KmsCryptoClient¶

class oci.key_management.KmsCryptoClient(config, service_endpoint, **kwargs)¶

Use the Key Management API to manage vaults and keys. For more information, see [Managing Vaults](/Content/KeyManagement/Tasks/managingvaults.htm) and [Managing Keys](/Content/KeyManagement/Tasks/managingkeys.htm).

Methods

`__init__`(config, service_endpoint, **kwargs)	Creates a new service client
`decrypt`(decrypt_data_details, **kwargs)	Decrypts data using the given `DecryptDataDetails`__ resource.
`encrypt`(encrypt_data_details, **kwargs)	Encrypts data using the given `EncryptDataDetails`__ resource.
`export_key`(export_key_details, **kwargs)	Exports a specific version of a master encryption key according to the details of the request.
`generate_data_encryption_key`(…)	Generates a key that you can use to encrypt or decrypt data.
`sign`(sign_data_details, **kwargs)	Creates a digital signature for a message or message digest by using the private key of a public-private key pair, also known as an asymmetric key.
`verify`(verify_data_details, **kwargs)	Verifies a digital signature that was generated by the `Sign`__ operation by using the public key of the same asymmetric key that was used to sign the data.

__init__(config, service_endpoint, **kwargs)¶

Creates a new service client

Parameters:

config (dict) – Configuration keys and values as per SDK and Tool Configuration. The from_file() method can be used to load configuration from a file. Alternatively, a dict can be passed. You can validate_config the dict using validate_config()
service_endpoint (str) – The endpoint of the service to call using this client. For example https://iaas.us-ashburn-1.oraclecloud.com.
timeout (float or tuple(float, float)) – (optional) The connection and read timeouts for the client. The default values are connection timeout 10 seconds and read timeout 60 seconds. This keyword argument can be provided as a single float, in which case the value provided is used for both the read and connection timeouts, or as a tuple of two floats. If a tuple is provided then the first value is used as the connection timeout and the second value as the read timeout.
signer (AbstractBaseSigner) –
(optional) The signer to use when signing requests made by the service client. The default is to use a Signer based on the values provided in the config parameter.

One use case for this parameter is for Instance Principals authentication by passing an instance of InstancePrincipalsSecurityTokenSigner as the value for this keyword argument
retry_strategy (obj) –
(optional) A retry strategy to apply to all calls made by this service client (i.e. at the client level). There is no retry strategy applied by default. Retry strategies can also be applied at the operation level by passing a retry_strategy keyword argument as part of calling the operation. Any value provided at the operation level will override whatever is specified at the client level.

This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.
circuit_breaker_strategy (obj) – (optional) A circuit breaker strategy to apply to all calls made by this service client (i.e. at the client level). This client uses DEFAULT_CIRCUIT_BREAKER_STRATEGY as default if no circuit breaker strategy is provided. The specifics of circuit breaker strategy are described here.
circuit_breaker_callback (function) – (optional) Callback function to receive any exceptions triggerred by the circuit breaker.
client_level_realm_specific_endpoint_template_enabled (bool) – (optional) A boolean flag to indicate whether or not this client should be created with realm specific endpoint template enabled or disable. By default, this will be set as None.
allow_control_chars – (optional) allow_control_chars is a boolean to indicate whether or not this client should allow control characters in the response object. By default, the client will not allow control characters to be in the response object.

decrypt(decrypt_data_details, **kwargs)¶

Decrypts data using the given `DecryptDataDetails`__ resource.

Parameters:	decrypt_data_details (oci.key_management.models.DecryptDataDetails) – (required) DecryptDataDetails opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service. retry_strategy (obj) – (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level. This should be one of the strategies available in the `retry` module. This operation will not retry by default, users can also use the convenient `DEFAULT_RETRY_STRATEGY` provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here. To have this operation explicitly not perform any retries, pass an instance of `NoneRetryStrategy`. allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:	A `Response` object with data of type `DecryptedData`
Return type:	`Response`
Example:

Click here to see an example of how to use decrypt API.

encrypt(encrypt_data_details, **kwargs)¶

Encrypts data using the given `EncryptDataDetails`__ resource. Plaintext included in the example request is a base64-encoded value of a UTF-8 string.

