Logs relating to the privilegedunwrap API route

The fields described below belong to logs about the privilegedunwrap API route. This route allows:

  • An administrator to decrypt exported user data with the decrypter.exe Google utility,

  • An encryption service to migrate data from another KACLS to itself.

Field

Description

Type

Examples

api_route

URL slug of the API route.

String
"/api/v1/{tenantId}/privilegedunwrap"

user_agent

User agent used in the request.

String

"Chrome/27.0.1453.110"

source_address

Network traffic source (client requesting the connection).

String

"172.16.16.212"

http_status

HTTP response code that indicates the status of the request to the proxy.

Integer

Prescribed values:

"200", "400", "401", "405", "413", "415","500"

request_payload

Data relating to the HTTP request.

Object

  reason

JSON string providing additional context about the operation. 

String

"{client:’drive’ op:’update’}"

In a migration, the value is set: "KACLS migration"

  resource_name

Resource identifier.

String
"6Bhds6BhdRkqt3Rkqt36Bhd"

  authentication_token

JWT generated by a third-party tool that guarantees the user’s identity.

It contains the information below:

Object

 

Only for user use cases
email: e-mail address of the user that the authentication token concerns.

String

"alice@domain.eu"
 

Only for migration use cases
kaclsUrl: URL of the KACLS that initiates the privileged unwrap request.

 String
"https://cse.mysds.io/api/v1/0995624d-13f5-40a9-9c59-fee6fe3ef3f4"
 

iss: identifies the service that generates the JWT (issuer).

String

URL of the issuing KACLS
 

aud: identifies the recipient of the JWT (audience).

String array

In a migration, the value is set: "kacls-migration"
 

exp: identifies the expiry time after which the JWT must no longer be accepted.

Integer (timestamp in seconds)

"1694617320"

 

iat: identifies the date on which the JWT was created (issued at).

Integer (timestamp in seconds)

"1694617320"

additional_data

Additional data.
It contains the information below:

Object

   

wrap_properties: data relating to the wrap operation.

Object

 

kek_id: identifier of the KEK used.

String
"bbc9cd0b-803c-4d9c-93f9-b43bdfc0bf96"

        

version: version of the wrap operation.

Integer

1

       

mode: mode used for the wrap operation.

  • persistence: persistence mode used (none)

String

Prescribed values:

  • kms or json_file for persistence

        

cse_version: version of the service during the wrap operation.

String

"1.0.23458"
  authentication_mode: authentication mode used for the wrap operation.

String

"local-configuration", "admin-configuration", "cse-configuration"

In a migration, the value is set: "migration"
  authentication_domain: domain used for authentication.

String

 "domain.com"