Skip to main content
GET
Get a versioned public key
Requires the IAM action kms:GetPublicKey. See KMS permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Path Parameters

key_id
string<uuid>
required

Query Parameters

key_version
integer

Material version to export. Defaults to the current version.

Required range: x >= 1

Response

Success

key_crn
string
required
Example:

"crn:kms:sa-saopaulo-1:my-account:key/prod-signer"

key_version
integer
required
Required range: x >= 1
key_spec
enum<string>
required

Cryptographic spec. Determines which mechanisms apply:

  • aes-256: symmetric AEAD (AES-GCM)
  • rsa-2048: asymmetric; OAEP-SHA256 encrypt + PSS-SHA256 sign
  • rsa-4096: same as rsa-2048
  • ecdsa-p256: asymmetric; SHA-256 sign/verify (no encrypt)
Available options:
aes-256,
rsa-2048,
rsa-4096,
ecdsa-p256
Example:

"aes-256"

key_usage
enum<string>
required

Operation set the key is pinned to at create time. Even when the spec supports both (RSA), one usage must be chosen — the service refuses operations from the other set.

Available options:
encrypt_decrypt,
sign_verify
Example:

"encrypt_decrypt"

public_key
string
required

PEM-encoded SubjectPublicKeyInfo for the requested asymmetric material version. No private material is exported.