Inputs specific to Crypto API encrypt and decrypt routes

As a Stormshield KMaaS administrator, you can use these inputs to create custom rules to access Crypto API, for example to filter the application of policies. Use some of these inputs in the created policy.

Input	Description	Source of the input
endpoint	API routes called: "crypto/encrypt", "crypto/decrypt"	URL of the request
tenantId	unique identifier of a tenant in UUID format. Example: 2363615f-5b08-4119-a5bd-fad3f5f3f420	URL of the request
authentication.authType	Type of authentication used for the request. Possible values : token, apiKey	"authorization" header used.
authentication.keyName	Name of the API key used to authenticate the request. Only present when using "apiKey" authentication.	Name corresponding to the key in configuration.
authentication.iss	Entity which has created and signed the token. Only present when using "token" authentication.	JWT authentication token provided by the IDP.
authentication.aud	Corresponds to the audience for which the token was issued. Only present when using "token" authentication. Example: [ 'cse-authorization', 'cse-authorization1' ]	JWT authentication token provided by the IDP.
authentication.iat	Date when the token was issued. In timestamp format (integer) Only present when using "token" authentication. Example: 1677679386	JWT authentication token provided by the IDP.
authentication.exp	Date when the token expires. In timestamp format (integer) Only present when using "token" authentication. Example: 1677679386	JWT authentication token provided by the IDP.
authentication.customClaims	Optional. Custom claims provided par the IDP. Only present when using "token" authentication. See Inputs specific to Crypto API encrypt and decrypt routes.	JWT authentication token provided by the IDP.

Inputs specific to Crypto API decrypt route

Input	Description	Source of the input
kekId	Identifier of the KEK used for data decryption.	Body of the decrypt request, or ID of the active KEK if not specified.
policy	Content of the optional policy block included in the decrypt request body. You can use it to define ABAC policies using policy.body.dataAttributes. It is present only when the policy block is included in the decrypt request or when using Stormshield SDK.	Body of the decrypt request.

Input

Description

Source of the input

kekId

Identifier of the KEK used for data decryption.

Body of the decrypt request, or ID of the active KEK if not specified.

policy

Content of the optional policy block included in the decrypt request body.

You can use it to define ABAC policies using policy.body.dataAttributes.

It is present only when the policy block is included in the decrypt request or when using Stormshield SDK.

Body of the decrypt request.