SAP HYOK APIs
Caution
This feature is a technical preview for evaluation in non-production environments. A technical preview introduces new, limited functionality for customer feedback as we work on the feature. Details and functionality are subject to change. This includes API endpoints, UI elements, and CLI commands. We cannot guarantee that data created as part of a technical preview will be retained after the feature is finalized.
SAP Data Custodian KMS supports a customer-managed keystore that allows you to create HYOK keys residing in your external key manager. You manage the full lifecycle of HYOK keys within your external key manager. SAP Data Custodian KMS does not have any control over these keys.
Your external key manager handles crypto operations within its secure enclave, using a network endpoint. SAP KMS forwards these requests to your external key manager, where the key material remains protected.
Create and download the SAP certificate
Log in to your SAP Data Custodian system.
Open the Key Management menu.
Select Configurations.
Select Thales CipherTrust Manager from the Customer Managed Keystore tab.
Click Certificate Authentication.
Click Create Certificate. A new certificate will be generated.
Select the new certificate.
Select Actions.
Select Download.
Copy the SAP Certificate ID.
Create a keystore
Create a keystore on the CipherTrust Data Security Platform Service. Refer to Creating SAP HYOK Keystores for details. After the keystore is created successfully, copy the keystore URL.
Create a group for HYOK in SAP
You need to create a group for HYOK in SAP for CipherTrust Data Security Platform Service. To create a group.
Log in to SAP Data Custodian tenant.
Open the Dashboard.
Select the Key Management Service tab.
Select an application context.
Click Create Group.
Complete the Group Details section.
Complete the Keystore Selection section.
Select Customer Managed Keystore (HYOK).
Select Thales CipherTrust Manager from the Keystore drop-down menu.
Review Authentication Method section, auto populates to Certificate.
Complete the Configure Authentication Method section.
Enter Thales CipherTrust Data Security Platform Service keystore URL in the Thales Keystore URL field. You copied it above while creating a SAP keystore.
Enter the SAP Certificate ID in the Certificate ID field. You copied it above while creating and downloading the certificate.
Click Review.
Review the group details.
Click Create.
Create an endpoint (key)
Create an endpoint on the CipherTrust Data Security Platform Service. Refer to Creating SAP HYOK Endpoints for details. After the endpoint is created successfully, copy the globally unique identifier of the endpoint.
Register the key for HYOK in SAP
You need to register the key for HYOK in SAP for CipherTrust Data Security Platform Service. To register the key.
Log in to SAP Data Custodian tenant.
Open the Dashboard.
Select the Key Management Service tab.
Select an application context.
Select the HYOK group where the endpoint will be registered.
Click the Keys tab.
Click Register New Key.
Complete the Key Details section.
Select the Key ID.
Enter the unique identifier of the endpoint that you created above.
Click Review.
Review key details.
Click Register.
Managing the SAP HYOK APIs
Tip
The mandatory API request parameters are written in bold.
