API overview
API standard and pre-built SDKs in multi-language
The OpenAPI specification of this product (Kms/2016-01-20) follows the RPC standard. Alibaba Cloud provides pre-built SDKs for popular programming languages to abstract low-level complexities such as request signing. This enables developers to call APIs using language-specific syntax without dealing with HTTP details directly.
Custom signature
If your specific needs, such as a customized signature, are not supported by the SDK, manually sign requests using the signature mechanism. Note that manual signing requires significant effort (usually about 5 business days). For support, join our DingTalk group (ID: 147535001692).
Before you begin
An Alibaba Cloud account has full administrative privileges. A compromised AccessKey pair exposes all associated resources to unauthorized access, posing a significant security risk. To call APIs securely, create a Resource Access Management (RAM) user with API access only, configure its AccessKey pairs, and implement the principle of least privilege (PoLP) through RAM policies. Use the Alibaba Cloud account only when its permissions are explicitly required for specific scenarios.
Service Management
API | Title | Description |
DescribeAccountKmsStatus | Queries the status of Key Management Service (KMS) within your Alibaba Cloud account. | |
OpenKmsService | Activates Key Management Service (KMS) for your Alibaba Cloud account. |
Manage Instances
API | Title | Description |
ListKmsInstances | Queries all KMS instances in the current region. | |
ConnectKmsInstance | Enables a Key Management Service (KMS) instance. | |
GetKmsInstance | Retrieves the details of a KMS instance. | |
UpdateKmsInstanceBindVpc | Updates the VPC bindings of a KMS instance. | |
ReleaseKmsInstance | Releases a pay-as-you-go KMS instance. | |
GetDefaultKmsInstance | Queries the default KMS instance in a specified region. |
Key Management
API | Title | Description |
CreateKey | Creates a customer master key (CMK) for envelope encryption, digital signatures, or other cryptographic operations. | |
ListKeys | Queries the IDs and ARNs of all CMKs in the current region. | |
DescribeKey | Queries the metadata of a CMK, such as the key state, usage, and rotation configuration. | |
UpdateKeyDescription | Updates the description of a CMK. | |
EnableKey | Enables a key to encrypt and decrypt data. | |
DisableKey | Disables a key. | |
GetPublicKey | Retrieves the public key of an asymmetric key. You can use the public key to encrypt data or verify a signature on your device. | |
CreateAlias | Creates an alias for a key. | |
ListAliases | Queries all aliases in the current region for the current account. | |
ListAliasesByKeyId | Queries all aliases that are bound to a key. | |
DeleteAlias | Deletes an alias. | |
UpdateAlias | Binds an existing alias to a different customer master key (CMK) ID. | |
GetParametersForImport | Queries the parameters that are used to import key material for a customer master key (CMK). | |
ImportKeyMaterial | Imports externally generated key material into a CMK whose origin is EXTERNAL. | |
DeleteKeyMaterial | Deletes the imported key material from a CMK. After deletion, the CMK enters the PendingImport state until you re-import key material. | |
ScheduleKeyDeletion | Deletes a specified customer master key (CMK). | |
CancelKeyDeletion | Cancels the deletion task of a CMK. | |
SetDeletionProtection | Enables or disables deletion protection for a customer master key (CMK). | |
UpdateRotationPolicy | Updates the automatic rotation policy of a CMK. | |
DescribeKeyVersion | Queries the metadata of a specific CMK version. | |
CreateKeyVersion | Creates a version for a customer master key (CMK). | |
ListKeyVersions | Queries all versions of a specified CMK. | |
SetKeyPolicy | Sets the key policy for a CMK in a KMS instance. | |
GetKeyPolicy | Queries the key policy of a CMK in a KMS instance. |
Key
API | Title | Description |
GenerateDataKey | Generates a random data key for envelope encryption. The data key is returned in both plaintext and ciphertext forms. | |
