Skip to main content
POST
Encrypt a payload
Requires the IAM action kms:Encrypt. See KMS permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Path Parameters

key_id
string<uuid>
required
Example:

"3f8a1c2e-9b47-4d6a-bc11-0e2f5a7d9c41"

Body

application/json
plaintext
string<byte>
required

Base64-encoded plaintext.

Example:

"c3VwZXItc2VjcmV0LXZhbHVl"

aad
string<byte>

Optional base64-encoded additional authenticated data (AES-GCM AEAD). Must be supplied verbatim to Decrypt; mismatch fails the auth tag check. Ignored for asymmetric keys.

Example:

"YWNjb3VudC1pZD0xMjM0"

Response

Ciphertext

ciphertext
string<byte>

Base64-encoded opaque, versioned ciphertext. Store verbatim; do not parse its internal layout. Decrypt selects the original material version automatically after rotation.

Example:

"AQIDBHByb2QtbWFzdGVyL2VuY3J5cHRlZA=="

key_crn
string

CRN of the key the ciphertext was sealed under.

Example:

"crn:kms:sa-saopaulo-1:my-account:key/prod-master"