Fortanix Data Security Manager REST API
REST API for the Fortanix Data Security Manager (DSM): account, group, app, user and role administration plus key lifecycle (generate, import, rotate, export, destroy) and cryptographic operations (encrypt, decrypt, sign, verify, digest, HMAC, key agreement, key wrapping, multi-part and batch crypto), approval requests, Lua plugins, audit logs and account statistics.
Fortanix Data Security Manager REST API is one of 3 APIs that Fortanix publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Key Management, Cryptography, HSM, Secrets Management, and Encryption. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.
This API exposes 171 operations across 131 paths, organized into 20 resource areas, and defines 741 schemas. It is described by OpenAPI 3.0.0, at version 0.1.0-20260710.
Requests are made against a single base URL, {dsmEndpoint}.
171 operations
131 paths
741 schemas
15 DELETE48 GET12 PATCH93 POST3 PUT
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 3
Fortanix Data Security Manager REST API declares
3 security schemes
for authenticating requests.
It accepts HTTP basic authentication (basicAuth).
An API key is passed in the header as Authorization (apiKeyAuth).
It accepts HTTP bearer tokens (JWT) (bearerToken).
apiKeyAuth— Please enter your token prefixed with 'Basic ' (e.g., 'Basic yourtokenhere')
Paths & Operations 171
Across 131 paths, the API surfaces 171 operations — 15 DELETE, 48 GET, 12 PATCH, 93 POST, 3 PUT. They span 20 resource areas, including Accounts, Keys, Apps, Crypto, Approval_requests, Groups, Session, Batch, and 12 more. Each is listed below with its method, path, parameters, and response codes.
Accounts 13
GET
/sys/v1/accounts/{acct_id}/usage
Get account usage information. See input and output of this API for info on what it can return.
POST
/sys/v1/accounts
Create a new account.
GET
/sys/v1/accounts
Get info about all accounts.
POST
/sys/v1/accounts/{acct_id}/replication/credentials
Create an admin app credential that can be used to perform account replication.
GET
/sys/v1/accounts/{acct_id}/replication/credentials
Retrieve all stored replication credentials under the account.
DELETE
/sys/v1/accounts/{acct_id}
Delete an account.
GET
/sys/v1/accounts/{acct_id}
Get info for a specific account.
PATCH
/sys/v1/accounts/{acct_id}
Update account settings such as authentication, logging, etc.
DELETE
/sys/v1/accounts/{acct_id}/replication/credentials/{credential_id}
Delete the specified replication credential.
GET
/sys/v1/accounts/{acct_id}/replication/credentials/{credential_id}
Retrieve the specified replication credential.
PATCH
/sys/v1/accounts/{acct_id}/replication/credentials/{credential_id}
Update the specified replication credential.
GET
/sys/v1/accounts/{acct_id}/replication/recent_scan_summary
Fetch a summary of recent scans.
POST
/sys/v1/accounts/{acct_id}/replication/credentials/{credential_id}/self_sign
Generate a self-signed cert for the specified credential.
Keys 23
POST
/crypto/v1/keys/{key_id}/activate
Transition a security object to Active state.
POST
/crypto/v1/keys/copy
Make a copy of a security object.
POST
/crypto/v1/keys
Generate a new security object.
PUT
/crypto/v1/keys
Import a security object.
GET
/crypto/v1/keys
Get all security objects accessible to the requester.
DELETE
/crypto/v1/keys/{key_id}
Delete the specified security object.
PATCH
/crypto/v1/keys/{key_id}
Update the properties of a security object like name, description, etc.
POST
/crypto/v1/keys/{key_id}/destroy
Transition a security object to Destroyed state. Objects in the Destroyed state cannot be used in any cryptographic operation. Their metadata however, remains accessible.
POST
/crypto/v1/keys/digest
Retrieve the digest (hash) of the value of an exportable security object.
POST
/crypto/v1/keys/export
Get the details and value of a particular exportable security object.
POST
/crypto/v1/keys/components/export
Exports the security object as components.
POST
/crypto/v1/keys/kcv
Computes the KCV of the input and returns. This is only valid for AES, DES & DES3 keys.
POST
/crypto/v1/keys/key_attestation
Retrieve a key attestation certificate for a security object.
GET
/crypto/v1/pubkey/{acct_id}/{name}
Get public part of an asymmetric key.
POST
/crypto/v1/keys/info
Lookup a security object.
POST
/crypto/v1/keys/components/import
Import a security object by components.
POST
/crypto/v1/keys/persist
Persist a transient key.
DELETE
/crypto/v1/keys/{key_id}/private
Destroy private half of an asymmetric key.
POST
/crypto/v1/keys/replace
Rotate a security object to an existing security object.
PUT
/crypto/v1/keys/{key_id}/revert
Reverts a security object to a previous state.
POST
/crypto/v1/keys/{key_id}/revoke
Transition a security object to Deactivated or Compromised state.
POST
/crypto/v1/keys/rekey
Rotate a security object.
POST
/crypto/v1/keys/kcv/verify
Computes the KCV of the input blob and checks if it matches the input KCV.
Apps 13
POST
/sys/v1/apps/{app_id}/groups
Assign the app a new group membership
GET
/sys/v1/apps/{app_id}/groups
Get all group memberships for the app
POST
/sys/v1/apps
Create a new application with the specified properties.
GET
/sys/v1/apps
Get details of all apps accessible to requester.
DELETE
/sys/v1/apps/{app_id}
Delete an app.
GET
/sys/v1/apps/{app_id}
Lookup an application.
PATCH
/sys/v1/apps/{app_id}
Update app settings like groups, client config, etc.
DELETE
/sys/v1/apps/{app_id}/groups/{group_id}
Remove an app's membership in a specific group
GET
/sys/v1/apps/{app_id}/groups/{group_id}
Get an app's group membership
PATCH
/sys/v1/apps/{app_id}/groups/{group_id}
Update an app's particular group membership
GET
/sys/v1/apps/{app_id}/credential
Get an application's credential.
