Package com.google.cloud.kms.v1 (2.32.0)

Request message for KeyManagementService.AsymmetricDecrypt.

Protobuf type google.cloud.kms.v1.AsymmetricDecryptRequest

Request message for KeyManagementService.AsymmetricDecrypt.

Protobuf type google.cloud.kms.v1.AsymmetricDecryptRequest

Response message for KeyManagementService.AsymmetricDecrypt.

Protobuf type google.cloud.kms.v1.AsymmetricDecryptResponse

Response message for KeyManagementService.AsymmetricDecrypt.

Protobuf type google.cloud.kms.v1.AsymmetricDecryptResponse

Request message for KeyManagementService.AsymmetricSign.

Protobuf type google.cloud.kms.v1.AsymmetricSignRequest

Request message for KeyManagementService.AsymmetricSign.

Protobuf type google.cloud.kms.v1.AsymmetricSignRequest

Response message for KeyManagementService.AsymmetricSign.

Protobuf type google.cloud.kms.v1.AsymmetricSignResponse

Response message for KeyManagementService.AsymmetricSign.

Protobuf type google.cloud.kms.v1.AsymmetricSignResponse

A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.

Protobuf type google.cloud.kms.v1.Certificate

A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.

Protobuf type google.cloud.kms.v1.Certificate

Request message for KeyManagementService.CreateCryptoKey.

Protobuf type google.cloud.kms.v1.CreateCryptoKeyRequest

Request message for KeyManagementService.CreateCryptoKey.

Protobuf type google.cloud.kms.v1.CreateCryptoKeyRequest

Request message for KeyManagementService.CreateCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.CreateCryptoKeyVersionRequest

Request message for KeyManagementService.CreateCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.CreateCryptoKeyVersionRequest

Request message for EkmService.CreateEkmConnection.

Protobuf type google.cloud.kms.v1.CreateEkmConnectionRequest

Request message for EkmService.CreateEkmConnection.

Protobuf type google.cloud.kms.v1.CreateEkmConnectionRequest

Request message for KeyManagementService.CreateImportJob.

Protobuf type google.cloud.kms.v1.CreateImportJobRequest

Request message for KeyManagementService.CreateImportJob.

Protobuf type google.cloud.kms.v1.CreateImportJobRequest

Request message for KeyManagementService.CreateKeyRing.

Protobuf type google.cloud.kms.v1.CreateKeyRingRequest

Request message for KeyManagementService.CreateKeyRing.

Protobuf type google.cloud.kms.v1.CreateKeyRingRequest

A CryptoKey represents a logical key that can be used for cryptographic operations.

A CryptoKey is made up of zero or more versions, which represent the actual key material used in cryptographic operations.

Protobuf type google.cloud.kms.v1.CryptoKey

A CryptoKey represents a logical key that can be used for cryptographic operations.

A CryptoKey is made up of zero or more versions, which represent the actual key material used in cryptographic operations.

Protobuf type google.cloud.kms.v1.CryptoKey

Builder for projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}.

AUTO-GENERATED DOCUMENTATION AND CLASS

Builder for CryptoKeyPathName.

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Protobuf type google.cloud.kms.v1.CryptoKeyVersion

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Protobuf type google.cloud.kms.v1.CryptoKeyVersion

Builder for projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}.

A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.

Protobuf type google.cloud.kms.v1.CryptoKeyVersionTemplate

A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.

Protobuf type google.cloud.kms.v1.CryptoKeyVersionTemplate

Request message for KeyManagementService.Decrypt.

Protobuf type google.cloud.kms.v1.DecryptRequest

Request message for KeyManagementService.Decrypt.

Protobuf type google.cloud.kms.v1.DecryptRequest

Response message for KeyManagementService.Decrypt.

Protobuf type google.cloud.kms.v1.DecryptResponse

Response message for KeyManagementService.Decrypt.

Protobuf type google.cloud.kms.v1.DecryptResponse

Request message for KeyManagementService.DestroyCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.DestroyCryptoKeyVersionRequest

Request message for KeyManagementService.DestroyCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.DestroyCryptoKeyVersionRequest

A Digest holds a cryptographic message digest.

Protobuf type google.cloud.kms.v1.Digest

A Digest holds a cryptographic message digest.

