Cryptographic Operations

A suite of cryptographic primitives offered by the Exoscale KMS.

decrypt

Decrypt

POST /kms-key/{id}/decrypt

Decrypts a ciphertext.

Path parameters

Name	In	Description
`id`	`path`	Must be a valid UUID.

Request body

Content-Type: application/json

Property	Type	Required	Description
`ciphertext`	string	yes	The Base64-encoded ciphertext payload to be decrypted. Base64-encoded string.
`encryption-context`	string	no	The exact Base64-encoded Additional Authenticated Data (AAD) used during encryption to verify data integrity. Base64-encoded string.

Example

{
  "ciphertext": "string",
  "encryption-context": "string"
}

Responses

200: Base64 encoded plaintext.

Content-Type: application/json

Property	Type	Description
`plaintext`	string	The recovered Base64-encoded original plaintext payload. Base64-encoded string.

Example output

{
  "plaintext": "string"
}

400: ### Errors

Key Not Found: The request was rejected because the specified KMS Key could not be found.

Key is Disabled: The request was rejected because the specified KMS key is disabled.

Invalid Usage: The request was rejected because the operation is only allowed on symmetric keys with usage “encrypt-decrypt”.

Content-Type: application/json

Property	Type	Description
`detail`	string	A highly contextual, readable explanation breaking down explicitly what triggered this error scenario.
`status`	integer	Min: `100`. Max: `599`.
`title`	string	A brief summary defining the class of failure, optimal for quick user interface groupings.
`type`	string	An absolute or relative URI reference pointing to human-readable documentation concerning the specific problem type encountered. Must be a valid URI reference.

Example output

{
  "detail": "string",
  "status": 0,
  "title": "string",
  "type": "string"
}

SDK reference for decrypt: golang | Python | Java

CLI: exo api decrypt

encrypt

Encrypt

POST /kms-key/{id}/encrypt

Encrypts a plaintext.

Path parameters

Name	In	Description
`id`	`path`	Must be a valid UUID.

Request body

Content-Type: application/json

Property	Type	Required	Description
`plaintext`	string	yes	The Base64-encoded plaintext data you wish to encrypt. Base64-encoded string.
`encryption-context`	string	no	Base64-encoded bytes to be used as the Additional Authenticated Data (AAD) for encryption integrity. Base64-encoded string.

Example

{
  "encryption-context": "string",
  "plaintext": "string"
}

Responses

200: Base64 encoded ciphertext

Content-Type: application/json

Property	Type	Description
`ciphertext`	string	The resulting Base64-encoded ciphertext after encryption. Base64-encoded string.

Example output

{
  "ciphertext": "string"
}

400: ### Errors

Key Not Found: The request was rejected because the specified KMS Key could not be found.

Key is Disabled: The request was rejected because the specified KMS key is disabled.

Invalid Usage: The request was rejected because the operation is only allowed on symmetric keys with usage “encrypt-decrypt”.

Content-Type: application/json

Property	Type	Description
`detail`	string	A highly contextual, readable explanation breaking down explicitly what triggered this error scenario.
`status`	integer	Min: `100`. Max: `599`.
`title`	string	A brief summary defining the class of failure, optimal for quick user interface groupings.
`type`	string	An absolute or relative URI reference pointing to human-readable documentation concerning the specific problem type encountered. Must be a valid URI reference.

Example output

{
  "detail": "string",
  "status": 0,
  "title": "string",
  "type": "string"
}

SDK reference for encrypt: golang | Python | Java

CLI: exo api encrypt

generate-data-key

Generate Data Encryption Key

POST /kms-key/{id}/generate-data-key

Generate a Data Encryption Key from a given KMS Key.

Path parameters

Name	In	Description
`id`	`path`	Must be a valid UUID.

Request body

Content-Type: application/json

Property	Type	Required	Description
`bytes-count`	integer	no	Min: `1`. Max: `1024`.
`encryption-context`	string	no	Base64-encoded Additional Authenticated Data binding key generation parameters securely to operational scope. Base64-encoded string.
`key-spec`	string	no	Allowed values: `AES-256`.

Example

{
  "bytes-count": 0,
  "encryption-context": "string",
  "key-spec": "AES-256"
}

Responses

200: Data Encryption Key in the clear and in its base64 encoded encrypted format.

Content-Type: application/json

Property	Type	Description
`ciphertext`	string	The identical symmetric data key, returned safely wrapped/encrypted using the designated root parent KMS key. Base64-encoded string.
`plaintext`	string	The Base64-encoded raw symmetric data key payload. Expose only securely during active application setups. Base64-encoded string.

Example output

{
  "ciphertext": "string",
  "plaintext": "string"
}

400: ### Errors

Key Not Found: The request was rejected because the specified KMS Key could not be found.

Key is Disabled: The request was rejected because the specified KMS key is disabled.

Invalid Usage: The request was rejected because the operation is only allowed on symmetric keys with usage “encrypt-decrypt”.

Content-Type: application/json

Property	Type	Description
`detail`	string	A highly contextual, readable explanation breaking down explicitly what triggered this error scenario.
`status`	integer	Min: `100`. Max: `599`.
`title`	string	A brief summary defining the class of failure, optimal for quick user interface groupings.
`type`	string	An absolute or relative URI reference pointing to human-readable documentation concerning the specific problem type encountered. Must be a valid URI reference.

Example output

{
  "detail": "string",
  "status": 0,
  "title": "string",
  "type": "string"
}

SDK reference for generate-data-key: golang | Python | Java

CLI: exo api generate-data-key

re-encrypt

Re-encrypt

POST /kms-key/{id}/re-encrypt

Decrypts an existing ciphertext using its original key material and re-encrypts the underlying plaintext using a specified KMS key or the latest key material of the same KMS Key.

Path parameters

Name	In	Description
`id`	`path`	Must be a valid UUID.

Request body

Content-Type: application/json

Property	Type	Required	Description
`destination`	Destination	yes
`source`	Source	yes

Example

{
  "destination": {
    "encryption-context": "string",
    "key": "string"
  },
  "source": {
    "ciphertext": "string",
    "encryption-context": "string",
    "key": "string"
  }
}

Responses

200: Base64 encoded ciphertext

Content-Type: application/json

Property	Type	Description
`ciphertext`	string	The new Base64-encoded ciphertext block safely wrapped by the chosen destination key parameters. Base64-encoded string.

Example output

{
  "ciphertext": "string"
}

400: ### Errors

Key Not Found: The request was rejected because the specified KMS Key could not be found.

Key is Disabled: The request was rejected because the specified KMS key is disabled.

Not on Default: The request was rejected because the operation is not allowed on the default key.

Bad Request: The request was rejected because of an invalid request body or path parameter.

Content-Type: application/json

Property	Type	Description
`detail`	string	A highly contextual, readable explanation breaking down explicitly what triggered this error scenario.
`status`	integer	Min: `100`. Max: `599`.
`title`	string	A brief summary defining the class of failure, optimal for quick user interface groupings.
`type`	string	An absolute or relative URI reference pointing to human-readable documentation concerning the specific problem type encountered. Must be a valid URI reference.

Example output

{
  "detail": "string",
  "status": 0,
  "title": "string",
  "type": "string"
}

SDK reference for re-encrypt: golang | Python | Java

CLI: exo api re-encrypt

Last updated on July 20, 2026

Cryptographic Operations

Other Operations

decrypt

Path parameters

Request body

Responses

encrypt

Path parameters

Request body

Responses

generate-data-key

Path parameters

Request body

Responses

re-encrypt

Path parameters

Request body

Responses