GET
/sys/v1/apps/client_configs
Get configurations for various clients. This API can only be called by apps
POST
/sys/v1/apps/{app_id}/reset_secret
Regenerate API key.
Crypto 24
POST
/crypto/v1/agree
Agree on a key from two other keys.
POST
/crypto/v1/keys/batch/decrypt
Batch decrypt with one or more keys.
POST
/crypto/v1/keys/batch/encrypt
Batch encrypt with one or more keys.
POST
/crypto/v1/keys/batch/sign
Batch sign with one or more private keys.
POST
/crypto/v1/keys/batch/verify
Batch verify with one or more public keys.
POST
/crypto/v1/digest
Compute digest (hash) of data.
POST
/crypto/v1/decapsulate
Decrypt an encapsulated key with this Sobject, obtaining a new symmetric key in the target group.
POST
/crypto/v1/decrypt
Decrypt data using a symmetric or asymmetric key.
POST
/crypto/v1/decrypt/final
Conclude multi-part decryption. See /crypto/v1/decrypt/init for more details.
POST
/crypto/v1/decrypt/init
Begin multi-part decryption.
POST
/crypto/v1/decrypt/update
Continue multi-part decryption. See /crypto/v1/decrypt/init for more details.
POST
/crypto/v1/derive
Derive a new key from an existing key.
POST
/crypto/v1/encapsulate
Obtain a new symmetric key and its encapsulated version from this Sobject.
POST
/crypto/v1/encrypt
Encrypt data using a symmetric or asymmetric key.
POST
/crypto/v1/encrypt/final
Conclude multi-part encryption. See /crypto/v1/encrypt/init for more details.
POST
/crypto/v1/encrypt/init
Begin multi-part encryption.
POST
/crypto/v1/encrypt/update
Continue multi-part encryption. See /crypto/v1/encrypt/init for more details.
POST
/crypto/v1/mac
Compute a message authentication code (HMAC or CMAC). The key being used should have the MACGENERATE key operation.
POST
/crypto/v1/macverify
Verify the input MAC. The key used must have the MACVERIFY key operation.
POST
/crypto/v1/sign
Sign with a private key. The key must be asymmetric and have the SIGN key operation enabled.
POST
/crypto/v1/transform
Transform an existing key into a new one.
POST
/crypto/v1/unwrapkey
Unwrap a security object with another security object.
POST
/crypto/v1/verify
Verify a signature with a public key. The verifying key must be an asymmetric key with the VERIFY key operation enabled.
POST
/crypto/v1/wrapkey
Wrap a security object with another security object.
Approval_requests 8
POST
/sys/v1/approval_requests/{req_id}/approve
Approve an approval request.
POST
/sys/v1/approval_requests
Create a new approval request.
GET
/sys/v1/approval_requests
Get all approval requests.
DELETE
/sys/v1/approval_requests/{req_id}
Delete an approval request.
GET
/sys/v1/approval_requests/{req_id}
Lookup a specific approval request.
POST
/sys/v1/approval_requests/{req_id}/deny
Deny an approval request.
POST
/sys/v1/approval_requests/{req_id}/result
Get the result for an approved or failed request.
POST
/sys/v1/approval_requests/{req_id}/challenge
Creates a challenge for the FIDO2/U2F device to sign.
Groups 14
POST
/sys/v1/groups/{group_id}/hmg/scans
Scan external objects asynchronously.
GET
/sys/v1/groups/{group_id}/hmg/scans
Retrieve the scan status of an external group.
POST
/sys/v1/groups/{group_id}/hmg/check
Check that the HMG configuration for a particular group is valid and reachable.
POST
/sys/v1/groups/hmg/check
Check that the HMG configuration provided is valid and reachable.
POST
/sys/v1/groups
Create a new group with the specified properties.
GET
/sys/v1/groups
Get all groups accessible to the requester.
DELETE
/sys/v1/groups/{group_id}
Delete the group.
GET
/sys/v1/groups/{group_id}
Lookup a specific group.
PATCH
/sys/v1/groups/{group_id}
Change a group's properties.
POST
/sys/v1/groups/hmg/gcp_key_rings
Given an GCP configuration, fetch a list of available GCP key rings which can be used to back a group.
GET
/sys/v1/groups/{group_id}/hmg/scans/{scan_id}
Query the status of a particular scan. Only the last five completed scans,as well as any in-progress scan, is queryable.
POST
/sys/v1/groups/hmg/azure_vaults
Given an Azure configuration, fetch a list of available Azure key vaults which can be used to back a group.
POST
/sys/v1/groups/hmg/scan_collections
Using the chosen credential, list the key collections available.
POST
/sys/v1/groups/{group_id}/hmg/scan
Scan external objects.
Session 11
POST
/sys/v1/session/auth/discover
Returns the available auth methods for the given user email. Example: password, ldap, oauth, etc.
POST
/sys/v1/session/auth
Create a session for a user or an app.
POST
/sys/v1/session/config_2fa/auth
Unlock two factor configuration.
POST
/sys/v1/session/config_2fa/terminate
Lock two factor configuration.
POST
/sys/v1/session/reauth
Create a new session for an App using an existing session bearer token.
POST
/sys/v1/session/auth/2fa/recovery_code
Use a backup recovery code to complete authentication.
POST
/sys/v1/session/refresh
Perform a no-op to keep session from expiring.
POST
/sys/v1/session/select_account
Select one of user's account to proceed. Even if the user has only one account, this needs to be called.
POST
/sys/v1/session/aws_temporary_credentials
This sets AWS temporary credentials in the session so that calls to AWS backed groups use these credentials. https://docs.aws.amazon.com/IAM/latest/UserGuide/idcredentialstemp.html
POST
/sys/v1/session/terminate
Terminate the current session.
POST
/sys/v1/session/auth/2fa/u2f
Use of U2F is deprecated, this endpoint will return BadRequest.
Batch 1
POST
/batch/v1
Create a new batch request
Users 19
POST
/sys/v1/users/change_password
Change user's password.
POST
/sys/v1/users/{user_id}/confirm_email
Confirms user's email address.
