How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Fortanix

Fortanix Keys API

The Keys API from Fortanix — 20 operation(s) for keys.

Documentation Provider Profile APIs.io OpenAPI GitHub

Fortanix Keys API is one of 51 APIs that Fortanix publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Keys. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 23 operations across 20 paths, and defines 176 schemas. It is described by OpenAPI 3.2.0, at version 0.1.0-20260710.

Requests are made against a single base URL, {dsmEndpoint}.

23 operations 20 paths 176 schemas 2 DELETE2 GET1 PATCH16 POST2 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
0.1.0-20260710
Base URL
https://amer.smartkey.io
Authentication
HTTP Basic, API Key, HTTP Bearer
Contact
Fortanix Support
License
Apache 2.0
Terms of Service
View terms
Resource Areas
1

Authentication & Security 3

Fortanix Keys API declares 3 security schemes for authenticating requests. It accepts HTTP basic authentication (basicAuth). An API key is passed in the header as Authorization (apiKeyAuth). It accepts HTTP bearer tokens (JWT) (bearerToken).

  • apiKeyAuth — Please enter your token prefixed with 'Basic ' (e.g., 'Basic yourtokenhere')

Paths & Operations 23

Across 20 paths, the API surfaces 23 operations — 2 DELETE, 2 GET, 1 PATCH, 16 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.

Keys 23
POST
/crypto/v1/keys/{key_id}/activate
Transition a security object to Active state.
ActivateSobject 1 param → 204
POST
/crypto/v1/keys/copy
Make a copy of a security object.
CopySobject body → 2XX
POST
/crypto/v1/keys
Generate a new security object.
CreateSobject body → 2XX
PUT
/crypto/v1/keys
Import a security object.
ImportSobject body → 2XX
GET
/crypto/v1/keys
Get all security objects accessible to the requester.
ListSobjects 1 param → 2XX
DELETE
/crypto/v1/keys/{key_id}
Delete the specified security object.
DeleteSobject 1 param → 204
PATCH
/crypto/v1/keys/{key_id}
Update the properties of a security object like name, description, etc.
UpdateSobject 1 param body → 2XX
POST
/crypto/v1/keys/{key_id}/destroy
Transition a security object to Destroyed state. Objects in the Destroyed state cannot be used in any cryptographic operation. Their metadata however, remains accessible.
DestroySobject 1 param → 204
POST
/crypto/v1/keys/digest
Retrieve the digest (hash) of the value of an exportable security object.
DigestSobject body → 2XX
POST
/crypto/v1/keys/export
Get the details and value of a particular exportable security object.
ExportSobject body → 2XX
POST
/crypto/v1/keys/components/export
Exports the security object as components.
ExportSobjectComponents body → 2XX
POST
/crypto/v1/keys/kcv
Computes the KCV of the input and returns. This is only valid for AES, DES & DES3 keys.
GetKcv body → 2XX
POST
/crypto/v1/keys/key_attestation
Retrieve a key attestation certificate for a security object.
GetKeyAttestation body → 2XX
GET
/crypto/v1/pubkey/{acct_id}/{name}
Get public part of an asymmetric key.
GetPubkey 2 params → 2XX
POST
/crypto/v1/keys/info
Lookup a security object.
GetSobject 1 param body → 2XX
POST
/crypto/v1/keys/components/import
Import a security object by components.
ImportSobjectByComponents body → 2XX
POST
/crypto/v1/keys/persist
Persist a transient key.
PersistTransientKey body → 2XX
DELETE
/crypto/v1/keys/{key_id}/private
Destroy private half of an asymmetric key.
RemovePrivate 1 param → 204
POST
/crypto/v1/keys/replace
Rotate a security object to an existing security object.
ReplaceSobject body → 204
PUT
/crypto/v1/keys/{key_id}/revert
Reverts a security object to a previous state.
RevertPrevKeyOp 1 param body → 204
POST
/crypto/v1/keys/{key_id}/revoke
Transition a security object to Deactivated or Compromised state.
RevokeSobject 1 param body → 204
POST
/crypto/v1/keys/rekey
Rotate a security object.
RotateSobject body → 2XX
POST
/crypto/v1/keys/kcv/verify
Computes the KCV of the input blob and checks if it matches the input KCV.
VerifyKcv body → 2XX

Schemas 176

The contract defines 176 schemas that model the data the API accepts and returns. Each schema is shown below with its type and property counts.

