Inputs specific to the Key Access Management rewrap, encrypt and decrypt routes
As a Stormshield KMaaS administrator, you can use these inputs to create custom rules to access the Key Access Management, for example to filter the application of policies. Use some of these inputs in the created policy.
|
Input |
Description |
Source of the input |
|---|---|---|
| endpoint | API routes called: "kas/rewrap", "kas/encrypt", "kas/decrypt" | URL of the request |
| tenantId |
unique identifier of a tenant in UUID format. Example: 2363615f-5b08-4119-a5bd-fad3f5f3f420 |
URL of the request |
| authentication.authType |
Type of authentication used for the request. Possible values :
|
"authorization" header used. |
| authentication.keyName |
Name of the API key used to authenticate the request. Only present when using "apiKey" authentication. |
Name corresponding to the key in configuration. |
| authentication.iss |
Entity which has created and signed the token. Only present when using "token" authentication. |
JWT authentication token provided by the IDP. |
| authentication.aud |
Corresponds to the audience for which the token was issued. Only present when using "token" authentication. Example: [ 'cse-authorization', 'cse-authorization1' ] |
JWT authentication token provided by the IDP. |
| authentication.iat |
Date when the token was issued. In timestamp format (integer) Only present when using "token" authentication. Example: 1677679386 |
JWT authentication token provided by the IDP. |
| authentication.exp |
Date when the token expires. In timestamp format (integer) Only present when using "token" authentication. Example: 1677679386 |
JWT authentication token provided by the IDP. |
| authentication.customClaims |
Optional. Custom claims provided par the IDP. Only present when using "token" authentication. See Inputs specific to the Key Access Management rewrap, encrypt and decrypt routes. |
JWT authentication token provided by the IDP. |
Inputs specific to the Key Access Management rewrap and decrypt routes
|
Input |
Description |
Source of the input |
|---|---|---|
| kekId | Identifier of the KEK used for data decryption. | Body of the decrypt request, or ID of the active KEK if not specified. |
| policy |
Content of the optional policy block included in the decrypt request body. The block is optional for the kas/rewrap route, but mandatory for the kas/decrypt route You can use it to define ABAC policies using policy.body.dataAttributes. It is present only when the policy block is included in the /kas/rewrap or kas/decrypt requests or when using Stormshield SDK. |
Body of the rewrap or decrypt request. |