DELETE
/sys/v1/users/{user_id}
Delete a stale user (for sysadmins).
GET
/sys/v1/users/{user_id}
Lookup a user.
PATCH
/sys/v1/users/{user_id}
Change a user's properties like firstname, lastname, description, etc.
DELETE
/sys/v1/users
Delete the currently logged-in user.
GET
/sys/v1/users
Get all users accessible to the requester.
POST
/sys/v1/users
Create a new user with the given properties.
DELETE
/sys/v1/users/{user_id}/accounts
Remove user's association with an account.
POST
/sys/v1/users/forgot_password
Initiate password reset sequence for a user.
POST
/sys/v1/users/generate_recovery_codes
Generate recovery codes for two factor authentication.
GET
/sys/v1/users/accounts
Get user's accounts.
GET
/sys/v1/users/permissions
Returns the caller's permissions
POST
/sys/v1/users/invite
Invite an existing user or new user to join an existing account.
POST
/sys/v1/users/process_invite
Accept or reject pending account invitations.
POST
/sys/v1/users/resend_confirm_email
Resend email with link to confirm user's email address.
POST
/sys/v1/users/{user_id}/resend_invite
Resend invite to the user to join a specific account.
POST
/sys/v1/users/{user_id}/reset_password
Reset a user's password. Requires a valid password reset token.
POST
/sys/v1/users/{user_id}/validate_token
Validates password reset token for the user.
Fido 2
POST
/sys/v1/session/auth/2fa/fido2
Completes a pending authentication using a FIDO2 key.
POST
/sys/v1/session/config_2fa/new_challenge
Get credential creation options as per the given request.
Account_extensions 3
PUT
/sys/v1/account_extensions/{acct_id}
Create a new account extension.
GET
/sys/v1/account_extensions/{acct_id}
Get info for a specific account extension.
PATCH
/sys/v1/account_extensions/{acct_id}
Update specific account extension.
Credentials 6
POST
/sys/v1/credentials
Create a new integration credential
GET
/sys/v1/credentials
Get all credentials accessible to the requester
DELETE
/sys/v1/credentials/{cred_id}
Delete a credential by id
GET
/sys/v1/credentials/{cred_id}
Get a credential specified by id
PATCH
/sys/v1/credentials/{cred_id}
Update a credential object
POST
/sys/v1/credentials/{cred_id}/rotate
Rotate a specified credential
External_roles 6
POST
/sys/v1/external_roles
Create a new external role.
GET
/sys/v1/external_roles
Get all external roles.
DELETE
/sys/v1/external_roles/{external_role_id}
Delete an external role.
GET
/sys/v1/external_roles/{external_role_id}
Lookup a particular external role by its ID.
PATCH
/sys/v1/external_roles/{external_role_id}
Update an external role.
POST
/sys/v1/external_roles/{external_role_id}/sync
Synchronize information about the external role by retrieving it from external source.
Plugins 6
POST
/sys/v1/plugins
Create a new plugin.
GET
/sys/v1/plugins
Get details of all plugins accessible to the requester.
DELETE
/sys/v1/plugins/{plugin_id}
Delete a plugin.
GET
/sys/v1/plugins/{plugin_id}
Lookup a plugin.
POST
/sys/v1/plugins/{plugin_id}
Invokes a plugin execution with the provided request body as input to the plugin.
PATCH
/sys/v1/plugins/{plugin_id}
Change a plugin's properties, such as name, description, code, group membership, etc.
Roles 5
POST
/sys/v1/roles
Create a new role.
GET
/sys/v1/roles
Get all roles.
DELETE
/sys/v1/roles/{custom_role_id}
Delete a role.
GET
/sys/v1/roles/{custom_role_id}
Lookup a role.
PATCH
/sys/v1/roles/{custom_role_id}
Update a role given by the input ID.
Logs 1
GET
/sys/v1/logs
Get all logs visible to the requester.
Misc 9
GET
/sys/v1/services
Check information about all connected services
GET
/sys/v1/health
Check whether the server is handling requests
GET
/sys/v1/services/{name}
Check information about the specified service
POST
/sys/v1/ldap/search/{ldap_id}
Searches for LDAP objects in the specified LDAP directory.
GET
/saml/metadata.xml
Get the SP metadata file for SAML configuration
GET
/sys/v1/info
Returns info about the system.
POST
/sys/v1/ldap/test
Test connection using the ldap SSO configuration saved in the account.
GET
/sys/v1/tls_certificates
Returns all TLS Certs SPKIs of the DSM endpoints Deprecated(legacy), please use API "/sys/v1/tlspublickeys" instead
GET
/sys/v1/tls_public_keys
Returns all TLS Certs SPKIs of the DSM endpoints
Stats 5
GET
/sys/v1/stats/apps
Get app aggregate transaction statistics.
GET
/sys/v1/stats/{app_id}/app
Get transaction statistics for a specific application.
GET
/sys/v1/stats/groups
Get group aggregate transaction statistics.
GET
/sys/v1/stats/{group_id}/group
Get transaction statistics for a specific group.
GET
/sys/v1/stats/{key_id}/key
Get transaction statistics for a specific security object.
Marketplace 1
GET
/sys/v1/marketplace
Gets all the plugins from the input url.
Version 1
GET
/sys/v1/version
Returns information about the DSM server version and the client API version that it supports.
Schemas 741
The contract defines 741 schemas that model the data the API accepts and returns. The most detailed is ApprovableResult (2 properties). Each schema is shown below with its type and property counts.
Account
AccountApprovalPolicy
AccountExtension
AccountExtensionCreateRequest
AccountExtensionRequest
AccountPermissions
string
MANAGELOGGING: Permission to manage logging integrations, and enable/disable error logging. MANAGEAUTH: Permission to manage SSO and password policy. MANAGEWOR…
AccountPurpose
Describes the purpose of the account.
AccountPurposeVariantStandard
AccountPurposeVariantAccountReplication
AccountPurposeType
The purpose of the account (minus any configuration-related details).
