
              - aes_256_gcm
              x-enum-descriptions:
                values:
                  aes_256_gcm: Key Manager currently only supports the `AES-GCM` (256-bits)
                    key algorithm
              nullable: true
              default: unknown_symmetric_encryption
              x-one-of: usage
          x-properties-order:
          - symmetric_encryption
        state:
          type: string
          description: |-
            Key state.
            See the `Key.State` enum for a description of possible values.
          enum:
          - unknown_state
          - enabled
          - disabled
          - pending_key_material
          x-enum-descriptions:
            values:
              enabled: The key can be used for cryptographic operations.
              disabled: The key cannot be used for cryptographic operations.
              pending_key_material: Key material must be imported before the key can
                be used for cryptographic operations.
          default: unknown_state
        rotation_count:
          type: integer
          description: |-
            Number of key rotations.
            The rotation count tracks the number of times the key has been rotated.
          format: uint32
        created_at:
          type: string
          description: Key creation date. (RFC 3339 format)
          format: date-time
          example: "2022-03-22T12:34:56.123456Z"
          nullable: true
        updated_at:
          type: string
          description: Key last modification date. (RFC 3339 format)
          format: date-time
          example: "2022-03-22T12:34:56.123456Z"
          nullable: true
        protected:
          type: boolean
          description: Returns `true` if key protection is applied to the key.
        locked:
          type: boolean
          description: Returns `true` if the key is locked.
        description:
          type: string
          description: Description of the key.
          nullable: true
        tags:
          type: array
          description: List of the key's tags.
          items:
            type: string
        rotated_at:
          type: string
          description: Key last rotation date. (RFC 3339 format)
          format: date-time
          example: "2022-03-22T12:34:56.123456Z"
          nullable: true
        rotation_policy:
          type: object
          description: Key rotation policy.
          properties:
            rotation_period:
              type: string
              description: |-
                Rotation period.
                Time interval between two key rotations. The minimum duration is 24 hours and the maximum duration is 1 year (876000 hours). (in seconds)
              example: 2.5s
              nullable: true
            next_rotation_at:
              type: string
              description: |-
                Key next rotation date.
                Timestamp indicating the next scheduled rotation. (RFC 3339 format)
              format: date-time
              example: "2022-03-22T12:34:56.123456Z"
              nullable: true
          x-properties-order:
          - rotation_period
          - next_rotation_at
        origin:
          type: string
          description: |-
            Key origin.
            Refer to the `Key.Origin` enum for a description of values.
          enum:
          - unknown_origin
          - scaleway_kms
          - external
          x-enum-descriptions:
            values:
              scaleway_kms: Key Manager generates the key material upon key creation
              external: Key Manager creates a key with key material coming from an
                external source
          default: unknown_origin
        region:
          type: string
          description: Region where the key is stored.
      x-properties-order:
      - id
      - project_id
      - name
      - usage
      - state
      - rotation_count
      - created_at
      - updated_at
      - protected
      - locked
      - description
      - tags
      - rotated_at
      - rotation_policy
      - origin
      - region
    scaleway.key_manager.v1alpha1.ListKeysRequest.OrderBy:
      type: string
      enum:
      - name_asc
      - name_desc
      - created_at_asc
      - created_at_desc
      - updated_at_asc
      - updated_at_desc
      default: name_asc
    scaleway.key_manager.v1alpha1.ListKeysResponse:
      type: object
      properties:
        keys:
          type: array
          description: Single page of keys matching the requested criteria.
          items:
            $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
        total_count:
          type: integer
          description: Total count of keys matching the requested criteria.
          format: uint64
      x-properties-order:
      - keys
      - total_count
  securitySchemes:
    scaleway:
      in: header
      name: X-Auth-Token
      type: apiKey
paths:
  /key-manager/v1alpha1/regions/{region}/keys:
    get:
      tags:
      - Keys
      operationId: ListKeys
      summary: List keys
      description: Retrieve a list of keys across all Projects in an Organization
        or within a specific Project. You must specify the `region`, and either the
        `organization_id` or the `project_id`.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: query
        name: organization_id
        description: (Optional) Filter by Organization ID. (UUID format)
        schema:
          type: string
          description: (Optional) Filter by Organization ID. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      - in: query
        name: project_id
        description: (Optional) Filter by Project ID. (UUID format)
        schema:
          type: string
          description: (Optional) Filter by Project ID. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      - in: query
        name: order_by
        schema:
          $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.ListKeysRequest.OrderBy'
      - in: query
        name: page
        schema:
          $ref: '#/components/schemas/google.protobuf.Int32Value'
      - in: query
        name: page_size
        schema:
          type: integer
          format: uint32
      - in: query
        name: tags
        description: (Optional) List of tags to filter on.
        schema:
          type: array
          description: (Optional) List of tags to filter on.
          items:
            type: string
      - in: query
        name: name
        description: (Optional) Filter by key name.
        schema:
          type: string
          description: (Optional) Filter by key name.