SobjectComponent
FpeDate
A structure for specifying a token part representing a date that occurs after a specified date and/or occurs before a specified date. Depending on the subparts…
EffectiveKeyOperations
string
Operations allowed to be performed on a given key by a given User or an app SIGN: If this is set, the key can be used for signing. VERIFY: If this is set, the…
ExternalKmsInfoVariantOci
VerifyKcvRequest
Mgf
Specifies the Mask Generating Function (MGF) to use.
KeyCreationMethodVariantUnwrap
RsaEncryptionPaddingOaep
FpeDataPart
Structure for specifying (part of) a complex tokenization data type.
PublishPublicKeyConfigEnabled
GoogleAccessReason
string
An access reason provided by Google when making EKMS API calls.
Slip10Options
CipherMode
string
Cipher mode used for symmetric key algorithms.
GoogleAccessReasonPolicy
FpeDayMonthDate
FpeInputProcessing
Options to apply some pre- and post-processing to the input.
VerifyKcvResponse
PublishPublicKeyConfig
If enabled, the public key will be available publicly (without authentication) through the GetPublicKey API.
AriaOptions
ListSobjectsResponse
OciVaultInfo
KeyCreationMethodVariantImport
FpeInputProcessingPassthroughSpecific
KeyCheckValueRequest
ApprovalAuthConfig
PublishPublicKeyConfigVariantEnabled
RotationPolicy
FpeConstraints
AwsKeyRotationStatusVariantKeyRotationEnabled
AwsKmsInfo
RevertRequest
FpeCompoundPartOr
FpeDayMonthYearDate
AwsKeyRotationStatus
FpeOptions
FPE-specific options (for specifying the format of the data to be encrypted)
MlDsaParamSet
string
ML-DSA parameter sets
SobjectReplaceRequest
ExternalKmsInfoVariantAWS
FpeSection
ExportSobjectComponentsRequest
RsaEncryptionPadding
Type of padding to use for RSA encryption. The use of PKCS1 v1.5 padding is strongly discouraged, because of its susceptibility to Bleichenbacher's attack. The…
KcvMethod
string
Methods for calculating a Key Checksum Value.
EffectiveKeyPolicy
FpeMonthYearDate
AwsMultiRegionInfo
FpeVariant
KeyCreationMethodVariantGenerate
EcKcdsaOptions
WrappingKeys
FpeDateDayMonthYear
UnwrapKeyParams
LmsOptions
AesOptions
FpeCompoundPartMultiple
All
string
A helper enum with a single variant, All, which indicates that something should apply to an entire part. (This is here mainly to allow other untagged enums to…
FpeWords
A set of fixed-length strings.
KeyCheckValueResponse
HistoryItemState
Secs
WrappingKeysOnly
RsaEncryptionPaddingPolicy
RSA encryption padding policy.
MgfPolicy
MGF policy.
Des3Options
RsaSignaturePaddingPolicyPss
ObjectOrigin
string
The origin of a security object - where it was created / generated.
SobjectDescriptorInline
FpePreserveMask
A structure indicating which indices in an encrypted part to mask or preserve.
RsaEncryptionPaddingPolicyOaep
KeyCreationMethod
Information about the method by which a key was created
ExternalKeyIdOciVault
ExternalKeyIdAzureKeyVault
ExternalKeyIdAwsKms
MgfPolicyMgf1
SobjectEncoding
string
Response data encoding.
SobjectExportPolicy
ExternalKeyIdFortanix
ExportPolicyVariantWrapped
CopySobjectRequest
ExportPolicyVariantUnrestricted
BlsOptions
AwsMultiRegionKeyType
string
Specifies the type of multi-Region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.htmlmulti-region-concepts
ExternalKeyId
Identification information for an external key. There are multiple variants of this type to represent the different kinds of keys DSM supports (e.g., AWS, Azur…
RotateCopiedKeys
Bip32Network
string
The BIP32 network The Testnet network is usually an actual network with nodes and miners, and free cryptocurrency. This provides a testing environment for deve…
FpeChecksum
string
FpeGroup
KeyCreationMethodVariantDerive
CryptMode
CipherMode or RsaEncryptionPadding, depending on the encryption algorithm.
FpeCharSet
The alphabet to use for an encrypted portion of a complex tokenization data type. Characters should be specified as a list of pairs, where each pair [a, b] rep…
EllipticCurve
string
Identifies a standardized elliptic curve.
MgfMgf1
KeyAttestationStatementFormat
string
PersistTransientKeyRequest