AccountPurposeTypeVariantStandard
AccountPurposeTypeVariantAccountReplication
AccountReplicationConfiguration
AccountReplicationConnection
AccountReplicationScanSettings
AccountRequest
AccountRole
AccountSort
ActionType
string
AesOptions
AesOptionsPolicy
AgreeKeyMechanism
string
Options to use for key agreement mechanism.
AgreeKeyRequest
Algorithm
string
A cryptographic algorithm.
All
string
A helper enum with a single variant, All, which indicates that something should apply to an entire part. (This is here mainly to allow other untagged enums to…
ApiPath
App
AppAccountMembership
AppAccountRole
string
AppAccountRoleDescriptor
AppAccountRoleDescriptorVariantSystemDefined
AppAccountRoleDescriptorVariantCustom
AppAuthType
AppAuthTypeVariants
AppCredential
AppCredentialRequest
AppCredentialResponse
AppCreditsUsage
AppGroupMembership
AppGroupRole
string
AppGroupRoleDescriptor
AppGroupRoleDescriptorVariantSystemDefined
AppGroupRoleDescriptorVariantCustom
AppOauthConfigEnabled
AppOauthConfig
OAuth settings for an app. If enabled, an app can request to act on behalf of a user.
AppOauthConfigVariantEnabled
AppOauthConfigVariantDisabled
AppPermissions
string
Operations allowed to be performed by an app. SIGN: VERIFY: ENCRYPT: DECRYPT: WRAPKEY: UNWRAPKEY: DERIVEKEY: MACGENERATE: MACVERIFY: EXPORT: MANAGE: AGREEKEY:…
AppRequest
AppResetSecretRequest
AppRole
string
App's role.
AppSort
ApprovalAuthConfig
ApprovalRequest
ApprovalRequestRequest
ApprovalRequestSettings
ApprovalRequestSettingsRequest
ApprovalStatus
string
Approval request status.
ApprovalSubject
Identifies an object acted upon by an approval request.
ApprovalWaitConfig
ApproveRequest
AriaOptions
AriaOptionsPolicy
AttestationConveyancePreference
string
If you really want to understand attestation, read the following: This enum just specified how the attestation should be conveyed to the RP. You can see doc of…
AuthConfig
AuthConfigLdap
AuthConfigOauth
AuthConfigPassword
AuthConfigSignedJwt
AuthConfigVcd
AuthDiscoverParams
AuthDiscoverRequest
AuthMethodSamlPost
AuthMethodOauthAuthCodeGrant
AuthMethodLdapPassword
AuthMethodVcd
AuthMethod
AuthMethodVariantPassword
AuthMethodVariantSamlPost
AuthMethodVariantOauthAuthCodeGrant
AuthMethodVariantLdapPassword
AuthMethodVariantVcd
AuthRequest
AuthRequestMethodSamlResponse
AuthRequestMethodLdapBasicAuth
AuthRequestMethodAuthByAppName
AuthRequestMethodAwsIam
AuthRequestMethodPassword
AuthRequestMethod
AuthRequestMethodVariantSamlResponse
AuthRequestMethodVariantOauthAuthCode
AuthRequestMethodVariantLdapBasicAuth
AuthRequestMethodVariantAuthByAppName
AuthRequestMethodVariantAwsIam
AuthRequestMethodVariantPassword
AuthResponse
AuthenticationExtensionsClientInputs
AuthenticationExtensionsClientOutputs
AuthenticatorAssertionResponse
AuthenticatorAttachment
string
AuthenticatorAttestationResponse
AuthenticatorSelectionCriteria
AuthenticatorTransport
Hints by relying party on how client should communicate with the authenticator. https://www.w3.org/TR/webauthn-2/enum-transport
AuthenticatorTransportInner
string
See [AuthenticatorTransport] type.
AutoScanSettings
AwsKeyMaterialId
AwsKeyOrigin
string
Origin of the AWS KMS key. See the [AWS documentation](https://docs.aws.amazon.com/kms/latest/APIReference/APIKeyMetadata.htmlKMS-Type-KeyMetadata-Origin) for…
AwsKeyRotationStatusKeyRotationEnabled
AwsKeyRotationStatus
AwsKeyRotationStatusVariantKeyRotationDisabled
AwsKeyRotationStatusVariantKeyRotationEnabled
AwsKmsInfo
AwsKmsKeyMaterialMapping
string
AwsMultiRegionInfo
AwsMultiRegionKeyType
string
Specifies the type of multi-Region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.htmlmulti-region-concepts
AwsTemporaryCredentials
AwsXksCredential
AwsXksCredentialRequest
AwskmsService
string
Specifies the AWS service. Only kms is supported for now.
AzureAuthConfigClientSecret
AzureAuthConfigTokenAuthConfig
AzureAuthConfig
AzureAuthConfigVariantClientSecret
AzureAuthConfigVariantTokenAuthConfig
AzureCredentialAuthClientSecret
AzureCredentialAuthCertificate
AzureCredentialAuth
Authentication configuration for Azure integrations that use Credential Objects.
AzureCredentialAuthVariantClientSecret
AzureCredentialAuthVariantCertificate
AzureKeyVaultType
string
Types of Azure Key Vault based on the protection level.
AzureLogAnalyticsLoggingConfig
AzureLogAnalyticsLoggingConfigRequest
AzureLogIngestionLoggingConfig
AzureLogIngestionLoggingConfigRequest
AzureServiceEndpoints
BatchDecryptRequestItem
BatchEncryptRequestItem
BatchExecutionType
string
BatchRequest
BatchRequestItem
BatchRequestList
BatchResponse
BatchResponseList
BatchResponseObjectResult
BatchResponseObjectSkipped
BatchResponseObject
BindToPrincipal
A security principal that a session can be bound to. Eg: When app-1 creates a session that can be validated against app-2's credentials, app-1 specifies app-2'…
Bip32Network
string
The BIP32 network The Testnet network is usually an actual network with nodes and miners, and free cryptocurrency. This provides a testing environment for deve…
Bip32Options
Bip32OptionsPolicy
BlsOptions
BlsOptionsPolicy
BlsVariant
string
Signature/public-key size trade-off for BLS.
