curl --request POST \
--url https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"ciphertext": "aSDinaTvuI8gbWludGxpZnk="
}
'import requests
url = "https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap"
payload = { "ciphertext": "aSDinaTvuI8gbWludGxpZnk=" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({ciphertext: 'aSDinaTvuI8gbWludGxpZnk='})
};
fetch('https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'ciphertext' => 'aSDinaTvuI8gbWludGxpZnk='
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap"
payload := strings.NewReader("{\n \"ciphertext\": \"aSDinaTvuI8gbWludGxpZnk=\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"ciphertext\": \"aSDinaTvuI8gbWludGxpZnk=\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"ciphertext\": \"aSDinaTvuI8gbWludGxpZnk=\"\n}"
response = http.request(request)
puts response.read_body{
"ciphertext": "AQIDBHByb2QtbWFzdGVyL2VuY3J5cHRlZA==",
"key_crn": "crn:kms:sa-saopaulo-1:my-account:key/prod-master"
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"params": {
"instances": 2,
"pools": 0
}
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"params": {
"instances": 2,
"pools": 0
}
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}Reencapsular texto cifrado com o material atual da chave
Reencapsula texto cifrado ou uma chave de dados encapsulada com a versão atual da mesma chave encrypt_decrypt habilitada. Nenhum texto em claro é retornado. Em um envelope com AAD, apenas a chave de dados encapsulada muda; a carga, a etiqueta de autenticação e a exigência do AAD original são preservadas. A rotação não reescreve o texto cifrado armazenado; substitua o valor armazenado por este resultado quando desejar migrar.
curl --request POST \
--url https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"ciphertext": "aSDinaTvuI8gbWludGxpZnk="
}
'import requests
url = "https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap"
payload = { "ciphertext": "aSDinaTvuI8gbWludGxpZnk=" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({ciphertext: 'aSDinaTvuI8gbWludGxpZnk='})
};
fetch('https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'ciphertext' => 'aSDinaTvuI8gbWludGxpZnk='
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap"
payload := strings.NewReader("{\n \"ciphertext\": \"aSDinaTvuI8gbWludGxpZnk=\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"ciphertext\": \"aSDinaTvuI8gbWludGxpZnk=\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://kms.{region}.basaltic.sh/v1/keys/{key_id}/rewrap")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"ciphertext\": \"aSDinaTvuI8gbWludGxpZnk=\"\n}"
response = http.request(request)
puts response.read_body{
"ciphertext": "AQIDBHByb2QtbWFzdGVyL2VuY3J5cHRlZA==",
"key_crn": "crn:kms:sa-saopaulo-1:my-account:key/prod-master"
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"params": {
"instances": 2,
"pools": 0
}
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"params": {
"instances": 2,
"pools": 0
}
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}kms:Rewrap. Veja permissões do KMS para a lista completa, o escopo de cada ação e um exemplo de política.Autorizações
Um token bearer OAuth 2.0, enviado como Authorization: Bearer <token>. Esta é a forma recomendada de autenticação.
Obtenha o token trocando o par de chaves de acesso de uma conta de serviço em POST /v1/oauth/token com grant_type=client_credentials. Esse é o fluxo padrão de credenciais de cliente; bibliotecas compatíveis com OAuth podem obter e renovar o token para você.
curl -s -u "$KEY_ID:$SECRET" -d grant_type=client_credentials \
https://iam.basaltic.sh/v1/oauth/token
Os tokens duram uma hora por padrão. O mesmo par de chaves de acesso também serve como credencial AWS SigV4 para o endpoint de objetos compatível com S3, que aceita somente esse método de autenticação.
Parâmetros de caminho
Corpo
Texto cifrado ou chave de dados encapsulada em Base64, produzidos por esta chave KMS. AAD não é necessário nem alterado.
Resposta
Sucesso
Texto cifrado opaco, versionado e codificado em Base64. Armazene sem alterações; não interprete seu formato interno. Após a rotação, Decrypt seleciona automaticamente a versão original do material.
"AQIDBHByb2QtbWFzdGVyL2VuY3J5cHRlZA=="
CRN da chave sob a qual o texto cifrado foi selado.
"crn:kms:sa-saopaulo-1:my-account:key/prod-master"

