Skip to main content
GET
List KMS keys
Requires the IAM action kms:ListKeys. See KMS permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Query Parameters

limit
integer
default:50
Required range: 1 <= x <= 500
Example:

50

marker
string<uuid>

Resume token — the last key id from the previous page.

Example:

"7c9e2f4a-1d83-4b6e-9a2c-5f8b0d3e6a17"

state
enum<string>

Optional state filter (enabled / disabled / pending_deletion). Lifecycle state:

  • enabled: usable for spec/usage operations
  • disabled: exists; refuses crypto ops; can be re-enabled
  • pending_deletion: scheduled for hard delete at scheduled_purge_at; cancellable until then
Available options:
enabled,
disabled,
pending_deletion
Example:

"enabled"

name
string

Exact, case-sensitive account-scoped key name. Combined with other filters.

Example:

"prod-master"

crn
string

Exact KMS key CRN in the authenticated account and current region. Malformed or empty CRNs return 400; valid foreign or mismatched CRNs return an empty page. Combined with name and state filters.

Example:

"crn:kms:sa-saopaulo-1:acme:key/prod-master"

Response

List of keys

keys
object[]
meta
object