KmsManagementClient

class oci.key_management.KmsManagementClient(config, service_endpoint, **kwargs)

API for managing and performing operations with keys and vaults.

__init__(config, service_endpoint, **kwargs)

Creates a new service client

Parameters:
  • config (dict) -- Configuration keys and values as per SDK and Tool Configuration. The from_file() method can be used to load configuration from a file. Alternatively, a dict can be passed. You can validate_config the dict using validate_config()
  • service_endpoint (str) -- The endpoint of the service to call using this client. For example https://iaas.us-ashburn-1.oraclecloud.com.
  • timeout (float or tuple(float, float)) -- (optional) The connection and read timeouts for the client. The default is that the client never times out. This keyword argument can be provided as a single float, in which case the value provided is used for both the read and connection timeouts, or as a tuple of two floats. If a tuple is provided then the first value is used as the connection timeout and the second value as the read timeout.
  • signer (AbstractBaseSigner) --

    (optional) The signer to use when signing requests made by the service client. The default is to use a Signer based on the values provided in the config parameter.

    One use case for this parameter is for Instance Principals authentication by passing an instance of InstancePrincipalsSecurityTokenSigner as the value for this keyword argument

  • retry_strategy (obj) --

    (optional) A retry strategy to apply to all calls made by this service client (i.e. at the client level). There is no retry strategy applied by default. Retry strategies can also be applied at the operation level by passing a retry_strategy keyword argument as part of calling the operation. Any value provided at the operation level will override whatever is specified at the client level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

cancel_key_deletion(key_id, **kwargs)

Cancels the scheduled deletion of a key. Cancels the scheduled deletion of the specified key. Canceling a scheduled deletion restores the key to the respective states they were in before the deletion was scheduled.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • if_match (str) -- (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) -- (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type Key

Return type:

Response

change_key_compartment(key_id, change_key_compartment_details, **kwargs)

Moves a key into a different compartment. When provided, If-Match is checked against ETag values of the key. Moves a key into a different compartment. When provided, If-Match is checked against ETag values of the key.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • change_key_compartment_details (ChangeKeyCompartmentDetails) -- (required)
  • if_match (str) -- (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) -- (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type None

Return type:

Response

create_key(create_key_details, **kwargs)

Creates a new key. Creates a new key.

Parameters:
  • create_key_details (CreateKeyDetails) -- (required) CreateKeyDetails
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) -- (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type Key

Return type:

Response

create_key_version(key_id, **kwargs)

Creates a new KeyVersion resource and rotates the key to use it for encryption. Generates new cryptographic material for a key. The key must be in an ENABLED state to be rotated.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) -- (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type KeyVersion

Return type:

Response

disable_key(key_id, **kwargs)

Disables a key so it cannot be used for cryptographic operations. Disables a key to make it unavailable for encryption or decryption.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • if_match (str) -- (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) -- (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type Key

Return type:

Response

enable_key(key_id, **kwargs)

Enables a key so it can be used for cryptographic operations. Enables a key to make it available for encryption or decryption.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • if_match (str) -- (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) -- (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type Key

Return type:

Response

get_key(key_id, **kwargs)

Gets details about a key. Gets information about the specified key.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type Key

Return type:

Response

get_key_version(key_id, key_version_id, **kwargs)

Gets details about a key version. Gets information about the specified key version.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • key_version_id (str) -- (required) The OCID of the key version.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type KeyVersion

Return type:

Response

list_key_versions(key_id, **kwargs)

Lists the KeyVersion resources for a key. Lists all key versions for the specified key.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • limit (int) -- (optional) The maximum number of items to return in a paginated "List" call.
  • page (str) -- (optional) The value of the opc-next-page response header from the previous "List" call.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • sort_by (str) --

    (optional) The field to sort by. You can specify only one sort order. The default order for TIMECREATED is descending. The default order for DISPLAYNAME is ascending.

    Allowed values are: "TIMECREATED", "DISPLAYNAME"

  • sort_order (str) --

    (optional) The sort order to use, either ascending (ASC) or descending (DESC).

    Allowed values are: "ASC", "DESC"

  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type list of KeyVersionSummary

Return type:

Response

list_keys(compartment_id, **kwargs)

Lists keys in the specified vault and compartment. Lists the keys in the specified vault and compartment.

Parameters:
  • compartment_id (str) -- (required) The OCID of the compartment.
  • limit (int) -- (optional) The maximum number of items to return in a paginated "List" call.
  • page (str) -- (optional) The value of the opc-next-page response header from the previous "List" call.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • sort_by (str) --

    (optional) The field to sort by. You can specify only one sort order. The default order for TIMECREATED is descending. The default order for DISPLAYNAME is ascending.

    Allowed values are: "TIMECREATED", "DISPLAYNAME"

  • sort_order (str) --

    (optional) The sort order to use, either ascending (ASC) or descending (DESC).

    Allowed values are: "ASC", "DESC"

  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type list of KeySummary

Return type:

Response

schedule_key_deletion(key_id, schedule_key_deletion_details, **kwargs)

Schedules the deletion of a key. Schedules the deletion of the specified key. This sets the state of the key to PENDING_DELETION and then deletes it after the retention period ends.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • schedule_key_deletion_details (ScheduleKeyDeletionDetails) -- (required) ScheduleKeyDeletionDetails
  • if_match (str) -- (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • opc_retry_token (str) -- (optional) A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (e.g., if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type Key

Return type:

Response

update_key(key_id, update_key_details, **kwargs)

Updates a key's properties. Updates the properties of a key. Specifically, you can update the displayName, freeformTags, and definedTags properties. Furthermore, the key must in an ACTIVE or CREATING state to be updated.

Parameters:
  • key_id (str) -- (required) The OCID of the key.
  • update_key_details (UpdateKeyDetails) -- (required) UpdateKeyDetails
  • if_match (str) -- (optional) For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
  • opc_request_id (str) -- (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service.
  • retry_strategy (obj) --

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

Returns:

A Response object with data of type Key

Return type:

Response