Encrypting the Data using a Symmetric Key

The post v1/cckm/sap/hyok/v1/keystores/{keystore_id}/keys/{external_key_id}/symmetric-encrypt API encrypts a plaintext data using an encryption key stored in a keystore on CipherTrust Manager. The key specified in the key_id path variable MUST be a symmetric key with ENCRYPT and DECRYPT attributes.

The API encrypts the plaintext data using the AES-GCM algorithm. The additional authenticated data (AAD) and key version ID are optional fields. If a specific key version ID is not provided, the latest version of the key is used to encrypt the plaintext data. The output is a JSON blob that can be passed to the symmetric decrypt API.

Note

This API does not accept an external IV, and it is generated by CipherTrust Manager.

Request Parameters

Example Request

post https://<Host IP Address>/api/v1/cckm/sap/hyok/v1/keystores/{keystore_id}/keys/{external_key_id}/symmetric-encrypt
<authorization token and other headers>
{
    "plaintext": "dGVzdGluZw==",
    "aad": "a2FqYWw=",
    "request_metadata": {
        "sap_tenant_id": "5e3d1d87-9502-42af-a946-3ffec9e71a44",
        "sap_group_id": "0dab7383-fa9b-4540-bcc7-fe03a6f59487",
        "sap_user_type": "USER_DEV",
        "sap_request_id": "86428acc-a1c8-6de1-b8f7-8de9a436gdr3"
    }
}

Example Response

{
    "ciphertext": "QE84BatkGw==",
    "iv": "h0R8plP4nAcGgs9B",
    "tag": "niKrwAK4LNOKmG++I/Nbaw==",
    "aad": "a2FqYWw=",
    "key_version_id": "0dab7383-fa9b-4540-bcc7-fe03a6f59487"
}

Response Codes

Refer to HTTP status codes for details.