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.ListKeysResponse'
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X GET \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys"
      - lang: HTTPie
        source: |-
          http GET "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys" \
            X-Auth-Token:$SCW_SECRET_KEY
    post:
      tags:
      - Keys
      operationId: CreateKey
      summary: Create a key
      description: Create a key in a given region specified by the `region` parameter.
        Keys only support symmetric encryption. You can use keys to encrypt or decrypt
        arbitrary payloads, or to generate data encryption keys. **Data encryption
        keys are not stored in Key Manager**.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                project_id:
                  type: string
                  description: ID of the Project containing the key. (UUID format)
                  example: 6170692e-7363-616c-6577-61792e636f6d
                name:
                  type: string
                  description: (Optional) Name of the key.
                  nullable: true
                usage:
                  type: object
                  description: |-
                    Key usage.
                    See the `Key.Algorithm.SymmetricEncryption` enum for a description of values.
                  properties:
                    symmetric_encryption:
                      type: string
                      description: |-
                        Algorithm used to encrypt and decrypt arbitrary payloads.
                        See the `Key.Algorithm.SymmetricEncryption` enum for a description of values.
                      enum:
                      - unknown_symmetric_encryption
                      - aes_256_gcm
                      x-enum-descriptions:
                        values:
                          aes_256_gcm: Key Manager currently only supports the `AES-GCM`
                            (256-bits) key algorithm
                      nullable: true
                      default: unknown_symmetric_encryption
                      x-one-of: usage
                  default: Symmetric encryption with the `AES_256_GCM` key algorithm
                  x-properties-order:
                  - symmetric_encryption
                description:
                  type: string
                  description: (Optional) Description of the key.
                  nullable: true
                tags:
                  type: array
                  description: (Optional) List of the key's tags.
                  items:
                    type: string
                rotation_policy:
                  type: object
                  description: |-
                    (Optional) Rotation policy of the key.
                    If not specified, no rotation policy will be applied to the key.
                  properties:
                    rotation_period:
                      type: string
                      description: |-
                        Rotation period.
                        Time interval between two key rotations. The minimum duration is 24 hours and the maximum duration is 1 year (876000 hours). (in seconds)
                      example: 2.5s
                      nullable: true
                    next_rotation_at:
                      type: string
                      description: |-
                        Key next rotation date.
                        Timestamp indicating the next scheduled rotation. (RFC 3339 format)
                      format: date-time
                      example: "2022-03-22T12:34:56.123456Z"
                      nullable: true
                  x-properties-order:
                  - rotation_period
                  - next_rotation_at
                unprotected:
                  type: boolean
                  description: |-
                    (Optional) Defines whether key protection is applied to a key. Protected keys can be used but not deleted.
                    Default value is `false`.
                origin:
                  type: string
                  description: |-
                    Key origin.
                    Refer to the `Key.Origin` enum for a description of values.
                  enum:
                  - unknown_origin
                  - scaleway_kms
                  - external
                  x-enum-descriptions:
                    values:
                      scaleway_kms: Key Manager generates the key material upon key
                        creation
                      external: Key Manager creates a key with key material coming
                        from an external source
                  default: unknown_origin
              x-properties-order:
              - project_id
              - name
              - usage
              - description
              - tags
              - rotation_policy
              - unprotected
              - origin
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{"project_id":"6170692e-7363-616c-6577-61792e636f6d","unprotected":false}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys" \
            X-Auth-Token:$SCW_SECRET_KEY \
            project_id="6170692e-7363-616c-6577-61792e636f6d" \
            unprotected:=false
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}:
    get:
      tags:
      - Keys
      operationId: GetKey
      summary: Get key metadata
      description: Retrieve metadata for a specified key using the `region` and `key_id`
        parameters.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to target. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to target. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X GET \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}"
      - lang: HTTPie
        source: |-
          http GET "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}" \
            X-Auth-Token:$SCW_SECRET_KEY
    patch:
      tags:
      - Keys
      operationId: UpdateKey
      summary: Update a key
      description: Modify a key's metadata including name, description and tags, specified
        by the `key_id` and `region` parameters.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to update. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to update. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: (Optional) Updated name of the key.
                  nullable: true
                description:
                  type: string
                  description: (Optional) Updated description of the key.
                  nullable: true
                tags:
                  type: array
                  description: (Optional) Updated list of the key's tags.
                  nullable: true
                  items:
                    type: string
                rotation_policy:
                  type: object
                  description: |-
                    (Optional) Updated rotation policy of the key.