XmssOptions
FpeFormatV2
PrincipalUserViaApp
WrappingKeysVariantAny
WrapKeyParams
ExportComponentsResponse
SobjectRequest
FpeWordsIntegerRanges
DsaOptions
KeyAttestationResponse
ObjectDigestRequest
RsaSignaturePaddingPolicy
RSA signature padding policy.
SobjectDescriptorPersisted
Uniquely identifies a persisted sobject.
FpeOptionsV2
RsaOptions
FpeDatePart
string
Possible date-related constraint types that do not form a complete date (by themselves) for a complex tokenization data type.
KeyAttestationRequest
GetSobjectParams
AwsKeyOrigin
string
Origin of the AWS KMS key. See the [AWS documentation](https://docs.aws.amazon.com/kms/latest/APIReference/APIKeyMetadata.htmlKMS-Type-KeyMetadata-Origin) for…
KeyCreationMethodVariantEncapsulate
FpeCompoundPartConcat
FpeOptionsBasic
ListSobjectsParams
DesOptions
KeyOperations
string
Operations allowed to be performed on a given key. SIGN: If this is set, the key can be used to for signing. VERIFY: If this is set, the key can used for verif…
ExternalKeyIdPkcs11
SobjectDescriptor
Uniquely identifies a persisted or transient sobject.
AwsKeyRotationStatusKeyRotationEnabled
RevocationReasonCode
string
Reasons to revoke a security object.
ExportPolicyWrapped
MlDsaOptions
PublishPublicKeyConfigVariantDisabled
FpeCode
KeyCreationMethodVariantTransform
KeyCreationMethodVariantDecapsulate
FpeConstraintsApplicability
A structure indicating which subparts to which to apply a set of constraints.
RemovableGoogleAccessReasonPolicy
MlKemParamSet
string
ML-KEM parameter sets
KeyAttestationStatement
WrappingKeysVariantOnly
AwsKeyRotationStatusVariantKeyRotationDisabled
ExternalSobjectInfo
ExternalKeyIdGcpKeyRing
MlKemOptions
SobjectRekeyRequest
Sobject
FpeDateConstraint
Possible date-related constraint types for a portion of a complex tokenization data type.
FpeDataPartLiteral
BlsVariant
string
Signature/public-key size trade-off for BLS.
OauthScope
string
OAuth scope.
RevocationReason
ExportPolicy
HistoryItem
RotationInterval
ExternalKmsInfo
Information about a specific external KMS key object.
Bip32Options
FpeDateMonthDay
FpeWordsCustom
AwsKeyMaterialId
RsaEncryptionPolicy
SplittingMethod
string
Method used to split the key into multiple components.
FpeCompoundPart
Structure of a compound portion of a complex tokenization data type, itself composed of smaller parts.
SeedOptions
FpeDateMonthYear
FpeOptionsAdvanced
Principal
A security principal.
SobjectState
string
Security object operational state.
ImportSobjectComponentsRequest
Algorithm
string
A cryptographic algorithm.
ObjectType
string
Type of security object.
RsaSignaturePolicy
DigestAlgorithm
string
A hash algorithm.
KcdsaOptions
KeyCreationMethodVariantAgree
FpeTokenizeMode
string
How to tokenize a given input. The most secure option is "PreserveFormat".
FpeInputDefaultProcessing
string
Metadata
VirtualSobjectInfo
ObjectDigestResponse
CustomMetadata
object
KeyLinks
SobjectSort
FpeEncryptedPart

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

fortanix-keys-api-openapi.yml Raw ↑

Other APIs Fortanix publishes across the network.

Fortanix Confidential Computing Manager REST API
AE Profile APIs.io
Fortanix Account Extensions API
AE Profile APIs.io
Fortanix Accounts API
AE Profile APIs.io
Fortanix Admin API
AE Profile APIs.io
Fortanix App API
AE Profile APIs.io
Fortanix Application Config API
AE Profile APIs.io
Fortanix Approval Requests API
AE Profile APIs.io
Fortanix Approval Requests API
AE Profile APIs.io
Fortanix Apps API
AE Profile APIs.io
Fortanix Auth API
AE Profile APIs.io
Fortanix Authentication API
AE Profile APIs.io
Fortanix Batch API
AE Profile APIs.io
#Keys
← Back to F APIs
API Details
ID
fortanix:fortanix-keys-api
Base URL
https://amer.smartkey.io
Docs
https://support.fortanix.com/apidocs/dsm-introduction
Provider
Fortanix
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=fortanix-keys-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/fortanix-keys-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Fortanix Keys API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.