path: root/contrib/libs/yandex-cloud-api-protos/yandex/cloud/kms/v1/symmetric_key_service.proto

syntax = "proto3";

package yandex.cloud.kms.v1;

import "google/api/annotations.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/duration.proto";
import "yandex/cloud/access/access.proto";
import "yandex/cloud/api/operation.proto";
import "yandex/cloud/operation/operation.proto";
import "yandex/cloud/validation.proto";
import "yandex/cloud/kms/v1/symmetric_key.proto";

option go_package = "github.com/yandex-cloud/go-genproto/yandex/cloud/kms/v1;kms";
option java_package = "yandex.cloud.api.kms.v1";

// Set of methods for managing symmetric KMS keys.
service SymmetricKeyService {

  // --- control plane

  // Creates a symmetric KMS key in the specified folder.
  rpc Create (CreateSymmetricKeyRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/kms/v1/keys" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "CreateSymmetricKeyMetadata"
      response: "SymmetricKey"
    };
  }

  // Returns the specified symmetric KMS key.
  //
  //  To get the list of available symmetric KMS keys, make a [SymmetricKeyService.List] request.
  rpc Get (GetSymmetricKeyRequest) returns (SymmetricKey) {
    option (google.api.http) = { get: "/kms/v1/keys/{key_id}" };
  }

  // Returns the list of symmetric KMS keys in the specified folder.
  rpc List (ListSymmetricKeysRequest) returns (ListSymmetricKeysResponse) {
    option (google.api.http) = { get: "/kms/v1/keys" };
  }

  // Returns the list of versions of the specified symmetric KMS key.
  rpc ListVersions (ListSymmetricKeyVersionsRequest) returns (ListSymmetricKeyVersionsResponse) {
    option (google.api.http) = { get: "/kms/v1/keys/{key_id}/versions" };
  }

  // Updates the specified symmetric KMS key.
  rpc Update (UpdateSymmetricKeyRequest) returns (operation.Operation) {
    option (google.api.http) = { patch: "/kms/v1/keys/{key_id}" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "UpdateSymmetricKeyMetadata"
      response: "SymmetricKey"
    };
  }

  // Deletes the specified symmetric KMS key. This action also automatically schedules
  // the destruction of all of the key's versions in 72 hours.
  //
  // The key and its versions appear absent in [SymmetricKeyService.Get] and [SymmetricKeyService.List]
  // requests, but can be restored within 72 hours with a request to tech support.
  rpc Delete (DeleteSymmetricKeyRequest) returns (operation.Operation) {
    option (google.api.http) = { delete: "/kms/v1/keys/{key_id}" };
    option (yandex.cloud.api.operation) = {
      metadata: "DeleteSymmetricKeyMetadata"
      response: "SymmetricKey"
    };
  }

  // Sets the primary version for the specified key. The primary version is used
  // by default for all encrypt/decrypt operations where no version ID is specified.
  rpc SetPrimaryVersion (SetPrimarySymmetricKeyVersionRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/kms/v1/keys/{key_id}:setPrimaryVersion" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "SetPrimarySymmetricKeyVersionMetadata"
      response: "SymmetricKey"
    };
  }

  // Schedules the specified key version for destruction.
  //
  // Scheduled destruction can be cancelled with the [SymmetricKeyService.CancelVersionDestruction] method.
  rpc ScheduleVersionDestruction (ScheduleSymmetricKeyVersionDestructionRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/kms/v1/keys/{key_id}:scheduleVersionDestruction" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "ScheduleSymmetricKeyVersionDestructionMetadata"
      response: "SymmetricKeyVersion"
    };
  }

  // Cancels previously scheduled version destruction, if the version hasn't been destroyed yet.
  rpc CancelVersionDestruction (CancelSymmetricKeyVersionDestructionRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/kms/v1/keys/{key_id}:cancelVersionDestruction" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "CancelSymmetricKeyVersionDestructionMetadata"
      response: "SymmetricKeyVersion"
    };
  }

  // Rotates the specified key: creates a new key version and makes it the primary version.
  // The old version remains available for decryption of ciphertext encrypted with it.
  rpc Rotate (RotateSymmetricKeyRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/kms/v1/keys/{key_id}:rotate" };
    option (yandex.cloud.api.operation) = {
      metadata: "RotateSymmetricKeyMetadata"
      response: "SymmetricKey"
    };
  }

  // Lists operations for the specified symmetric KMS key.
  rpc ListOperations (ListSymmetricKeyOperationsRequest) returns (ListSymmetricKeyOperationsResponse) {
    option (google.api.http) = { get: "/kms/v1/keys/{key_id}/operations" };
  }