                    If not specified, the key's existing rotation policy applies.
                  properties:
                    rotation_period:
                      type: string
                      description: |-
                        Rotation period.
                        Time interval between two key rotations. The minimum duration is 24 hours and the maximum duration is 1 year (876000 hours). (in seconds)
                      example: 2.5s
                      nullable: true
                    next_rotation_at:
                      type: string
                      description: |-
                        Key next rotation date.
                        Timestamp indicating the next scheduled rotation. (RFC 3339 format)
                      format: date-time
                      example: "2022-03-22T12:34:56.123456Z"
                      nullable: true
                  x-properties-order:
                  - rotation_period
                  - next_rotation_at
              x-properties-order:
              - name
              - description
              - tags
              - rotation_policy
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X PATCH \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}"
      - lang: HTTPie
        source: |-
          http PATCH "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}" \
            X-Auth-Token:$SCW_SECRET_KEY
    delete:
      tags:
      - Keys
      operationId: DeleteKey
      summary: Delete a key
      description: Permanently delete a key specified by the `region` and `key_id`
        parameters. This action is irreversible. Any data encrypted with this key,
        including data encryption keys, will no longer be decipherable.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to delete. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to delete. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "204":
          description: ""
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X DELETE \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}"
      - lang: HTTPie
        source: |-
          http DELETE "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}" \
            X-Auth-Token:$SCW_SECRET_KEY
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/decrypt:
    post:
      tags:
      - Keys
      operationId: Decrypt
      summary: Decrypt an encrypted payload
      description: Decrypt an encrypted payload using an existing key, specified by
        the `key_id` parameter. The maximum payload size that can be decrypted is
        equivalent to the encrypted output of 64 KB of data (around 131 KB).
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to decrypt. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to decrypt. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.DecryptResponse'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                ciphertext:
                  type: string
                  description: |-
                    Ciphertext data to decrypt.
                    Data size must be between 1 and 131071 bytes.
                associated_data:
                  type: object
                  description: |-
                    (Optional) Additional authenticated data.
                    The additional data must match the value passed in the encryption request.
                  properties:
                    value:
                      type: string
                  x-properties-order:
                  - value
              x-properties-order:
              - ciphertext
              - associated_data
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{"ciphertext":"string"}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/decrypt"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/decrypt" \
            X-Auth-Token:$SCW_SECRET_KEY \
            ciphertext="string"
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/delete-key-material:
    post:
      tags:
      - Keys
      operationId: DeleteKeyMaterial
      summary: Delete key material
      description: Delete previously imported key material. This renders the associated
        cryptographic key unusable for any operation. The key's origin must be `external`.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key of which to delete the key material. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key of which to delete the key material. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "204":
          description: ""
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/delete-key-material"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/delete-key-material" \
            X-Auth-Token:$SCW_SECRET_KEY
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/disable:
    post:
      tags:
      - Keys
      operationId: DisableKey
      summary: Disable key
      description: Disable a given key, preventing it to be used for cryptographic
        operations. Disabling a key renders it unusable. You must specify the `region`
        and `key_id` parameters.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to disable. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to disable. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/disable"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/disable" \
            X-Auth-Token:$SCW_SECRET_KEY
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/enable:
    post:
      tags:
      - Keys
      operationId: EnableKey
      summary: Enable key
      description: Enable a given key to be used for cryptographic operations. Enabling
        a key allows you to make a disabled key usable again. You must specify the
        `region` and `key_id` parameters.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to enable. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to enable. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/enable"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/enable" \
            X-Auth-Token:$SCW_SECRET_KEY
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/encrypt:
    post:
      tags:
      - Keys
      operationId: Encrypt
      summary: Encrypt a payload
      description: Encrypt a payload using an existing key, specified by the `key_id`
        parameter. Only keys with a usage set to `symmetric_encryption` are supported
        by this method. The maximum payload size that can be encrypted is 64 KB of
        plaintext.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to encrypt. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to encrypt. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.EncryptResponse'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                plaintext:
                  type: string
                  description: |-
                    Plaintext data to encrypt.
                    Data size must be between 1 and 65535 bytes.
                associated_data:
                  type: object
                  description: |-
                    (Optional) Additional authenticated data.
                    Additional data which will not be encrypted, but authenticated and appended to the encrypted payload.
                  properties:
                    value:
                      type: string
                  x-properties-order:
                  - value
              x-properties-order:
              - plaintext
              - associated_data
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{"plaintext":"string"}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/encrypt"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/encrypt" \
            X-Auth-Token:$SCW_SECRET_KEY \
            plaintext="string"
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/generate-data-key:
    post:
      tags:
      - Keys
      operationId: GenerateDataKey
      summary: Create a data encryption key
      description: |-
        Create a new data encryption key for cryptographic operations outside of Key Manager. The data encryption key is encrypted and must be decrypted using the key you have created in Key Manager.

