Read KMS offerings and resources
Step 1 of 5 in Connect Azure KMS with BYOK and BYOC.
Read before you configure. The offerings call lists the KMS kinds the deployment permits for this
tenant; if AZURE_KEY_VAULT is not offered, no amount of configuration will make it work.
- Overview
- Request
- Response
List KMS offerings
Endpoint: GET /api/platform/config/v1/tenants/00000000-0000-4000-8000-000000000000/kms/offerings
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The captured deployment offers SOFTWARE, AWS_KMS and AZURE_KEY_VAULT. Azure accepts both
PRODUCT_MANAGED and TENANT_SUPPLIED credentials, which decides who holds the client secret in the
next step.
- Overview
- Request
- Response
List KMS resources
Endpoint: GET /api/platform/config/v1/tenants/00000000-0000-4000-8000-000000000000/kms/resources
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Read the tenant setup KMS resource
Endpoint: GET /api/platform/config/v1/tenants/00000000-0000-4000-8000-000000000000/kms/resources/krh_%3Copaque%3E
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Each resource carries a handle, a resourceVersion used for optimistic concurrency, and a state.
Resources move from DEGRADED through CONFIGURED to DETACHED and RETIRED. A resource that
provisioning created for the tenant (for example a software keystore) shows up here too, which tells
you whether an Azure provider is additive or a replacement for existing signing material.
A platform-owned shared vault appears as an offered shared provider rather than as a tenant resource.
The tenant sees its providerId, kind and fulfillment mode, with enabled: false until it opts in,
and nothing about the vault behind it:
- Overview
- Request
- Response
Tenant lists the offered Azure provider
Endpoint: GET /api/platform/config/v1/tenants/00000000-0000-4000-8000-000000000000/kms/shared-providers
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Next
Continue with step 2, Configure the Azure Key Vault provider.