CaConfig
CA settings.
CaSet
string
Predefined CA sets.
CertificateOptionsPolicy
CertificateReplicationCredential
CheckHmgRequest
CipherMode
string
Cipher mode used for symmetric key algorithms.
ClientConfigurations
ClientConfigurationsRequest
ClientFileLogging
ClientFileLoggingVariantEnabled
ClientFileLoggingVariantDisabled
ClientFileLoggingConfig
ClientLogConfig
CollectionMetadata
CommonClientConfig
Config2faAuthRequest
Config2faAuthResponse
ConfirmEmailRequest
ConfirmEmailResponse
CopySobjectRequest
CountAccuracy
An indicator of how accurate a count of objects is.
CountAccuracyVariantExact
CountAccuracyVariantApproximate
CountParams
CreateGroupMembership
CreateReplicationCredentialRequest
A request to create a new admin app credential for account replication purposes. Note that the result is not immediately usable; further steps are needed in or…
CreateReplicationCredentialRequestVariantCertificate
CredentialDetails
Describes the authentication type for a given integration. This type is the "backbone" to the credential objects in DSM as it's what contains the relevant info…
CredentialDetailsVariantOci
CredentialDetailsVariantAzure
CredentialId
A wrapper type to provide better clarity that the id referenced is an integration credential object.
CredentialSort
CryptMode
CipherMode or RsaEncryptionPadding, depending on the encryption algorithm.
CryptographicPolicy
CustomAttributeSearchMetadata
CustomSubscriptionType
DaysAhead
DecapsulateKeyRequest
DecryptFinalRequest
DecryptFinalResponse
DecryptInitRequest
DecryptInitResponse
DecryptRequest
DecryptResponse
DecryptUpdateRequest
DecryptUpdateResponse
DenyRequest
DeriveKeyMechanismBip32MasterKey
DeriveKeyMechanismBip32HardenedChild
DeriveKeyMechanismSlip10HardenedChild
DeriveKeyMechanismHkdf
DeriveKeyMechanism
Mechanism to be used when deriving a new key from an existing key.
DeriveKeyRequest
Des3Options
Des3OptionsPolicy
DesOptions
DesOptionsPolicy
DigestAlgorithm
string
A hash algorithm.
DigestRequest
DigestResponse
DsaOptions
DsaOptionsPolicy
EcKcdsaOptions
EcKcdsaOptionsPolicy
EcOptionsPolicy
EffectiveKeyOperations
string
Operations allowed to be performed on a given key by a given User or an app SIGN: If this is set, the key can be used for signing. VERIFY: If this is set, the…
EffectiveKeyPolicy
EllipticCurve
string
Identifies a standardized elliptic curve.
EncapsulateKeyRequest
EncapsulateKeyResponse
EncryptFinalRequest
EncryptFinalResponse
EncryptInitRequest
EncryptInitResponse
EncryptRequest
EncryptResponse
EncryptUpdateRequest
EncryptUpdateResponse
EsAuditLog
EsAuditLogOuter
EsAuditQueryResponse
EsCountStatsLog
EsStatsCountQueryResponse
EsTotalTxn
ExportComponentsResponse
ExportPolicyWrapped
ExportPolicy
ExportPolicyVariantWrapped
ExportPolicyVariantUnrestricted
ExportSobjectComponentsRequest
ExternalEntropyInfo
ExternalEntropySourceInfo
ExternalKeyIdPkcs11
ExternalKeyIdFortanix
ExternalKeyIdAzureKeyVault
ExternalKeyIdGcpKeyRing
ExternalKeyIdOciVault
ExternalKeyId
Identification information for an external key. There are multiple variants of this type to represent the different kinds of keys DSM supports (e.g., AWS, Azur…
ExternalKeyIdAwsKms
ExternalKmsInfo
Information about a specific external KMS key object.
ExternalKmsInfoVariantAWS
ExternalKmsInfoVariantOci
ExternalRole
ExternalRoleKind
string
Type of an external role.
ExternalRoleMapping
ExternalRoleRequest
ExternalSobjectInfo
Fido2MfaChallengeResponse
Fido2 options when requesting assertion or attestation to a device
FidoAddDeviceRequest
ForgotPasswordRequest
FpeCharSet
The alphabet to use for an encrypted portion of a complex tokenization data type. Characters should be specified as a list of pairs, where each pair [a, b] rep…
FpeChecksum
string
FpeCode
FpeCompoundPartOr
FpeCompoundPartConcat
FpeCompoundPartMultiple
FpeCompoundPart
Structure of a compound portion of a complex tokenization data type, itself composed of smaller parts.
FpeConstraints
FpeConstraintsApplicability
A structure indicating which subparts to which to apply a set of constraints.
FpeDataPartLiteral
FpeDataPart
Structure for specifying (part of) a complex tokenization data type.
FpeDateDayMonthYear
FpeDateMonthDay
FpeDateMonthYear
FpeDate
A structure for specifying a token part representing a date that occurs after a specified date and/or occurs before a specified date. Depending on the subparts…
FpeDateConstraint
Possible date-related constraint types for a portion of a complex tokenization data type.
FpeDatePart
string
Possible date-related constraint types that do not form a complete date (by themselves) for a complex tokenization data type.
FpeDayMonthDate
FpeDayMonthYearDate
FpeEncryptedPart
FpeFormatV2
FpeGroup
FpeInputDefaultProcessing
string
FpeInputProcessingPassthroughSpecific
FpeInputProcessing
Options to apply some pre- and post-processing to the input.
FpeMonthYearDate
FpeOptionsAdvanced
FpeOptionsV2
FpeOptions
FPE-specific options (for specifying the format of the data to be encrypted)
FpeOptionsBasic
FpePreserveMask
A structure indicating which indices in an encrypted part to mask or preserve.
FpeSection
FpeTokenizeMode
string
How to tokenize a given input. The most secure option is "PreserveFormat".
FpeVariant
FpeWordsIntegerRanges
FpeWordsCustom
FpeWords
A set of fixed-length strings.