GenerateAndExportDataKey | Generates a random data key, encrypts it by using a CMK and a public key that you specify, and returns both ciphertexts. | |
Encrypt | Encrypts plaintext by using a symmetric CMK. | |
Decrypt | Decrypts ciphertext that was encrypted by using a CMK. | |
ReEncrypt | Re-encrypts ciphertext under a different CMK without exposing the plaintext. | |
ExportDataKey | Exports a data key encrypted by a CMK. The data key is re-encrypted by a public key that you specify for secure transmission. | |
GenerateDataKeyWithoutPlaintext | Generates a random data key in only ciphertext form, without the plaintext copy. | |
AsymmetricSign | Generates a digital signature by using an asymmetric CMK. | |
AsymmetricVerify | Verifies a digital signature by using the public key of an asymmetric CMK. | |
AsymmetricEncrypt | Encrypts data by using the public key of an asymmetric CMK. | |
AsymmetricDecrypt | Decrypts data by using the private key of an asymmetric CMK. |
Secrets
API | Title | Description |
ListSecrets | Queries all secrets in the current region. | |
Retrieve Credential Value | Retrieve the credential value. | |
DeleteSecret | Deletes a secret. | |
CreateSecret | Creates a secret and stores its initial version. | |
UpdateSecret | Updates the metadata of a secret. | |
UpdateSecretVersionStage | Moves a version stage label to a different version of a secret. | |
UpdateSecretRotationPolicy | Updates the rotation policy of a secret. | |
DescribeSecret | Queries the metadata of a secret. | |
ListSecretVersionIds | Queries all version IDs and stage labels of a specified secret. | |
GetRandomPassword | Generates a random password string. | |
PutSecretValue | Stores a new version of a secret value for a generic secret. | |
RestoreSecret | Restores a deleted secret. | |
RotateSecret | Immediately rotates a secret. | |
SetSecretPolicy | Sets the access policy for a secret in a KMS instance. | |
GetSecretPolicy | Queries the access policy of a specified secret in a KMS instance. |
Tag
API | Title | Description |
GetKmsInstanceQuotaInfos | Queries the quota usage and limits of a KMS instance. | |
ListResourceTags | Queries the tags of a customer master key (CMK). | |
TagResource | Adds tags to a CMK, secret, or certificate. | |
UntagResource | Removes tags from a CMK, secret, or certificate. |
Manage Applications
API | Title | Description |
CreateNetworkRule | Creates a network access rule to configure the private IP addresses or private CIDR blocks that are allowed to access a Key Management Service (KMS) instance. | |
ListNetworkRules | Queries all network access rules in the current region. | |
DescribeNetworkRule | Retrieves the details of a network access rule. | |
UpdateNetworkRule | Updates a network access rule. | |
DeleteNetworkRule | Deletes a network access rule. | |
CreatePolicy | Creates a permission policy to configure the keys and secrets that are allowed to access. | |
ListPolicies | Queries all permission policies in the current region. | |
DescribePolicy | Retrieves the details of a permission policy. | |
UpdatePolicy | Updates a permission policy. | |
DeletePolicy | Deletes a permission policy. | |
CreateApplicationAccessPoint | Creates an application access point (AAP) | |
ListApplicationAccessPoints | Queries all application access points (AAPs) in the current region. | |
DescribeApplicationAccessPoint | Retrieves the details of an application access point (AAP). | |
UpdateApplicationAccessPoint | Updates the information about an application access point (AAP). | |
DeleteApplicationAccessPoint | Deletes an application access point (AAP). | |
CreateClientKey | Creates a client key. | |
ListClientKeys | Queries all client keys within an AAP. | |
GetClientKey | Retrieves information about a client key. | |
DeleteClientKey | Deletes a client key. |
Others
API | Title | Description |
DescribeRegions | Queries the regions where KMS is available. | |
ListTagResources | Lists the tags that are bound to a key or a secret. | |
TagResources | Adds tags to one or more keys or secrets. | |
UntagResources | Removes tags from keys or secrets. |