Skip to main content
POST
Generate a fresh data key
Requires the IAM action kms:GenerateDataKey. See KMS permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Path Parameters

key_id
string<uuid>
required
Example:

"3f8a1c2e-9b47-4d6a-bc11-0e2f5a7d9c41"

Body

application/json
number_of_bytes
enum<integer>
default:32

Size of the generated data key in bytes: 16 (AES-128), 32 (AES-256, the default) or 64 (HMAC-SHA512). No other size is supported; any other value fails the operation.

Available options:
16,
32,
64
Example:

32

Response

Data key

plaintext
string<byte>

Base64-encoded plaintext data key. Use immediately, then drop — callers must NOT persist this. Re-derive it on demand by calling Decrypt with the stored ciphertext.

Example:

"MzItYnl0ZS1yYW5kb20tZGF0YS1rZXktaGVyZQ=="

ciphertext
string<byte>

Base64-encoded data key wrapped under the KMS key. Safe to store at rest alongside the data the key protects.

Example:

"AQIDBHByb2QtbWFzdGVyL3dyYXBwZWQtZGs="