FreemiumSubscriptionType
GcpAppPermissions
string
CRYPTOSPACEGETINFO: CRYPTOSPACEGETPUBLICKEY:
GcpKeyRingConfig
GetAccountParams
GetAllHmgScansResponse
GetAllServicesResponse
GetAppGroupMemberships
GetAppParams
GetGroupsParams
GetMarketplaceParams
GetSobjectParams
GetUsageResponse
GetUserParams
GetUserPermissionsParams
GetUserPermissionsResponse
GoogleAccessReason
string
An access reason provided by Google when making EKMS API calls.
GoogleAccessReasonPolicy
GoogleServiceAccountCredential
GoogleServiceAccountKey
Group
GroupApprovalPolicy
GroupMembershipRequest
GroupMetaData
GroupPermissions
string
CREATEGROUPAPPROVALPOLICY: Permission to create group-level approval policy. Note that updating/deleting the approval policy is protected by the approval polic…
GroupRequest
GroupRole
GroupSort
HealthCheckInfo
HealthParams
HealthStatus
string
HistoryItem
HistoryItemState
HmacOptionsPolicy
HmgConfigNcipher
HmgConfigSafenet
HmgConfigAwsCloudHsm
HmgConfigAwsKms
HmgConfigFortanix
HmgConfigFortanixFipsCluster
HmgConfigAzureKeyVault
HmgConfigOciVault
HmgConfig
HmgConfigVariantNcipher
HmgConfigVariantSafenet
HmgConfigVariantAwsCloudHsm
HmgConfigVariantAwsKms
HmgConfigVariantFortanix
HmgConfigVariantFortanixFipsCluster
HmgConfigVariantAzureKeyVault
HmgConfigVariantOciVault
HmgConfigVariantGcpKeyRing
HmgListKeyCollectionsRequest
HmgListKeyCollectionsRequestVariantOciVault
HmgListKeyCollectionsResponseOciKeyVault
HmgListKeyCollectionsResponse
HmgListKeyCollectionsResponseVariantOciKeyVault
HmgRedundancyScheme
string
The scheme for determining how multiple HmgConfigs on a group should behave. If not specified, the backend will go through the list in random order, and use th…
HostnameInfo
ImportSobjectComponentsRequest
InnerEsBucket
IntegrationCredential
IntegrationCredentialCreateRequest
IntegrationCredentialRotationRequest
IntegrationCredentialUpdateRequest
IpAddressPolicy
The IPs that are allowed for an application. ipv4 or ipv6 both are acceptable types.
KcdsaOptions
KcdsaOptionsPolicy
KcvMethod
string
Methods for calculating a Key Checksum Value.
KeyAttestationRequest
KeyAttestationResponse
KeyAttestationStatement
KeyAttestationStatementFormat
string
KeyCheckValueRequest
KeyCheckValueResponse
KeyCreationMethod
Information about the method by which a key was created
KeyCreationMethodVariantGenerate
KeyCreationMethodVariantAgree
KeyCreationMethodVariantTransform
KeyCreationMethodVariantDerive
KeyCreationMethodVariantUnwrap
KeyCreationMethodVariantImport
KeyCreationMethodVariantEncapsulate
KeyCreationMethodVariantDecapsulate
KeyExpiryAlertConfig
KeyExpiryAlertConfigRequest
KeyExpiryAlertSiemToolConfig
KeyExpiryAlertTrigger
KeyExpiryAlertTriggerVariantDaysAhead
KeyFormat
string
Key Format
KeyHistoryPolicy
KeyLinks
KeyMetadataPolicy
KeyOperations
string
Operations allowed to be performed on a given key. SIGN: If this is set, the key can be used to for signing. VERIFY: If this is set, the key can used for verif…
KeyOpsOverride
KeyVault
KmipClientConfig
Language
string
Language of plugin code.
LastAppOperationTimestamp
LdapAccountRole
Role of a user or app in an account for the purpose of LDAP configurations.
LdapAuthorizationConfig
LdapDnResolutionConstruct
LdapDnResolution
Distinguished Name (DN) resolution method. Given a user's email address, a DN resolution method is used to find the user's DN in an LDAP directory.
LdapDnResolutionVariantConstruct
LdapDnResolutionVariantSearchByMail
LdapDnResolutionVariantUserPrincipalName
LdapPrincipalUnresolved
LdapPrincipalResolved
LdapPrincipal
LdapRoleConflictResolution
string
Controls how we resolve conflicting role assignments with LDAP authorization. When users are authorized through LDAP, their DSM group memberships are determine…
LdapSearchFilter
LdapSearchRequest
LdapSearchResultEntry
LdapSearchScope
string
LdapServiceAccount
LdapTestCredentials
LdapTestRequest
LdapUserSelfProvisioningConfig
LdapUserSelfProvisioningRoleFixed
LdapUserSelfProvisioningRole
A structure indicating how self-provisioned LDAP users will be assigned account roles.
LdapUserSelfProvisioningRoleVariantFixed
LegacyKeyPolicy
string
LegacyLdapAccountRole
string
Role of a user or app in an account for the purpose of LDAP configurations.
LegacyUserAccountRole
string
Legacy user account role
LegacyUserGroupRole
string
Legacy user group role
LegacyUserGroupRoleOrRoleId
Legacy user group role name or custom role id
ListApprovalRequestsParams
ListAppsParams
ListAppsResponseWithMetadata
ListAppsResponse
The response of the get all apps API
ListCredentialsMetadata
ListCredentialsParams
ListCredentialsResponse
ListExternalRolesParams
ListGroupsResponseWithMetadata
ListGroupsResponse
The response of the get all groups API
ListOciVaultsRequest
ListPluginsParams
ListReplicationCredentialsResponse
ListRolesParams
ListRolesResponse
ListSobjectsParams
ListUsersParams
LmsOptions
LmsOptionsPolicy
LoggingConfig
LoggingConfigRequest
LogsParams
MacRequest
MacResponse
MarketplacePlugin
Metadata
MetadataDurationConstraintRequired
MetadataDurationConstraint
MetadataPolicyItem
MetadataStringConstraintRequired
MetadataStringConstraint
MfaAuthMethodFido2
MfaAuthMethod
MfaChallengeParams
MfaChallengeResponse
MfaDelDeviceRequest
MfaDevice
MfaDeviceType
string
Type of MFA device
MfaProtocol
string
Protocols for MFA.
