SAP HYOK APIs

Caution

This feature is a technical preview for evaluation in non-production environments. A technical preview introduces new, limited functionality for customer feedback as we work on the feature. Details and functionality are subject to change. We cannot guarantee that data created as part of a technical preview will be retained after the feature is finalized.

SAP Data Custodian KMS supports a customer-managed keystore that allows you to create HYOK keys residing in your external key manager. You manage the full lifecycle of HYOK keys within your external key manager. SAP Data Custodian KMS does not have any control over these keys.

Your external key manager handles crypto operations within its secure enclave, using a network endpoint. SAP KMS forwards these requests to your external key manager, where the key material remains protected.

Prerequisites

Before integrating CipherTrust Manager as your external key manager:

1. Ensure that CipherTrust Manager is up and running. Activate and install the CCKM license. Refer to the CipherTrust Manager Deployment Guide and Licensing for details.

2. Ensure CipherTrust Manager has a valid hostname and a trusted third-party CA certificate installed on its web interface.

3. Add the SAP Cloud Root CA as both an external CA and an external trusted CA on CipherTrust Manager:

   1. Download the SAP Cloud Root CA.crt file from the Download section of the SAP Trust Center Services page.

   2. Rename the extension of the file from CRT to PEM.

   3. Add the SAP Cloud Root CA.pem file as an external CA on CipherTrust Manager. Refer to Add an external CA.

   4. Add the SAP Cloud Root CA.pem file as an external trusted CA on CipherTrust Manager. Refer to Add an external trusted CA.

Managing the SAP HYOK APIs

• Creating SAP Keystore

• Fetching SAP Keystore

• Viewing Details of a SAP Keystore

• Updating SAP Keystore

• Deleting a SAP Keystore

• Blocking Access to the SAP External Keystore

• Unblocking Access to the SAP External Keystore

• Create External Key in SAP Keystore

• Fetching SAP External Keys

• Viewing Details of a SAP External key in SAP Keystore

• Updating SAP External key

• Deleting a SAP External key

• Blocking Access to the SAP External Key

• Unblocking Access to the SAP External Key

• Enabling the SAP External Key

• Disabling the SAP External Key

• Viewing the Version Details for SAP HYOK

• Fetching SAP External Key Versions

• Archiving SAP Keystore

• Recovering SAP Keystore

• Archiving SAP External Key

• Recovering SAP External Key

Tip

The mandatory API request parameters are written in bold.