        The data encryption key is returned in plaintext and ciphertext but it should only be stored in its encrypted form (ciphertext). Key Manager does not store your data encryption key. To retrieve your key's plaintext, use the `Decrypt` method with your key's ID and ciphertext.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.DataKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                algorithm:
                  type: string
                  description: |-
                    Algorithm with which the data encryption key will be used to encrypt and decrypt arbitrary payloads.
                    See the `DataKey.Algorithm.SymmetricEncryption` enum for a description of values.
                  enum:
                  - unknown_symmetric_encryption
                  - aes_256_gcm
                  x-enum-descriptions:
                    values:
                      aes_256_gcm: Key Manager currently only supports the `AES-GCM`
                        (256-bits) data key algorithm.
                  default: aes_256_gcm
                without_plaintext:
                  type: boolean
                  description: |-
                    (Optional) Defines whether to return the data encryption key's plaintext in the response object.
                    Default value is `false`, meaning that the plaintext is returned.
                    Set it to `true` if you do not wish the plaintext to be returned in the response object.
              x-properties-order:
              - algorithm
              - without_plaintext
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{"without_plaintext":false}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/generate-data-key"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/generate-data-key" \
            X-Auth-Token:$SCW_SECRET_KEY \
            without_plaintext:=false
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/import-key-material:
    post:
      tags:
      - Keys
      operationId: ImportKeyMaterial
      summary: Import key material
      description: Import externally generated key material into Key Manager to derive
        a new cryptographic key. The key's origin must be `external`.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: |-
          ID of the key in which to import key material.
          The key's origin must be `external`. (UUID format)
        required: true
        schema:
          type: string
          description: |-
            ID of the key in which to import key material.
            The key's origin must be `external`. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                key_material:
                  type: string
                  description: The key material The key material is a random sequence
                    of bytes used to derive a cryptographic key.
                salt:
                  type: object
                  description: |-
                    (Optional) Salt value to pass the key derivation function.
                    A salt is random data added to key material to ensure unique derived keys, even if the input is similar. It helps strengthen security when the key material has low randomness (low entropy).
                  properties:
                    value:
                      type: string
                  x-properties-order:
                  - value
              x-properties-order:
              - key_material
              - salt
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{"key_material":"string"}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/import-key-material"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/import-key-material" \
            X-Auth-Token:$SCW_SECRET_KEY \
            key_material="string"
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/protect:
    post:
      tags:
      - Keys
      operationId: ProtectKey
      summary: Apply key protection
      description: Apply protection to a given key specified by the `key_id` parameter.
        Applying key protection means that your key can be used and modified, but
        it cannot be deleted.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to apply key protection to. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to apply key protection to. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/protect"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/protect" \
            X-Auth-Token:$SCW_SECRET_KEY
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/rotate:
    post:
      tags:
      - Keys
      operationId: RotateKey
      summary: Rotate a key
      description: Generate a new version of an existing key with new key material.
        Previous key versions remain usable to decrypt previously encrypted data,
        but the key's new version will be used for subsequent encryption operations
        and data key generation.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to rotate. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to rotate. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/rotate"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/rotate" \
            X-Auth-Token:$SCW_SECRET_KEY
  /key-manager/v1alpha1/regions/{region}/keys/{key_id}/unprotect:
    post:
      tags:
      - Keys
      operationId: UnprotectKey
      summary: Remove key protection
      description: Remove key protection from a given key specified by the `key_id`
        parameter. Removing key protection means that your key can be deleted anytime.
      parameters:
      - in: path
        name: region
        description: The region you want to target
        required: true
        schema:
          type: string
          description: The region you want to target
          enum:
          - fr-par
          - nl-ams
          - pl-waw
      - in: path
        name: key_id
        description: ID of the key to remove key protection from. (UUID format)
        required: true
        schema:
          type: string
          description: ID of the key to remove key protection from. (UUID format)
          example: 6170692e-7363-616c-6577-61792e636f6d
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/scaleway.key_manager.v1alpha1.Key'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      security:
      - scaleway: []
      x-codeSamples:
      - lang: cURL
        source: |-
          curl -X POST \
            -H "X-Auth-Token: $SCW_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d '{}' \
            "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/unprotect"
      - lang: HTTPie
        source: |-
          http POST "https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/{key_id}/unprotect" \
            X-Auth-Token:$SCW_SECRET_KEY
