Inputs specific to the privatekeydecrypt and privatekeysign API routes

Input

Description

 Source of the input
algorithm

Algorithm used to encrypt the private key.

 Data within the request body.
authentication.email

User's email address.
In UTF8 format, in lower case.

 JWT authentication token provided by the IDP.
authentication.googleEmail

Optional If the email field is not a Google Workspace address belonging to the domain, googleEmail is the user's email address. It takes priority over the email field.
In UTF8 format, in lower case.

 JWT authentication token provided by the IDP.
authentication.iss

Entity which has created and signed the token.

 JWT authentication token provided by the IDP.
authentication.aud

Corresponds to the audience for which the token was issued.

Example: [ 'cse-authorization', 'cse-authorization1' ]

 JWT authentication token provided by the IDP.
authentication.iat

Date when the token was issued. In timestamp format (integer)

Example: 1677679386

 JWT authentication token provided by the IDP.
authentication.exp

Date when the token expires.

In timestamp format (integer)

Example: 1677679386

 JWT authentication token provided by the IDP.
authentication.customClaims

Optional.

Custom claims provided by the IDP.

See Inputs specific to the privatekeydecrypt and privatekeysign API routes.

 JWT authentication token provided by the IDP.
authorization.email User’s email address. In UTF8 format, in lower case. JWT authorization token provided by Google
authorization.role

Role of the authorized user.

  • "decrypter" for privatekeydecrypt,

  • "signer" for privatekeysign

 JWT authorization token provided by Google
authorization.resourceName Same as resourceName, but originates from the authorization token. JWT authorization token provided by Google
authorization.perimeterId Same as perimeterId, but originates from the authorization token. JWT authorization token provided by Google
authorization.kaclsUrl URL of the KACLS. JWT authorization token provided by Google
authorization.iss

Entity which has created and signed the token.

Can be used to differentiate the various Google Workspace applications, or to migrate from a KACLS to another.

Example: “gsuitecse-tokenissuer-drive@system.gserviceaccount.com”

See Authorization settings.

 JWT authorization token provided by Google
authorization.aud

Corresponds to the audience for which the token was issued.

Example: [ 'cse-authorization', 'cse-authorization1' ]

 JWT authorization token provided by Google
authorization.exp

Date when the token expires.

In timestamp format (integer)

Example: 1677679386

 JWT authorization token provided by Google
authorization.iat

IssuedAt, date when the token was issued.

In timestamp format (integer)

Example: 1677679386

 JWT authorization token provided by Google
authorization.spkiHashBase64 SPKI hash in base64 to validate authorization. JWT authorization token provided by Google
authorization.spkiHashAlgorithm Encryption algorithm used to produce the SPKI hash. JWT authorization token provided by Google
authorization.messageId Optional. Value relating to the encryption key used during a wrapprivatekey operation. JWT authorization token provided by Google
authorization.kaclsOwnerDomain Optional claim configured by the Google Workspace's owner to change the domain used in the request to the KACLS. It prevents from registering unauthorized KACLS. This claim is sent to the OPA server, which allows or forbids the action based on this information. JWT authorization token provided by Google
contentType

Cryptographic content type.

Prescribed values: "private-key-pem" or "private-key-name"

 Cryptographic component configured.