Protobuf type google.cloud.kms.v1.Digest

An EkmConfig is a singleton resource that represents configuration parameters that apply to all CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC in a given project and location.

Protobuf type google.cloud.kms.v1.EkmConfig

An EkmConfig is a singleton resource that represents configuration parameters that apply to all CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC in a given project and location.

Protobuf type google.cloud.kms.v1.EkmConfig

Builder for projects/{project}/locations/{location}/ekmConfig.

An EkmConnection represents an individual EKM connection. It can be used for creating CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC, as well as performing cryptographic operations using keys created within the EkmConnection.

Protobuf type google.cloud.kms.v1.EkmConnection

An EkmConnection represents an individual EKM connection. It can be used for creating CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC, as well as performing cryptographic operations using keys created within the EkmConnection.

Protobuf type google.cloud.kms.v1.EkmConnection

A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.

Protobuf type google.cloud.kms.v1.EkmConnection.ServiceResolver

A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.

Protobuf type google.cloud.kms.v1.EkmConnection.ServiceResolver

Builder for projects/{project}/locations/{location}/ekmConnections/{ekm_connection}.

Service Description: Google Cloud Key Management EKM Service

Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• EkmConnection

This class provides the ability to make remote calls to the backing service through method calls that map to API methods. Sample code to get started:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (EkmServiceClient ekmServiceClient = EkmServiceClient.create()) {
   EkmConnectionName name = EkmConnectionName.of("[PROJECT]", "[LOCATION]", "[EKM_CONNECTION]");
   EkmConnection response = ekmServiceClient.getEkmConnection(name);
 }
 

Note: close() needs to be called on the EkmServiceClient object to clean up resources such as threads. In the example above, try-with-resources is used, which automatically calls close().

The surface of this class includes several types of Java methods for each of the API's methods:

1. A "flattened" method. With this type of method, the fields of the request type have been converted into function parameters. It may be the case that not all fields are available as parameters, and not every API method will have a flattened method entry point.
2. A "request object" method. This type of method only takes one parameter, a request object, which must be constructed before the call. Not every API method will have a request object method.
3. A "callable" method. This type of method takes no parameters and returns an immutable API callable object, which can be used to initiate calls to the service.

See the individual methods for example code.

Many parameters require resource names to be formatted in a particular way. To assist with these names, this class includes a format method for each type of name, and additionally a parse method to extract the individual identifiers contained within names that are returned.

This class can be customized by passing in a custom instance of EkmServiceSettings to create(). For example:

To customize credentials:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 EkmServiceSettings ekmServiceSettings =
     EkmServiceSettings.newBuilder()
         .setCredentialsProvider(FixedCredentialsProvider.create(myCredentials))
         .build();
 EkmServiceClient ekmServiceClient = EkmServiceClient.create(ekmServiceSettings);
 

To customize the endpoint:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 EkmServiceSettings ekmServiceSettings =
     EkmServiceSettings.newBuilder().setEndpoint(myEndpoint).build();
 EkmServiceClient ekmServiceClient = EkmServiceClient.create(ekmServiceSettings);
 

To use REST (HTTP1.1/JSON) transport (instead of gRPC) for sending and receiving requests over the wire:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 EkmServiceSettings ekmServiceSettings = EkmServiceSettings.newHttpJsonBuilder().build();
 EkmServiceClient ekmServiceClient = EkmServiceClient.create(ekmServiceSettings);
 

Please refer to the GitHub repository's samples for more quickstart code snippets.

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• EkmConnection

A stub to allow clients to do synchronous rpc calls to service EkmService.

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• EkmConnection

A stub to allow clients to do ListenableFuture-style rpc calls to service EkmService.

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• EkmConnection

Base class for the server implementation of the service EkmService.

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• EkmConnection

A stub to allow clients to do asynchronous rpc calls to service EkmService.

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• EkmConnection

Settings class to configure an instance of EkmServiceClient.

The default instance has everything set to sensible defaults:

• The default service address (cloudkms.googleapis.com) and default port (443) are used.
• Credentials are acquired automatically through Application Default Credentials.
• Retries are configured for idempotent methods but not for non-idempotent methods.

The builder of this class is recursive, so contained classes are themselves builders. When build() is called, the tree of builders is called to create the complete settings object.