MfaRenameDeviceRequest
MgfMgf1
Mgf
Specifies the Mask Generating Function (MGF) to use.
MgfPolicyMgf1
MgfPolicy
MGF policy.
MlDsaMode
MlDsaModeVariantPure
MlDsaModeVariantPreHash
MlDsaModeVariantExternalMu
MlDsaOptions
MlDsaOptionsPolicy
MlDsaParamSet
string
ML-DSA parameter sets
MlKemOptions
MlKemOptionsPolicy
MlKemParamSet
string
ML-KEM parameter sets
NotificationPref
string
Notification preferences.
OauthAuthParamDisplay
string
Corresponds to the display parameter in https://openid.net/specs/openid-connect-core-10.htmlAuthRequest
OauthAuthParamPrompt
string
Corresponds to the prompt parameter in https://openid.net/specs/openid-connect-core-10.htmlAuthRequest
OauthAuthenticationParameters
OauthCodeData
OauthScope
string
OAuth scope.
ObjectCount
ObjectCounts
ObjectDigestRequest
ObjectDigestResponse
ObjectOrigin
string
The origin of a security object - where it was created / generated.
ObjectType
string
Type of security object.
ObjectTypeFilterSelection
ObjectTypeFilter
ObjectTypeFilterVariantAll
ObjectTypeFilterVariantSelection
OciCredentialAuthApiKey
OciCredentialAuth
OciCredentialAuthVariantApiKey
OciKeyVault
OciVaultInfo
OnPremSubscriptionType
OneAppAuthType
string
Authentication method of an app.
OneAppCredential
App authentication mechanisms.
OneAppCredentialRequest
OpaqueOptionsPolicy
OuterEsBucket
PasswordChangeRequest
PasswordResetRequest
PersistTransientKeyRequest
Pkcs11ClientConfig
Plugin
PluginCodeSigningPolicy
PluginRequest
PluginSort
PluginSourceFromRepo
PluginSourceInline
PluginSource
Plugin code that will be executed inside SGX enclave.
PluginSourceRequestFromRepo
PluginSourceRequestInline
PluginSourceRequest
PluginType
string
Type of a plugin.
PolicyDefinitionRego
PolicyDefinition
PolicyDefinitionVariantRego
PreviousCredential
PrincipalUserViaApp
Principal
A security principal.
PrivateClaimsPolicy
ProcessInviteRequest
PublicKeyCredentialCreationOptions
PublicKeyCredentialDescriptor
PublicKeyCredentialParameters
PublicKeyCredentialRequestOptions
PublicKeyCredentialRpEntity
PublicKeyCredentialType
string
https://www.w3.org/TR/webauthn-2/enum-credentialType This enum defines valid cred types.
PublicKeyCredentialUserEntity
PublishPublicKeyConfigEnabled
PublishPublicKeyConfig
If enabled, the public key will be available publicly (without authentication) through the GetPublicKey API.
PublishPublicKeyConfigVariantEnabled
PublishPublicKeyConfigVariantDisabled
Quorum
QuorumApprovalConfig
QuorumGroupPermissions
string
Subset of GroupPermissions to represent GroupPermissions flags in use GETSOBJECTS: ROTATESOBJECTS: REVOKESOBJECTS: REVERTSOBJECTS: DELETEKEYMATERIAL: DELETESOB…
QuorumPolicy
RecentScanSummary
RecoveryCodeAuthRequest
RecoveryCodes
ReplicationCredential
Details about the admin app credential used to replicate objects from the source account.
ReplicationCredentialVariantCertificate
ReplicationCredentialId
The ID of a replication credential.
ReplicationCredentialSelfSignedCertRequest
ReplicationCredentialSelfSignedCertResponse
ReplicationScan
ResellerSubscriptionType
ResidentKeyRequirement
string
Tells Relying Party's requirement about client side discoverable creds (formely known as resident keys). If client side discoverable creds are there, it means…
RestrictedDuration
RevertRequest
Reviewer
ReviewerPrincipal
A Principal who can approve or deny an approval request.
RevocationReason
RevocationReasonCode
string
Reasons to revoke a security object.
Role
RoleDetails
RoleDetailsVariantAccount
RoleDetailsVariantGroup
RoleKind
string
RoleRequest
RoleSort
RotateCopiedKeys
RotationInterval
RotationMethod
Describes the how to rotate the credential and any additional information that is required for that to happen successfully.
RotationMethodVariantGenerate
RotationPolicy
RsaEncryptionPaddingOaep
RsaEncryptionPadding
Type of padding to use for RSA encryption. The use of PKCS1 v1.5 padding is strongly discouraged, because of its susceptibility to Bleichenbacher's attack. The…
RsaEncryptionPaddingPolicyOaep
RsaEncryptionPaddingPolicy
RSA encryption padding policy.
RsaEncryptionPolicy
RsaOptions
RsaOptionsPolicy
RsaSignaturePaddingPss
RsaSignaturePadding
Type of padding to use for RSA signatures. The padding specified must adhere to the key's signature policy. If not specified, the default based on the key's po…
RsaSignaturePaddingPolicyPss
RsaSignaturePaddingPolicy
RSA signature padding policy.
RsaSignaturePolicy
Scan
ScanHmgRequest
ScanResultFailed
ScanResult
The result of a scan.
ScanResultVariantSuccess
ScanResultVariantFailed
ScanWarning
SecretCredentialRequestGenerate
SecretCredentialRequest
SecretOptionsPolicy
Secs
SeedOptions
SeedOptionsPolicy
SelectAccountRequest
SelectAccountResponse
ServerMode
string
Server execution mode.
