Documentation

API reference.

Every public route of the SanctiKey API, rendered from the public OpenAPI document the service's build emits. The document names no server, so paths are shown without a host.

Authentication

Every route requires an HTTP bearer credential in the Authorization header. How your pipeline gets one is in Getting started.

Keys

GET/v1/keys/{key_id}

Get key metadata

Parameter	Type	Notes
key_id (path)required	`string`

200Successful Response KeyResponse
422Validation Error HTTPValidationError

DELETE/v1/keys/{key_id}

Schedule key deletion

Parameter	Type	Notes
key_id (path)required	`string`

200Successful Response DeleteKeyResponse
422Validation Error HTTPValidationError

POST/v1/keys/{key_id}/cancel-deletion

Cancel a scheduled key deletion

Parameter	Type	Notes
key_id (path)required	`string`

200Successful Response KeyResponse
422Validation Error HTTPValidationError

PUT/v1/keys/{key_id}/partition

Assign key to a named partition

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): AssignPartitionRequest

200Successful Response AssignPartitionResponse
422Validation Error HTTPValidationError

GET/v1/keys/{key_id}/regions

List the regions a key is placed in

Parameter	Type	Notes
key_id (path)required	`string`

200Successful Response KeyRegionListResponse
422Validation Error HTTPValidationError

POST/v1/keys/{key_id}/regions

Replicate a key into another region

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): AddRegionRequest

201Successful Response KeyRegionResponse
422Validation Error HTTPValidationError

POST/v1/keys/{key_id}/relocate

Move a key's home region

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): AddRegionRequest

200Successful Response KeyResponse
422Validation Error HTTPValidationError

PATCH/v1/regions/failover/{source_region}

Reconcile a failover mapping's lifecycle status

Parameter	Type	Notes
source_region (path)required	`string`

Request body (required): FailoverStatusRequest

200Successful Response FailoverPair
422Validation Error HTTPValidationError

DELETE/v1/regions/failover/{source_region}

Remove a region's DR failover mapping

Parameter	Type	Notes
source_region (path)required	`string`

200Successful Response object
422Validation Error HTTPValidationError

DELETE/v1/keys/{key_id}/regions/{region}

Remove a key's regional placement

Parameter	Type	Notes
key_id (path)required	`string`
region (path)required	`string`

200Successful Response RemoveRegionResponse
422Validation Error HTTPValidationError

GET/v1/keys

List keys in the caller's partitions

Parameter	Type	Notes
partition_id (query)	`string or null`
limit (query)	`integer`	minimum 1; maximum 100; default 20
next_token (query)	`string or null`

200Successful Response KeyListResponse
422Validation Error HTTPValidationError

POST/v1/keys

Create a KMS-backed key

Request body (required): CreateKeyRequest

201Successful Response KeyResponse
422Validation Error HTTPValidationError

GET/v1/regions

Account-wide key placement matrix

200Successful Response RegionMatrixResponse
422Validation Error HTTPValidationError

PUT/v1/regions/failover

Set a region-to-region DR failover mapping

Request body (required): FailoverPairRequest

200Successful Response FailoverPair
422Validation Error HTTPValidationError

Crypto

POST/v1/keys/{key_id}/encrypt

Encrypt plaintext with a KMS key

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): EncryptRequest

200Successful Response EncryptResponse
422Validation Error HTTPValidationError

POST/v1/keys/{key_id}/decrypt

Decrypt a KMS-encrypted ciphertext

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): DecryptRequest

200Successful Response DecryptResponse
422Validation Error HTTPValidationError

POST/v1/keys/{key_id}/verify

Verify a signature with a KMS key

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): VerifyRequest

200Successful Response VerifyResponse
422Validation Error HTTPValidationError

POST/v1/keys/{key_id}/generate-data-key

Generate a data encryption key

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): GenerateDataKeyRequest

200Successful Response GenerateDataKeyResponse
422Validation Error HTTPValidationError

POST/v1/keys/{key_id}/re-encrypt

Re-encrypt ciphertext under a different KMS key

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): ReEncryptRequest

200Successful Response ReEncryptResponse
422Validation Error HTTPValidationError

Sign

POST/v1/keys/{key_id}/sign

Sign a message with a KMS key

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): SignRequest

200Successful Response SignResponse
422Validation Error HTTPValidationError

POST/v1/keys/{key_id}/sign/upload-url

Get a presigned S3 URL for large message signing

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): SignUploadUrlRequest

202Successful Response SignUploadUrlResponse
422Validation Error HTTPValidationError