For example, to set the total timeout of getEkmConnection to 30 seconds:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 EkmServiceSettings.Builder ekmServiceSettingsBuilder = EkmServiceSettings.newBuilder();
 ekmServiceSettingsBuilder
     .getEkmConnectionSettings()
     .setRetrySettings(
         ekmServiceSettingsBuilder
             .getEkmConnectionSettings()
             .getRetrySettings()
             .toBuilder()
             .setTotalTimeout(Duration.ofSeconds(30))
             .build());
 EkmServiceSettings ekmServiceSettings = ekmServiceSettingsBuilder.build();
 

Builder for EkmServiceSettings.

Request message for KeyManagementService.Encrypt.

Protobuf type google.cloud.kms.v1.EncryptRequest

Request message for KeyManagementService.Encrypt.

Protobuf type google.cloud.kms.v1.EncryptRequest

Response message for KeyManagementService.Encrypt.

Protobuf type google.cloud.kms.v1.EncryptResponse

Response message for KeyManagementService.Encrypt.

Protobuf type google.cloud.kms.v1.EncryptResponse

ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.

Protobuf type google.cloud.kms.v1.ExternalProtectionLevelOptions

ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.

Protobuf type google.cloud.kms.v1.ExternalProtectionLevelOptions

Request message for KeyManagementService.GenerateRandomBytes.

Protobuf type google.cloud.kms.v1.GenerateRandomBytesRequest

Request message for KeyManagementService.GenerateRandomBytes.

Protobuf type google.cloud.kms.v1.GenerateRandomBytesRequest

Response message for KeyManagementService.GenerateRandomBytes.

Protobuf type google.cloud.kms.v1.GenerateRandomBytesResponse

Response message for KeyManagementService.GenerateRandomBytes.

Protobuf type google.cloud.kms.v1.GenerateRandomBytesResponse

Request message for KeyManagementService.GetCryptoKey.

Protobuf type google.cloud.kms.v1.GetCryptoKeyRequest

Request message for KeyManagementService.GetCryptoKey.

Protobuf type google.cloud.kms.v1.GetCryptoKeyRequest

Request message for KeyManagementService.GetCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.GetCryptoKeyVersionRequest

Request message for KeyManagementService.GetCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.GetCryptoKeyVersionRequest

Request message for EkmService.GetEkmConfig.

Protobuf type google.cloud.kms.v1.GetEkmConfigRequest

Request message for EkmService.GetEkmConfig.

Protobuf type google.cloud.kms.v1.GetEkmConfigRequest

Request message for EkmService.GetEkmConnection.

Protobuf type google.cloud.kms.v1.GetEkmConnectionRequest

Request message for EkmService.GetEkmConnection.

Protobuf type google.cloud.kms.v1.GetEkmConnectionRequest

Request message for KeyManagementService.GetImportJob.

Protobuf type google.cloud.kms.v1.GetImportJobRequest

Request message for KeyManagementService.GetImportJob.

Protobuf type google.cloud.kms.v1.GetImportJobRequest

Request message for KeyManagementService.GetKeyRing.

Protobuf type google.cloud.kms.v1.GetKeyRingRequest

Request message for KeyManagementService.GetKeyRing.

Protobuf type google.cloud.kms.v1.GetKeyRingRequest

Request message for KeyManagementService.GetPublicKey.

Protobuf type google.cloud.kms.v1.GetPublicKeyRequest

Request message for KeyManagementService.GetPublicKey.

Protobuf type google.cloud.kms.v1.GetPublicKeyRequest

Request message for KeyManagementService.ImportCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.ImportCryptoKeyVersionRequest

Request message for KeyManagementService.ImportCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.ImportCryptoKeyVersionRequest

An ImportJob can be used to create CryptoKeys and CryptoKeyVersions using pre-existing key material, generated outside of Cloud KMS.

When an ImportJob is created, Cloud KMS will generate a "wrapping key", which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of import_method. When the wrapping key generation is complete, the state will be set to ACTIVE and the public_key can be fetched. The fetched public key can then be used to wrap your pre-existing key material.

Once the key material is wrapped, it can be imported into a new CryptoKeyVersion in an existing CryptoKey by calling ImportCryptoKeyVersion. Multiple CryptoKeyVersions can be imported with a single ImportJob. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key.

An ImportJob expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the ImportJob's public key.

For more information, see Importing a key.