Parameters:	encrypt_data_details (oci.key_management.models.EncryptDataDetails) – (required) EncryptDataDetails opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service. retry_strategy (obj) – (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level. This should be one of the strategies available in the `retry` module. This operation will not retry by default, users can also use the convenient `DEFAULT_RETRY_STRATEGY` provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here. To have this operation explicitly not perform any retries, pass an instance of `NoneRetryStrategy`. allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:	A `Response` object with data of type `EncryptedData`
Return type:	`Response`
Example:

Click here to see an example of how to use encrypt API.

export_key(export_key_details, **kwargs)¶

Exports a specific version of a master encryption key according to the details of the request. For their protection, keys that you create and store on a hardware security module (HSM) can never leave the HSM. You can only export keys stored on the server. For export, the key version is encrypted by an RSA public key that you provide. This operation is not supported for keys having protection mode EXTERNAL.

Parameters:	export_key_details (oci.key_management.models.ExportKeyDetails) – (required) ExportKeyDetails retry_strategy (obj) – (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level. This should be one of the strategies available in the `retry` module. This operation will not retry by default, users can also use the convenient `DEFAULT_RETRY_STRATEGY` provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here. To have this operation explicitly not perform any retries, pass an instance of `NoneRetryStrategy`. allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:	A `Response` object with data of type `ExportedKeyData`
Return type:	`Response`
Example:

Click here to see an example of how to use export_key API.

generate_data_encryption_key(generate_key_details, **kwargs)¶

Generates a key that you can use to encrypt or decrypt data.

Parameters:	generate_key_details (oci.key_management.models.GenerateKeyDetails) – (required) GenerateKeyDetails opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service. retry_strategy (obj) – (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level. This should be one of the strategies available in the `retry` module. This operation will not retry by default, users can also use the convenient `DEFAULT_RETRY_STRATEGY` provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here. To have this operation explicitly not perform any retries, pass an instance of `NoneRetryStrategy`. allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:	A `Response` object with data of type `GeneratedKey`
Return type:	`Response`
Example:

Click here to see an example of how to use generate_data_encryption_key API.

sign(sign_data_details, **kwargs)¶

Creates a digital signature for a message or message digest by using the private key of a public-private key pair, also known as an asymmetric key. To verify the generated signature, you can use the `Verify`__ operation. Or, if you want to validate the signature outside of the service, you can do so by using the public key of the same asymmetric key. This operation is not supported for keys having protection mode EXTERNAL.

Parameters:	sign_data_details (oci.key_management.models.SignDataDetails) – (required) SignDataDetails opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service. retry_strategy (obj) – (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level. This should be one of the strategies available in the `retry` module. This operation will not retry by default, users can also use the convenient `DEFAULT_RETRY_STRATEGY` provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here. To have this operation explicitly not perform any retries, pass an instance of `NoneRetryStrategy`. allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:	A `Response` object with data of type `SignedData`
Return type:	`Response`
Example:

Click here to see an example of how to use sign API.

verify(verify_data_details, **kwargs)¶

Verifies a digital signature that was generated by the `Sign`__ operation by using the public key of the same asymmetric key that was used to sign the data. If you want to validate the digital signature outside of the service, you can do so by using the public key of the asymmetric key. This operation is not supported for keys having protection mode EXTERNAL.

Parameters:	verify_data_details (oci.key_management.models.VerifyDataDetails) – (required) VerifyDataDetails opc_request_id (str) – (optional) Unique identifier for the request. If provided, the returned request ID will include this value. Otherwise, a random request ID will be generated by the service. retry_strategy (obj) – (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level. This should be one of the strategies available in the `retry` module. This operation will not retry by default, users can also use the convenient `DEFAULT_RETRY_STRATEGY` provided by the SDK to enable retries for it. The specifics of the default retry strategy are described here. To have this operation explicitly not perform any retries, pass an instance of `NoneRetryStrategy`. allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:	A `Response` object with data of type `VerifiedData`
Return type:	`Response`
Example:

Click here to see an example of how to use verify API.