CSR

POST/v1/keys/{key_id}/csr

Generate a certificate signing request

Parameter	Type	Notes
key_id (path)required	`string`

Request body (required): CsrRequest

201Successful Response CsrResponse
422Validation Error HTTPValidationError

PKI

GET/v1/pki/cas/{key_id}

Get a CA and its chain

Parameter	Type	Notes
key_id (path)required	`string`

200Successful Response CaDetailResponse
422Validation Error HTTPValidationError

GET/v1/pki/cas/{key_id}/certificates

List certificates issued by a CA

Parameter	Type	Notes
key_id (path)required	`string`

200Successful Response CertListResponse
422Validation Error HTTPValidationError

GET/v1/pki/cas/{key_id}/crl

Get a CA's current CRL

Parameter	Type	Notes
key_id (path)required	`string`

200Successful Response CrlResponse
422Validation Error HTTPValidationError

GET/v1/pki/cas

List owned CAs

200Successful Response CaListResponse
422Validation Error HTTPValidationError

POST/v1/pki/cas

Designate an owned key as a CA

Request body (required): CaCreateRequest

201Successful Response CaResponse
422Validation Error HTTPValidationError

GET/v1/pki/certificates/{serial}

Get an issued certificate

Parameter	Type	Notes
serial (path)required	`string`

200Successful Response CertDetailResponse
422Validation Error HTTPValidationError

POST/v1/pki/certificates/{serial}/revoke

Revoke an issued certificate

Parameter	Type	Notes
serial (path)required	`string`

Request body (required): RevokeCertRequest

200Successful Response CrlResponse
422Validation Error HTTPValidationError

POST/v1/pki/certificates

Issue a leaf certificate

Request body (required): IssueCertRequest

201Successful Response CertResponse
422Validation Error HTTPValidationError

POST/v1/pki/certificates/upload

Import an externally-signed certificate

Request body (required): UploadCertRequest

201Successful Response object
422Validation Error HTTPValidationError

Requests

GET/v1/requests/{request_id}

Poll async operation status

Parameter	Type	Notes
request_id (path)required	`string`	max length 128

200Successful Response RequestResponse
422Validation Error HTTPValidationError

Profile

DELETE/v1/profile/api-keys/{key_id}

Revoke an API key

Parameter	Type	Notes
key_id (path)required	`string`

200Successful Response RevokeApiKeyResponse
422Validation Error HTTPValidationError

GET/v1/profile/api-keys/policy

Get the tenant API key policy for scope selector

200Successful Response ApiKeyPolicyResponse
422Validation Error HTTPValidationError

GET/v1/profile/api-keys

List API keys for the calling user

200Successful Response ApiKeyListResponse
422Validation Error HTTPValidationError

POST/v1/profile/api-keys

Create an API key

Request body (required): CreateApiKeyRequest

201Successful Response ApiKeyCreatedResponse
422Validation Error HTTPValidationError

GET/v1/profile/mfa

Get MFA enrollment status

200Successful Response object
422Validation Error HTTPValidationError

POST/v1/profile/mfa/associate

Begin TOTP enrollment

200Successful Response object
422Validation Error HTTPValidationError

POST/v1/profile/mfa/verify

Verify TOTP and enable MFA

Request body (required): VerifyMfaRequest

200Successful Response object
422Validation Error HTTPValidationError

Schemas

AddRegionRequest

Replicate an existing key into another region (spec §4.1 B, PLACEMENT).

Field Type Notes

regionrequired

string

AWS region id. Must be a member of the platform FIPS allowlist.

max length 32; pattern ^[a-z]{2}-[a-z]+-\d{1,2}$

ApiKeyCreatedResponse

A JSON object; the public specification does not enumerate its fields.

ApiKeyListResponse

A JSON object; the public specification does not enumerate its fields.

ApiKeyPolicyResponse

A JSON object; the public specification does not enumerate its fields.

AssignPartitionRequest

Field Type Notes

partition_idrequired

string

Partition name. Lowercase alphanumeric and hyphens only.

max length 64; pattern ^[a-z0-9-]+$

AssignPartitionResponse

A JSON object; the public specification does not enumerate its fields.