Protobuf type google.cloud.kms.v1.ImportJob

An ImportJob can be used to create CryptoKeys and CryptoKeyVersions using pre-existing key material, generated outside of Cloud KMS.

When an ImportJob is created, Cloud KMS will generate a "wrapping key", which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of import_method. When the wrapping key generation is complete, the state will be set to ACTIVE and the public_key can be fetched. The fetched public key can then be used to wrap your pre-existing key material.

Once the key material is wrapped, it can be imported into a new CryptoKeyVersion in an existing CryptoKey by calling ImportCryptoKeyVersion. Multiple CryptoKeyVersions can be imported with a single ImportJob. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key.

An ImportJob expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the ImportJob's public key.

For more information, see Importing a key.

Protobuf type google.cloud.kms.v1.ImportJob

The public key component of the wrapping key. For details of the type of key this public key corresponds to, see the ImportMethod.

Protobuf type google.cloud.kms.v1.ImportJob.WrappingPublicKey

The public key component of the wrapping key. For details of the type of key this public key corresponds to, see the ImportMethod.

Protobuf type google.cloud.kms.v1.ImportJob.WrappingPublicKey

Builder for projects/{project}/locations/{location}/keyRings/{key_ring}/importJobs/{import_job}.

Service Description: Google Cloud Key Management Service

Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• KeyRing
• CryptoKey
• CryptoKeyVersion
• ImportJob

If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

This class provides the ability to make remote calls to the backing service through method calls that map to API methods. Sample code to get started:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (KeyManagementServiceClient keyManagementServiceClient =
     KeyManagementServiceClient.create()) {
   KeyRingName name = KeyRingName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]");
   KeyRing response = keyManagementServiceClient.getKeyRing(name);
 }
 

Note: close() needs to be called on the KeyManagementServiceClient object to clean up resources such as threads. In the example above, try-with-resources is used, which automatically calls close().

The surface of this class includes several types of Java methods for each of the API's methods:

1. A "flattened" method. With this type of method, the fields of the request type have been converted into function parameters. It may be the case that not all fields are available as parameters, and not every API method will have a flattened method entry point.
2. A "request object" method. This type of method only takes one parameter, a request object, which must be constructed before the call. Not every API method will have a request object method.
3. A "callable" method. This type of method takes no parameters and returns an immutable API callable object, which can be used to initiate calls to the service.

See the individual methods for example code.

Many parameters require resource names to be formatted in a particular way. To assist with these names, this class includes a format method for each type of name, and additionally a parse method to extract the individual identifiers contained within names that are returned.

This class can be customized by passing in a custom instance of KeyManagementServiceSettings to create(). For example:

To customize credentials:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 KeyManagementServiceSettings keyManagementServiceSettings =
     KeyManagementServiceSettings.newBuilder()
         .setCredentialsProvider(FixedCredentialsProvider.create(myCredentials))
         .build();
 KeyManagementServiceClient keyManagementServiceClient =
     KeyManagementServiceClient.create(keyManagementServiceSettings);
 

To customize the endpoint:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 KeyManagementServiceSettings keyManagementServiceSettings =
     KeyManagementServiceSettings.newBuilder().setEndpoint(myEndpoint).build();
 KeyManagementServiceClient keyManagementServiceClient =
     KeyManagementServiceClient.create(keyManagementServiceSettings);
 

To use REST (HTTP1.1/JSON) transport (instead of gRPC) for sending and receiving requests over the wire:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 KeyManagementServiceSettings keyManagementServiceSettings =
     KeyManagementServiceSettings.newHttpJsonBuilder().build();
 KeyManagementServiceClient keyManagementServiceClient =
     KeyManagementServiceClient.create(keyManagementServiceSettings);
 

Please refer to the GitHub repository's samples for more quickstart code snippets.

Google Cloud Key Management Service Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• KeyRing
• CryptoKey
• CryptoKeyVersion
• ImportJob If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

A stub to allow clients to do synchronous rpc calls to service KeyManagementService.

Google Cloud Key Management Service Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• KeyRing
• CryptoKey
• CryptoKeyVersion
• ImportJob If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

A stub to allow clients to do ListenableFuture-style rpc calls to service KeyManagementService.

Google Cloud Key Management Service Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• KeyRing
• CryptoKey
• CryptoKeyVersion
• ImportJob If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

Base class for the server implementation of the service KeyManagementService.

