API Reference
  1. Anka Secure Admin API
  2. InternalCryptoUseCases

Provision an internal crypto use case

post
https://staging.ankatech.co/api/v3/admin/tenants//internal-crypto-use-cases

Composes an authorization overlay over keys that already exist, for the calling application's self-use scenario. Atomically creates the control-plane entities — Exchange Context (INTERNAL) + Actor (INTERNAL) + Credential + Asset references + Constraint Policy (permissive) + 1..N Capability Grants.

This endpoint creates no key. keyKid and targetKeyKid are references to keys the tenant already owns; provision keys with POST /api/v3/admin/tenants/{tenantId}/keys (scope admin.keys.orchestrate) and name them here. The key keeps its own lifecycle: revoking or deleting this use case leaves it untouched, and several use cases may reference one key.

A key reference that names no key in the tenant is 404. A key that exists but cannot carry the declared operations is 422, with a distinct type per cause. Every refusal happens before anything is provisioned, so a rejected request creates nothing.

The credential plaintext is returned ONCE in the 201 response body — capture it immediately.

Scope required: admin.tenant.internal-use-case.create

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
uuid
required

Tenant UUID

Body Params

Provision an internal crypto use case (Application self-use) as an authorization overlay over keys that ALREADY EXIST. Creates the control-plane entities atomically: Exchange Context (INTERNAL) + Actor (INTERNAL) + Credential + Asset references + Constraint Policy (permissive) + 1..N Capability Grants. It creates NO key: provision keys with POST /api/v3/admin/tenants/{tenantId}/keys and reference them here by kid.

string
required
length between 1 and 64
^[a-z][a-z0-9-]{0,63}$

Tenant-scoped slug for the use case (kebab-case, 1-64 chars). Reusable after the use case is REVOKED (partial unique index excludes soft-deleted rows).

string
length between 0 and 255

Human-readable display name (UI label). Defaults to name when omitted.

string
length between 0 and 4000

Auditor-readable description of the use case.

uuid
required

Application that owns this use case. MUST exist in the tenant AND have status=ACTIVE (SUSPENDED/DELETED/PROVISIONING applications → 409).

string
length between 0 and 128
^[a-z0-9][a-z0-9-]{0,127}$

Stable KID of an EXISTING key in this tenant that the use case authorizes. The key is referenced, never created: it must already exist (provision one with POST /api/v3/admin/tenants/{tenantId}/keys), it keeps its own lifecycle, and revoking the use case leaves it untouched. OPTIONAL: omit it when every declared operation is INTEROP_* or one of the stateless migration data-only operations (CONVERT_PKCS7_TO_JOSE, ANALYZE_PKCS7) — those operations bind to no tenant-owned key. Declaring a key-bound operation without a kid is refused 422.

operations
array of strings
required
length ≥ 1

Operations to grant. Vocabulary (11 values): ENCRYPT, DECRYPT, SIGN, VERIFY (atomic — require keyKid); REENCRYPT, RESIGN (cross-kid first-class — require keyKid + targetKeyKid); INTEROP_ENCRYPT, INTEROP_VERIFY (caller-supplied keys, scope-only); CONVERT_PKCS7_TO_JOSE, ANALYZE_PKCS7, EXPORT_KEY (migration data-only, scope-only).

operations*
string
length between 0 and 128
^[a-z0-9][a-z0-9-]{0,127}$

Stable KID of the EXISTING destination key for cross-kid REENCRYPT/RESIGN. Required when operations contains REENCRYPT or RESIGN, and forbidden otherwise — both violations are refused 422. The grant binds the PAIR as asset_kids [keyKid, targetKeyKid], written source-first by convention — the order records intent and is not enforced: the runtime matches a grant's asset set with containsAll, a subset test, so the same grant authorizes the reversed pair too. Setting targetKeyKid equal to keyKid is VALID and expresses an in-place migration across material versions of one key. Patent-critical: the REENCRYPT capability authorizes re-encryption over that pair WITHOUT granting standalone DECRYPT.

validityWindow
object

Optional validity window for the underlying Constraint Policy. Defaults: validFrom=now, validUntil=now+1y when omitted (server-side).

Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Updated 11 days ago

Did this page help you?
Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json

Updated 11 days ago

Did this page help you?