CaCreateRequest

Designate an owned KMS SIGN_VERIFY key as a root or intermediate CA.

Field	Type	Notes
key_idrequired	`string`	max length 128; pattern (?i)^((?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32})\|arn:aws(-[a-z]+)*:kms:[a-z0-9-]+:\d{12}:key/(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32}))$
moderequired	`string`	one of root, intermediate
subjectrequired	`CsrSubject`
validity_years	`integer`	minimum 1; maximum 30; default 10
pathlen	`integer`	minimum 0; maximum 3; default 0
issuer_ca_key_id	`string or null`	max length 128; pattern (?i)^((?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32})\|arn:aws(-[a-z]+)*:kms:[a-z0-9-]+:\d{12}:key/(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32}))$
profile	`string or null`	min length 1; max length 32

CaDetailResponse

A JSON object; the public specification does not enumerate its fields.

CaListResponse

A JSON object; the public specification does not enumerate its fields.

CaResponse

A JSON object; the public specification does not enumerate its fields.

CertDetailResponse

A JSON object; the public specification does not enumerate its fields.

CertListResponse

A JSON object; the public specification does not enumerate its fields.

CertResponse

A JSON object; the public specification does not enumerate its fields.

CreateApiKeyRequest

Field Type Notes

namerequired

string

Human-readable label for this API key.

min length 1; max length 64

scopesrequired

array of string

Scopes granted to this key. Must be a subset of the requesting user's own scopes.

min items 1; max items 10

CreateKeyRequest

Field	Type	Notes
key_specrequired	`string`	one of RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, SYMMETRIC_DEFAULT
key_usagerequired	`string`	one of ENCRYPT_DECRYPT, SIGN_VERIFY
description	`string`	max length 256; default ""
partition_id	`string`	Partition identifier. Lowercase alphanumeric and hyphens only. max length 64; pattern ^[a-z0-9-]+$; default "default"
home_region	`string or null`	max length 32; pattern ^[a-z]{2}-[a-z]+-\d{1,2}$
idempotency_token	`string or null`	min length 8; max length 64; pattern ^[A-Za-z0-9_-]+$

CrlResponse

A JSON object; the public specification does not enumerate its fields.

CsrRequest

Field	Type	Notes
subjectrequired	`CsrSubject`
signing_algorithm	`string`	one of RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512; default "RSASSA_PKCS1_V1_5_SHA_256"
san_dns_names	`array of string`	max items 20

CsrResponse

A JSON object; the public specification does not enumerate its fields.

CsrSubject

Field	Type	Notes
common_namerequired	`string`	max length 64; pattern ^[^\x00-\x1f\x7f\s,+"\\<>;](?:[^\x00-\x1f\x7f,+"\\<>;]*[^\x00-\x1f\x7f\s,+"\\<>;])?$
organization	`string or null`	max length 64; pattern ^[^\x00-\x1f\x7f\s,+"\\<>;](?:[^\x00-\x1f\x7f,+"\\<>;]*[^\x00-\x1f\x7f\s,+"\\<>;])?$
country	`string or null`	min length 2; max length 2; pattern ^[A-Z]{2}$
matter_vid	`string or null`	min length 4; max length 4; pattern ^[0-9A-F]{4}$
matter_pid	`string or null`	min length 4; max length 4; pattern ^[0-9A-F]{4}$

DecryptRequest

Field Type Notes

ciphertext_blobrequired

string

Base64-encoded binary data.

max length 12288

encryption_context object or null

DecryptResponse

A JSON object; the public specification does not enumerate its fields.

DeleteKeyResponse

A JSON object; the public specification does not enumerate its fields.

EncryptRequest

Field Type Notes

plaintextrequired

string

Base64-encoded plaintext. Max 4 MB raw.

max length 5592

encryption_context object or null

EncryptResponse

A JSON object; the public specification does not enumerate its fields.

FailoverPair

A JSON object; the public specification does not enumerate its fields.

FailoverPairRequest

Set (upsert) a source region's failover target.

Field Type Notes

source_regionrequired

string

AWS region id. Must be a member of the platform FIPS allowlist.

max length 32; pattern ^[a-z]{2}-[a-z]+-\d{1,2}$

target_regionrequired

string

AWS region id. Must be a member of the platform FIPS allowlist.

max length 32; pattern ^[a-z]{2}-[a-z]+-\d{1,2}$

FailoverStatusRequest

Reconcile a pair's lifecycle status (spec §4.3). HostedZones flips PENDING/ACTIVE as health-check records are laid or torn down; only those two states are settable via this path.