Google Cloud Key Management Service Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• KeyRing
• CryptoKey
• CryptoKeyVersion
• ImportJob If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

A stub to allow clients to do asynchronous rpc calls to service KeyManagementService.

Google Cloud Key Management Service Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• KeyRing
• CryptoKey
• CryptoKeyVersion
• ImportJob If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

Settings class to configure an instance of KeyManagementServiceClient.

The default instance has everything set to sensible defaults:

• The default service address (cloudkms.googleapis.com) and default port (443) are used.
• Credentials are acquired automatically through Application Default Credentials.
• Retries are configured for idempotent methods but not for non-idempotent methods.

The builder of this class is recursive, so contained classes are themselves builders. When build() is called, the tree of builders is called to create the complete settings object.

For example, to set the total timeout of getKeyRing to 30 seconds:

 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 KeyManagementServiceSettings.Builder keyManagementServiceSettingsBuilder =
     KeyManagementServiceSettings.newBuilder();
 keyManagementServiceSettingsBuilder
     .getKeyRingSettings()
     .setRetrySettings(
         keyManagementServiceSettingsBuilder
             .getKeyRingSettings()
             .getRetrySettings()
             .toBuilder()
             .setTotalTimeout(Duration.ofSeconds(30))
             .build());
 KeyManagementServiceSettings keyManagementServiceSettings =
     keyManagementServiceSettingsBuilder.build();
 

Builder for KeyManagementServiceSettings.

AUTO-GENERATED DOCUMENTATION AND CLASS

Deprecated. This resource name class will be removed in the next major version.

AUTO-GENERATED DOCUMENTATION AND CLASS

Contains an HSM-generated attestation about a key operation. For more information, see Verifying attestations.

Protobuf type google.cloud.kms.v1.KeyOperationAttestation

Contains an HSM-generated attestation about a key operation. For more information, see Verifying attestations.

Protobuf type google.cloud.kms.v1.KeyOperationAttestation

Certificate chains needed to verify the attestation. Certificates in chains are PEM-encoded and are ordered based on https://tools.ietf.org/html/rfc5246#section-7.4.2.

Protobuf type google.cloud.kms.v1.KeyOperationAttestation.CertificateChains

Certificate chains needed to verify the attestation. Certificates in chains are PEM-encoded and are ordered based on https://tools.ietf.org/html/rfc5246#section-7.4.2.

Protobuf type google.cloud.kms.v1.KeyOperationAttestation.CertificateChains

A KeyRing is a toplevel logical grouping of CryptoKeys.

Protobuf type google.cloud.kms.v1.KeyRing

A KeyRing is a toplevel logical grouping of CryptoKeys.

Protobuf type google.cloud.kms.v1.KeyRing

Builder for projects/{project}/locations/{location}/keyRings/{key_ring}.

Request message for KeyManagementService.ListCryptoKeyVersions.

Protobuf type google.cloud.kms.v1.ListCryptoKeyVersionsRequest

Request message for KeyManagementService.ListCryptoKeyVersions.

Protobuf type google.cloud.kms.v1.ListCryptoKeyVersionsRequest

Response message for KeyManagementService.ListCryptoKeyVersions.

Protobuf type google.cloud.kms.v1.ListCryptoKeyVersionsResponse

Response message for KeyManagementService.ListCryptoKeyVersions.

Protobuf type google.cloud.kms.v1.ListCryptoKeyVersionsResponse

Request message for KeyManagementService.ListCryptoKeys.

Protobuf type google.cloud.kms.v1.ListCryptoKeysRequest

Request message for KeyManagementService.ListCryptoKeys.

Protobuf type google.cloud.kms.v1.ListCryptoKeysRequest

Response message for KeyManagementService.ListCryptoKeys.

Protobuf type google.cloud.kms.v1.ListCryptoKeysResponse

Response message for KeyManagementService.ListCryptoKeys.

Protobuf type google.cloud.kms.v1.ListCryptoKeysResponse

Request message for EkmService.ListEkmConnections.

Protobuf type google.cloud.kms.v1.ListEkmConnectionsRequest

Request message for EkmService.ListEkmConnections.

Protobuf type google.cloud.kms.v1.ListEkmConnectionsRequest

Response message for EkmService.ListEkmConnections.