  // Lists existing access bindings for the specified key.
  rpc ListAccessBindings (access.ListAccessBindingsRequest) returns (access.ListAccessBindingsResponse) {
    option (google.api.http) = { get: "/kms/v1/keys/{resource_id}:listAccessBindings" };
  }

  // Sets access bindings for the key.
  rpc SetAccessBindings (access.SetAccessBindingsRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/kms/v1/keys/{resource_id}:setAccessBindings" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "access.SetAccessBindingsMetadata"
      response: "google.protobuf.Empty"
    };
  }

  // Updates access bindings for the specified key.
  rpc UpdateAccessBindings (access.UpdateAccessBindingsRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/kms/v1/keys/{resource_id}:updateAccessBindings" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "access.UpdateAccessBindingsMetadata"
      response: "google.protobuf.Empty"
    };
  }
}


message CreateSymmetricKeyRequest {
  // ID of the folder to create a symmetric KMS key in.
  string folder_id = 1 [(required) = true, (length) = "<=50"];

  // Name of the key.
  string name = 2 [(length) = "<=100"];

  // Description of the key.
  string description = 3 [(length) = "<=1024"];

  // Custom labels for the symmetric KMS key as `key:value` pairs. Maximum 64 per key.
  // For example, `"project": "mvp"` or `"source": "dictionary"`.
  map<string, string> labels = 4 [(size) = "<=64", (length) = "<=63", (pattern) = "[-_0-9a-z]*", (map_key).length = "<=63", (map_key).pattern = "[a-z][-_0-9a-z]*"];

  // Encryption algorithm to be used with a new key version, generated with the next rotation.
  SymmetricAlgorithm default_algorithm = 5;

  // Interval between automatic rotations. To disable automatic rotation, don't include
  // this field in the creation request.
  google.protobuf.Duration rotation_period = 6;

  // Flag that inhibits deletion of the symmetric KMS key
  bool deletion_protection = 7;
}

message CreateSymmetricKeyMetadata {
  // ID of the key being created.
  string key_id = 1;

  // ID of the primary version of the key being created.
  string primary_version_id = 2;
}

message GetSymmetricKeyRequest {
  // ID of the symmetric KMS key to return.
  // To get the ID of a symmetric KMS key use a [SymmetricKeyService.List] request.
  string key_id = 1 [(required) = true, (length) = "<=50"];
}

message ListSymmetricKeysRequest {
  // ID of the folder to list symmetric KMS keys in.
  string folder_id = 1 [(required) = true, (length) = "<=50"];

  // The maximum number of results per page to return. If the number of available
  // results is larger than [page_size], the service returns a [ListSymmetricKeysResponse.next_page_token]
  // that can be used to get the next page of results in subsequent list requests.
  // Default value: 100.
  int64 page_size = 2 [(value) = "<=1000"];

  // Page token. To get the next page of results, set [page_token] to the
  // [ListSymmetricKeysResponse.next_page_token] returned by a previous list request.
  string page_token = 3 [(length) = "<=100"];
}

message ListSymmetricKeysResponse {
  // List of symmetric KMS keys in the specified folder.
  repeated SymmetricKey keys = 1;

  // This token allows you to get the next page of results for list requests. If the number
  // of results is greater than the specified [ListSymmetricKeysRequest.page_size], use
  // the [next_page_token] as the value for the [ListSymmetricKeysRequest.page_token] query parameter
  // in the next list request. Each subsequent list request will have its own
  // [next_page_token] to continue paging through the results.
  string next_page_token = 2;
}

message ListSymmetricKeyVersionsRequest {
  // ID of the symmetric KMS key to list versions for.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // The maximum number of results per page to return. If the number of available
  // results is larger than [page_size], the service returns a [ListSymmetricKeyVersionsResponse.next_page_token]
  // that can be used to get the next page of results in subsequent list requests.
  // Default value: 100.
  int64 page_size = 2 [(value) = "<=1000"];

  // Page token. To get the next page of results, set [page_token] to the
  // [ListSymmetricKeyVersionsResponse.next_page_token] returned by a previous list request.
  string page_token = 3 [(length) = "<=100"];
}

message ListSymmetricKeyVersionsResponse {
  // List of versions for the specified symmetric KMS key.
  repeated SymmetricKeyVersion key_versions = 1;

  // This token allows you to get the next page of results for list requests. If the number
  // of results is greater than the specified [ListSymmetricKeyVersionsRequest.page_size], use
  // the [next_page_token] as the value for the [ListSymmetricKeyVersionsRequest.page_token] query parameter
  // in the next list request. Each subsequent list request will have its own
  // [next_page_token] to continue paging through the results.
  string next_page_token = 2;
}

message UpdateSymmetricKeyRequest {
  // ID of the symmetric KMS key to update.
  // To get the ID of a symmetric KMS key use a [SymmetricKeyService.List] request.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // Field mask that specifies which attributes of the symmetric KMS key are going to be updated.
  google.protobuf.FieldMask update_mask = 2 [(required) = true];

