Key stores

List key store types

GET/v4/config/ows/key-management/key-store-types

Lists the key store types and the key store providers that the organisation can use. Call it before Create key store to get the provider ID, the default settings and the authentication methods.

keyStoreTypes: local first (the key store of the installation, which an organisation never adds), then the types that the installation lets an organisation add (vault, gcp-kms, aws-kms, azure-key-vault, dpod, csc).
providers: the catalogue of the installation in display order, for example OpenBao, HashiCorp Vault, Google Cloud KMS, AWS KMS, Azure Key Vault, Thales Luna Cloud HSM (DPoD), Intesi Group and other CSC providers.

An organisation has at most one key store of each provider: a provider that it already uses has canAdd false. A provider that the installation hides, or whose type it does not allow, is in the list only when the organisation already has a key store of it. dpod also needs the HSM signer of the platform. A sandbox organisation gets the answer of its main organisation.

Language of the request sample

curl 'https://demo-api.igrant.io/v4/config/ows/key-management/key-store-types' \
  -H 'Authorization: ApiKey <your-api-key>'

{
  "keyStoreTypes": [
    {
      "type": "local",
      "name": "Local vault",
      "canAdd": false,
      "protection": "software",
      "qscd": false,
      "capabilities": [
        "create",
        "import",
        "sign",
        "csr",
        "certificateChain",
        "test"
      ],
      "keyOrigins": [
        "created",
        "imported"
      ],
      "authenticationMethods": null,
      "apiVersions": null
    },
    {
      "type": "vault",
      "name": "External vault (OpenBao or HashiCorp Vault)",
      "canAdd": true,
      "protection": null,
      "qscd": false,
      "capabilities": [
        "create",
        "import",
        "reference",
        "sign",
        "csr",
        "certificateChain",
        "listProviderKeys",
        "test",
        "edit",
        "delete"
      ],
      "keyOrigins": [
        "created",
        "imported",
        "referenced"
      ],
      "authenticationMethods": [
        "userpass",
        "approle",
        "cert",
        "token"
      ],
      "apiVersions": null
    },
    {
      "type": "csc",
      "name": "Remote signing service (CSC API)",
      "canAdd": true,
      "protection": null,
      "qscd": "provider",
      "capabilities": [
        "reference",
        "sign",
        "listProviderKeys",
        "test",
        "edit",
        "delete"
      ],
      "keyOrigins": [
        "referenced"
      ],
      "authenticationMethods": null,
      "apiVersions": [
        "v1",
        "v2"
      ]
    }
  ],
  "providers": [
    {
      "id": "openbao",
      "category": "external-vault",
      "type": "vault",
      "name": "OpenBao",
      "order": 10,
      "logo": "openbao",
      "logoUrl": null,
      "protection": "software",
      "qualified": false,
      "region": null,
      "defaults": {
        "transitMount": "transit"
      },
      "apiVersions": null,
      "canAdd": true,
      "notAvailableReason": null
    },
    {
      "id": "hashicorp-vault",
      "category": "external-vault",
      "type": "vault",
      "name": "HashiCorp Vault",
      "order": 20,
      "logo": "hashicorp-vault",
      "logoUrl": null,
      "protection": "software",
      "qualified": false,
      "region": null,
      "defaults": {
        "transitMount": "transit"
      },
      "apiVersions": null,
      "canAdd": true,
      "notAvailableReason": null
    },
    {
      "id": "google-cloud-kms",
      "category": "external-vault",
      "type": "gcp-kms",
      "name": "Google Cloud KMS",
      "order": 30,
      "logo": null,
      "logoUrl": null,
      "protection": "hsm-backed",
      "qualified": false,
      "region": null,
      "defaults": {
        "protectionLevel": "HSM"
      },
      "apiVersions": null,
      "canAdd": true,
      "notAvailableReason": null
    }
  ]
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:read

Response

application/json

The key store types and the providers.

keyStoreTypesobject[]
The key store types, local first.
providersobject[]
The key store providers, sorted by category, then order.