Protobuf type google.cloud.kms.v1.ListEkmConnectionsResponse

Response message for EkmService.ListEkmConnections.

Protobuf type google.cloud.kms.v1.ListEkmConnectionsResponse

Request message for KeyManagementService.ListImportJobs.

Protobuf type google.cloud.kms.v1.ListImportJobsRequest

Request message for KeyManagementService.ListImportJobs.

Protobuf type google.cloud.kms.v1.ListImportJobsRequest

Response message for KeyManagementService.ListImportJobs.

Protobuf type google.cloud.kms.v1.ListImportJobsResponse

Response message for KeyManagementService.ListImportJobs.

Protobuf type google.cloud.kms.v1.ListImportJobsResponse

Request message for KeyManagementService.ListKeyRings.

Protobuf type google.cloud.kms.v1.ListKeyRingsRequest

Request message for KeyManagementService.ListKeyRings.

Protobuf type google.cloud.kms.v1.ListKeyRingsRequest

Response message for KeyManagementService.ListKeyRings.

Protobuf type google.cloud.kms.v1.ListKeyRingsResponse

Response message for KeyManagementService.ListKeyRings.

Protobuf type google.cloud.kms.v1.ListKeyRingsResponse

Cloud KMS metadata for the given google.cloud.location.Location.

Protobuf type google.cloud.kms.v1.LocationMetadata

Cloud KMS metadata for the given google.cloud.location.Location.

Protobuf type google.cloud.kms.v1.LocationMetadata

Builder for projects/{project}/locations/{location}.

Request message for KeyManagementService.MacSign.

Protobuf type google.cloud.kms.v1.MacSignRequest

Request message for KeyManagementService.MacSign.

Protobuf type google.cloud.kms.v1.MacSignRequest

Response message for KeyManagementService.MacSign.

Protobuf type google.cloud.kms.v1.MacSignResponse

Response message for KeyManagementService.MacSign.

Protobuf type google.cloud.kms.v1.MacSignResponse

Request message for KeyManagementService.MacVerify.

Protobuf type google.cloud.kms.v1.MacVerifyRequest

Request message for KeyManagementService.MacVerify.

Protobuf type google.cloud.kms.v1.MacVerifyRequest

Response message for KeyManagementService.MacVerify.

Protobuf type google.cloud.kms.v1.MacVerifyResponse

Response message for KeyManagementService.MacVerify.

Protobuf type google.cloud.kms.v1.MacVerifyResponse

The public key for a given CryptoKeyVersion. Obtained via GetPublicKey.

Protobuf type google.cloud.kms.v1.PublicKey

The public key for a given CryptoKeyVersion. Obtained via GetPublicKey.

Protobuf type google.cloud.kms.v1.PublicKey

Request message for KeyManagementService.RawDecrypt.

Protobuf type google.cloud.kms.v1.RawDecryptRequest

Request message for KeyManagementService.RawDecrypt.

Protobuf type google.cloud.kms.v1.RawDecryptRequest

Response message for KeyManagementService.RawDecrypt.

Protobuf type google.cloud.kms.v1.RawDecryptResponse

Response message for KeyManagementService.RawDecrypt.

Protobuf type google.cloud.kms.v1.RawDecryptResponse

Request message for KeyManagementService.RawEncrypt.

Protobuf type google.cloud.kms.v1.RawEncryptRequest

Request message for KeyManagementService.RawEncrypt.

Protobuf type google.cloud.kms.v1.RawEncryptRequest

Response message for KeyManagementService.RawEncrypt.

Protobuf type google.cloud.kms.v1.RawEncryptResponse

Response message for KeyManagementService.RawEncrypt.

Protobuf type google.cloud.kms.v1.RawEncryptResponse

Request message for KeyManagementService.RestoreCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.RestoreCryptoKeyVersionRequest

Request message for KeyManagementService.RestoreCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.RestoreCryptoKeyVersionRequest

Deprecated. This resource name class will be removed in the next major version.

AUTO-GENERATED DOCUMENTATION AND CLASS

Request message for KeyManagementService.UpdateCryptoKeyPrimaryVersion.

Protobuf type google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest

Request message for KeyManagementService.UpdateCryptoKeyPrimaryVersion.

Protobuf type google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest

Request message for KeyManagementService.UpdateCryptoKey.