Service
SeverityLevel
string
SignRequest
SignResponse
SignatureMode
Signature mechanism
SignedJwtCredential
SigningKeysStored
SigningKeysFetched
SigningKeys
Signing keys used to validate JSON Web Signature objects including signed JSON Web Tokens.
SigningKeysVariantStored
SigningKeysVariantFetched
SignupRequest
Slip10Options
Slip10OptionsPolicy
Sobject
SobjectComponent
SobjectDescriptorInline
SobjectDescriptor
Uniquely identifies a persisted or transient sobject.
SobjectDescriptorPersisted
Uniquely identifies a persisted sobject.
SobjectEncoding
string
Response data encoding.
SobjectExportPolicy
SobjectId
A wrapper type to provide better clarity that the id referenced is a security object.
SobjectRekeyRequest
SobjectReplaceRequest
SobjectRequest
SobjectSort
SobjectState
string
Security object operational state.
SplittingMethod
string
Method used to split the key into multiple components.
SplunkLoggingConfig
SplunkLoggingConfigRequest
StackdriverLoggingConfig
StackdriverLoggingConfigRequest
StatsParams
SubjectGeneral
A GeneralName that can be used as a [subject alternative name][SAN] in a certificate. Today, the directoryName, dNSName, and iPAddress choices are supported. N…
Subscription
SubscriptionChangeRequest
SubscriptionExperimentalFeatures
SubscriptionFeatures
string
Features in subscription TOKENIZATION: HMG: AWSBYOK: AZUREBYOK: GCPBYOK: GCPEKMCONTROLPLANE: OCIBYOK:
SubscriptionTypeTrial
SubscriptionType
Type of subscription.
SyslogFacility
string
SyslogLoggingConfig
SyslogLoggingConfigRequest
SystemInfoParams
SystemInfoResponse
TepClientConfig
TepKeyContext
string
TepKeyMap
TepKeyMapList
TepSchema
TepSchemaVariantOpenAPI
TimeSpan
TlsCertificateSpki
TlsCertsSpkiResponse
TlsConfigRequired
TlsConfig
TLS client settings.
TlsConfigVariantDisabled
TlsConfigVariantOpportunistic
TlsConfigVariantRequired
TlsPublicKeyInfo
TlsPublicKeysResponse
TokenType
string
The type of a session token. (The default session token type is Bearer.)
TransformKeyMechanismBip32WeakChild
TransformKeyMechanismSlip10WeakChild
TransformKeyMechanism
Options for mechanism to be used when transforming a key
TransformKeyRequest
TrustAnchor
Trust anchors (i.e., root CA certificates) for a [TrustedCaCredential].
TrustAnchorSubject
Subjects or subject alternative names (SANs) for trusted CA auth. DSM will check the subject field and any SANs inside incoming client certificates and compare…
TrustedCaCredential
U2fAddDeviceRequest
U2fAuthRequest
U2fMfaChallengeResponse
U2fRegisteredKey
UniqueOperationsCount
UnwrapKeyParams
UnwrapKeyRequest
UpdateCertificateReplicationCredentialRequest
UpdateReplicationCredentialRequest
A request to update a replication credential (e.g., associating it with an app ID). Note that changing the credential from one type to another is disallowed; u…
UpdateReplicationCredentialRequestVariantCertificate
User
UserAccountFlag
string
User account flag
UserAccountFlagOrRole
User account flag or legacy user account role name or custom role id
UserAccountFlags
User's role(s) and state in an account.
UserGroupRole
User's role(s) in a group.
UserRequest
UserSort
UserVerificationRequirement
string
https://www.w3.org/TR/webauthn-2/enum-userVerificationRequirement https://www.w3.org/TR/webauthn-2/user-verification
ValidateTokenRequest
ValidateTokenResponse
VerifyKcvRequest
VerifyKcvResponse
VerifyMacRequest
VerifyRequest
VerifyResponse
VersionParams
VersionResponse
VirtualSobjectInfo
WithGroups
string
WorkspaceCseAuthMethod
string
Authentication method for Google Workspace CSE, User (default choice) requires each CSE user to be registered as a DSM user, while App requires each CSE user t…
WorkspaceCseAuthorizationProvider
WorkspaceCseConfig
WorkspaceCseIdentityProvider
WrapKeyParams
WrapKeyRequest
WrapKeyResponse
WrappingKeyName
WrappingKeysOnly
WrappingKeys
WrappingKeysVariantOnly
WrappingKeysVariantAny
XmssOptions
XmssOptionsPolicy
AppGroups
ApprovableResult
object
2 properties
2 required
Base64UrlSafe
string
BatchDecryptResponseItem
BatchEncryptResponseItem
BatchSignResponseItem
BatchVerifyResponseItem
COSEAlgorithmIdentifier
string
https://www.w3.org/TR/webauthn-2/typedefdef-cosealgorithmidentifier Signing algorithms from [IANA COSE Algorithms registry] that are supported on DSM side for…
CustomMetadata
object
ListSobjectsResponse
PluginOutput
string
PluginVersion
string
PublicKeyCredentialAuthenticatorAssertionResponse
PublicKeyCredentialAuthenticatorAttestationResponse
PublicKeyCredentialEntityForRp
PublicKeyCredentialEntityForUser
RemovableCommonClientConfig
RemovableCryptographicPolicy
RemovableGoogleAccessReasonPolicy
RemovableAutoScanSettings
RemovableKeyHistoryPolicy
RemovableKeyMetadataPolicy
RemovableKmipClientConfig
RemovablePkcs11ClientConfig
RemovablePluginCodeSigningPolicy
RemovableTepClientConfig
RemovableWorkspaceCseConfig
RemovableHmgRedundancyScheme
The HmgRedundancyScheme to set for the group. If unset, the backend will assign no particular meaning to the hsmorder fields of the group's HmgConfigs, and may…
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Fortanix 2
Other APIs Fortanix publishes across the network.
Fortanix Confidential Computing Manager REST API
Fortanix Armor and Key Insight API
#Key Management#Cryptography#HSM#Secrets Management#Encryption
Where this information came from
This is an independent, third-party profile of Fortanix Data Security Manager REST API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.