  // New name for the symmetric KMS key.
  string name = 3 [(length) = "<=100"];

  // New description for the symmetric KMS key.
  string description = 4 [(length) = "<=1024"];

  // New status for the symmetric KMS key.
  // Using the [SymmetricKeyService.Update] method you can only set ACTIVE or INACTIVE status.
  SymmetricKey.Status status = 5;

  // Custom labels for the symmetric KMS key as `key:value` pairs. Maximum 64 per key.
  map<string, string> labels = 6 [(size) = "<=64", (length) = "<=63", (pattern) = "[-_0-9a-z]*", (map_key).length = "<=63", (map_key).pattern = "[a-z][-_0-9a-z]*"];

  // Default encryption algorithm to be used with new versions of the symmetric KMS key.
  SymmetricAlgorithm default_algorithm = 7;

  // Time period between automatic symmetric KMS key rotations.
  google.protobuf.Duration rotation_period = 8; // period between two automatic rotations

  // Flag that inhibits deletion of the symmetric KMS key
  bool deletion_protection = 9;
}

message UpdateSymmetricKeyMetadata {
  // ID of the key being updated.
  string key_id = 1;
}

message DeleteSymmetricKeyRequest {
  // ID of the key to be deleted.
  string key_id = 1 [(required) = true, (length) = "<=50"];
}

message DeleteSymmetricKeyMetadata {
  // ID of the key being deleted.
  string key_id = 1;
}


message SetPrimarySymmetricKeyVersionRequest {
  // ID of the key to set a primary version for.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // ID of the version that should become primary for the specified key.
  string version_id = 2 [(required) = true, (length) = "<=50"];
}

message SetPrimarySymmetricKeyVersionMetadata {
  // ID of the key that the primary version if being changed for.
  string key_id = 1;

  // ID of the version that is being made primary for the key.
  string version_id = 2;
}

message RotateSymmetricKeyRequest {
  // ID of the key to be rotated.
  string key_id = 1 [(required) = true, (length) = "<=50"];
}

message RotateSymmetricKeyMetadata {
  // ID of the key being rotated.
  string key_id = 1;

  // ID of the version generated as a result of key rotation.
  string new_primary_version_id = 2;
}

message ScheduleSymmetricKeyVersionDestructionRequest {
  // ID of the key whose version should be scheduled for destruction.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // ID of the version to be destroyed.
  string version_id = 2 [(required) = true, (length) = "<=50"];

  // Time interval between the version destruction request and actual destruction.
  // Default value: 7 days.
  google.protobuf.Duration pending_period = 3;
}

message ScheduleSymmetricKeyVersionDestructionMetadata {
  // ID of the key whose version is being scheduled for destruction.
  string key_id = 1;

  // ID of the version that is being scheduled for destruction.
  string version_id = 2;

  // Time when the version is scheduled to be destroyed.
  google.protobuf.Timestamp destroy_at = 3;
}

message CancelSymmetricKeyVersionDestructionRequest {
  // ID of the key to cancel a version's destruction for.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // ID of the version whose scheduled destruction should be cancelled.
  string version_id = 2 [(required) = true, (length) = "<=50"];
}

message CancelSymmetricKeyVersionDestructionMetadata {
  // ID of the key whose version's destruction is being cancelled.
  string key_id = 1;

  // ID of the version whose scheduled destruction is being cancelled.
  string version_id = 2;
}


message ListSymmetricKeyOperationsRequest {
  // ID of the symmetric KMS key to get operations for.
  //
  // To get the key ID, use a [SymmetricKeyService.List] request.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // The maximum number of results per page that should be returned. If the number of available
  // results is larger than [page_size], the service returns a [ListSymmetricKeyOperationsResponse.next_page_token]
  // that can be used to get the next page of results in subsequent list requests.
  // Default value: 100.
  int64 page_size = 2 [(value) = "<=1000"];

  // Page token. To get the next page of results, set [page_token] to the
  // [ListSymmetricKeyOperationsResponse.next_page_token] returned by a previous list request.
  string page_token = 3 [(length) = "<=100"];
}

message ListSymmetricKeyOperationsResponse {
  // List of operations for the specified key.
  repeated operation.Operation operations = 1;

  // This token allows you to get the next page of results for list requests. If the number of results
  // is larger than [ListSymmetricKeyOperationsRequest.page_size], use the [next_page_token] as the value
  // for the [ListSymmetricKeyOperationsRequest.page_token] query parameter in the next list request.
  // Each subsequent list request will have its own [next_page_token] to continue paging through the results.
  string next_page_token = 2;
}