Protobuf type google.cloud.kms.v1.UpdateCryptoKeyRequest

Request message for KeyManagementService.UpdateCryptoKey.

Protobuf type google.cloud.kms.v1.UpdateCryptoKeyRequest

Request message for KeyManagementService.UpdateCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.UpdateCryptoKeyVersionRequest

Request message for KeyManagementService.UpdateCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.UpdateCryptoKeyVersionRequest

Request message for EkmService.UpdateEkmConfig.

Protobuf type google.cloud.kms.v1.UpdateEkmConfigRequest

Request message for EkmService.UpdateEkmConfig.

Protobuf type google.cloud.kms.v1.UpdateEkmConfigRequest

Request message for EkmService.UpdateEkmConnection.

Protobuf type google.cloud.kms.v1.UpdateEkmConnectionRequest

Request message for EkmService.UpdateEkmConnection.

Protobuf type google.cloud.kms.v1.UpdateEkmConnectionRequest

Request message for EkmService.VerifyConnectivity.

Protobuf type google.cloud.kms.v1.VerifyConnectivityRequest

Request message for EkmService.VerifyConnectivity.

Protobuf type google.cloud.kms.v1.VerifyConnectivityRequest

Response message for EkmService.VerifyConnectivity.

Protobuf type google.cloud.kms.v1.VerifyConnectivityResponse

Response message for EkmService.VerifyConnectivity.

Protobuf type google.cloud.kms.v1.VerifyConnectivityResponse

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• EkmConnection

Google Cloud Key Management Service Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

• KeyRing
• CryptoKey
• CryptoKeyVersion
• ImportJob If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

CryptoKeyPurpose describes the cryptographic capabilities of a CryptoKey. A given key can only be used for the operations allowed by its purpose. For more information, see Key purposes.

Protobuf enum google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose

The algorithm of the CryptoKeyVersion, indicating what parameters must be used for each cryptographic operation.

The GOOGLE_SYMMETRIC_ENCRYPTION algorithm is usable with CryptoKey.purpose ENCRYPT_DECRYPT.

Algorithms beginning with RSA_SIGN_ are usable with CryptoKey.purpose ASYMMETRIC_SIGN.

The fields in the name after RSA_SIGN_ correspond to the following parameters: padding algorithm, modulus bit length, and digest algorithm.

For PSS, the salt length used is equal to the length of digest algorithm. For example, RSA_SIGN_PSS_2048_SHA256 will use PSS with a salt length of 256 bits or 32 bytes.

Algorithms beginning with RSA_DECRYPT_ are usable with CryptoKey.purpose ASYMMETRIC_DECRYPT.

The fields in the name after RSA_DECRYPT_ correspond to the following parameters: padding algorithm, modulus bit length, and digest algorithm.

Algorithms beginning with EC_SIGN_ are usable with CryptoKey.purpose ASYMMETRIC_SIGN.

The fields in the name after EC_SIGN_ correspond to the following parameters: elliptic curve, digest algorithm.

Algorithms beginning with HMAC_ are usable with CryptoKey.purpose MAC.

The suffix following HMAC_ corresponds to the hash algorithm being used (eg. SHA256).

For more information, see Key purposes and algorithms.

Protobuf enum google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm

The state of a CryptoKeyVersion, indicating if it can be used.

Protobuf enum google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState

A view for CryptoKeyVersions. Controls the level of detail returned for CryptoKeyVersions in KeyManagementService.ListCryptoKeyVersions and KeyManagementService.ListCryptoKeys.

Protobuf enum google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionView

KeyManagementMode describes who can perform control plane cryptographic operations using this EkmConnection.

Protobuf enum google.cloud.kms.v1.EkmConnection.KeyManagementMode

The state of the ImportJob, indicating if it can be used.

Protobuf enum google.cloud.kms.v1.ImportJob.ImportJobState

ImportMethod describes the key wrapping method chosen for this ImportJob.

Protobuf enum google.cloud.kms.v1.ImportJob.ImportMethod

Attestation formats provided by the HSM.

Protobuf enum google.cloud.kms.v1.KeyOperationAttestation.AttestationFormat

ProtectionLevel specifies how cryptographic operations are performed. For more information, see Protection levels.

Protobuf enum google.cloud.kms.v1.ProtectionLevel