Field	Type	Notes
statusrequired	`string`	one of PENDING, ACTIVE

GenerateDataKeyRequest

Field	Type	Notes
key_spec	`string`	one of AES_256, AES_128; default "AES_256"
encryption_context	`object or null`

GenerateDataKeyResponse

A JSON object; the public specification does not enumerate its fields.

HTTPValidationError

Field	Type	Notes
detail	`array of ValidationError`

IssueCertRequest

Issue a leaf certificate from an uploaded CSR using an owned CA key. `profile` names an entry in common.cert_profiles; the 397-day CA/B cap is a property of the TLS profiles, not of issuance.

Field	Type	Notes
ca_key_idrequired	`string`	max length 128; pattern (?i)^((?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32})\|arn:aws(-[a-z]+)*:kms:[a-z0-9-]+:\d{12}:key/(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32}))$
csr_pemrequired	`string`	max length 16384
profilerequired	`string`	max length 32
validity_days	`integer`	minimum 1; maximum 36500; default 90
no_expiry	`boolean`	default false

KeyListResponse

A JSON object; the public specification does not enumerate its fields.

KeyRegionListResponse

A JSON object; the public specification does not enumerate its fields.

KeyRegionResponse

A JSON object; the public specification does not enumerate its fields.

KeyResponse

A JSON object; the public specification does not enumerate its fields.

ReEncryptRequest

Field	Type	Notes
ciphertext_blobrequired	`string`	Base64-encoded binary data. max length 12288
destination_key_idrequired	`string`	max length 128; pattern (?i)^((?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32})\|arn:aws(-[a-z]+)*:kms:[a-z0-9-]+:\d{12}:key/(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32}))$
source_encryption_context	`object or null`
destination_encryption_context	`object or null`

ReEncryptResponse

A JSON object; the public specification does not enumerate its fields.

RegionMatrixResponse

A JSON object; the public specification does not enumerate its fields.

RemoveRegionResponse

A JSON object; the public specification does not enumerate its fields.

RequestResponse

A JSON object; the public specification does not enumerate its fields.

ResponseValidationError

Field	Type	Notes
detail	`array of ValidationError`

RevokeApiKeyResponse

A JSON object; the public specification does not enumerate its fields.

RevokeCertRequest

Revoke an issued certificate. Reason maps to an RFC 5280 CRL reason code.

Field	Type	Notes
reason	`string`	one of unspecified, keyCompromise, affiliationChanged, superseded, cessationOfOperation; default "unspecified"

SignRequest

Field Type Notes

messagerequired

string

Base64-encoded message or pre-computed digest.

max length 87381

signing_algorithmrequired

string

one of RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA

message_type

string

one of RAW, DIGEST; default "RAW"

SignResponse

A JSON object; the public specification does not enumerate its fields.

SignUploadUrlRequest

Field	Type	Notes
signing_algorithmrequired	`string`	one of RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA
message_type	`string`	one of RAW, DIGEST; default "RAW"

SignUploadUrlResponse

A JSON object; the public specification does not enumerate its fields.

UploadCertRequest

Import an externally-signed cert; binds to an owned key (F6).

Field	Type	Notes
key_idrequired	`string`	max length 128; pattern (?i)^((?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32})\|arn:aws(-[a-z]+)*:kms:[a-z0-9-]+:\d{12}:key/(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|mrk-[0-9a-f]{32}))$
certificate_pemrequired	`string`	max length 16384
chain_pem	`string or null`	max length 65536

ValidationError

Field	Type	Notes
locrequired	`array of string or integer`
typerequired	`string`

VerifyMfaRequest

Field	Type	Notes
otprequired	`string`	min length 6; max length 8; pattern ^\d{6,8}$

VerifyRequest

Field	Type	Notes
messagerequired	`string`	Base64-encoded binary data. max length 87381
signaturerequired	`string`	Base64-encoded binary data. max length 1024
signing_algorithmrequired	`string`	one of RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA
message_type	`string`	one of RAW, DIGEST; default "RAW"

VerifyResponse

A JSON object; the public specification does not enumerate its fields.