Generate a cryptographic key (simple or composite hybrid).

post

https://{host}:{port}/api/v3/key-management/keys

Creates a new cryptographic key or updates metadata if the public key already exists.

Key Types (determined by 'kty' field)

Simple keys: Single algorithm keys (classical, symmetric, or post-quantum)
- kty values: oct, RSA, EC, OKP, ML-KEM, ML-DSA, FALCON, SLH-DSA, SM2, HQC
- Examples: AES-GCM-256, RSA-4096, P-256, ML-KEM-768, ML-DSA-65
Composite keys: Hybrid keys combining classical and post-quantum algorithms
- kty = COMPOSITE_KEM_COMBINE: For encryption (e.g., alg: X25519+ML-KEM-768)
- kty = COMPOSITE_SIGNATURE: For signatures (e.g., alg: Ed25519+ML-DSA-65)

Refer to GET /api/key-management/supported-algorithms for valid algorithms.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Unified key specification. The 'kty' field determines the key type:

Simple keys: oct, RSA, EC, ML-KEM, ML-DSA, etc.
Composite keys: COMPOSITE_KEM_COMBINE, COMPOSITE_SIGNATURE

Unified request for generating cryptographic keys. The 'kty' field determines key type: simple algorithm keys (oct, RSA, EC, ML-KEM, etc.) or composite hybrid keys (COMPOSITE_KEM_COMBINE, COMPOSITE_SIGNATURE). For composite keys, the 'alg' field specifies the algorithm combination (e.g., X25519+ML-KEM-768).

kid

string

required

Unique key identifier (kid). Must be unique within the tenant keystore.

kty

string

required

Key type (kty) - the discriminator for key generation.

Simple keys:

'oct': Symmetric keys (AES, Camellia, SM4, SEED, ARIA, ChaCha20)
'RSA': RSA asymmetric keys
'EC': Elliptic curve keys (P-256, P-384, P-521, brainpool)
'OKP': Edwards/Montgomery curves (Ed25519, Ed448, X25519, X448)
'ML-KEM': Post-quantum KEM (ML-KEM-512, ML-KEM-768, ML-KEM-1024)
'ML-DSA': Post-quantum signatures (ML-DSA-44, ML-DSA-65, ML-DSA-87)
'FALCON': Compact PQC signatures (FALCON-512, FALCON-1024)
'SLH-DSA': Stateless hash-based signatures
'SM2': China GM/T signatures
'HQC': Code-based PQC KEM

Composite keys:

'COMPOSITE_KEM_COMBINE': Hybrid KEM combining classical and PQC algorithms
'COMPOSITE_SIGNATURE': Dual signatures with classical and PQC algorithms

alg

string

required

Algorithm identifier.

Simple keys: Single algorithm identifier

Symmetric: AES-GCM-128, AES-GCM-256, Camellia-GCM-256, SM4-GCM-128, ChaCha20-Poly1305
RSA: RSA-2048, RSA-3072, RSA-4096
EC: P-256, P-384, P-521, brainpoolP256r1, brainpoolP384r1
ML-KEM: ML-KEM-512, ML-KEM-768, ML-KEM-1024
ML-DSA: ML-DSA-44, ML-DSA-65, ML-DSA-87

Composite keys: Combined algorithms with '+'

KEM: X25519+ML-KEM-768, P-384+ML-KEM-1024, etc.
Signatures: Ed25519+ML-DSA-65, P-384+ML-DSA-87, etc.

keyOps

array of strings

Permitted key operations. If not specified, auto-derived:

Symmetric/KEM: ["encrypt", "decrypt"]
Signature: ["sign", "verify"]
RSA/EC with dual capability: ["encrypt", "decrypt", "sign", "verify"]

keyOps

exportable

boolean

Defaults to false

Whether the public key material can be exported via migration endpoints.

expiresAt

string

Hard expiration date in ISO-8601 UTC format. After this date, key becomes unusable.

softLimitExpiration

string

Soft expiration date (warning threshold) in ISO-8601 UTC format. When reached, warnings are logged but key remains usable. Must be before expiresAt.

maxUsageLimit

int32

Maximum number of cryptographic operations allowed. 0 or null means unlimited.

softUsageLimit

int32

Soft usage limit (warning threshold). When reached, warnings are logged but operations continue. Must be less than maxUsageLimit.

kdf

string

Defaults to HKDF-SHA256

Key Derivation Function for COMPOSITE_KEM_COMBINE mode.
Only applicable when kty = COMPOSITE_KEM_COMBINE.
Supported values: HKDF-SHA256, HKDF-SHA384, HKDF-SHA512.
Ignored for simple keys and COMPOSITE_SIGNATURE.

verificationPolicy

string

enum

Defaults to ALL

Verification policy for COMPOSITE_SIGNATURE mode.
Only applicable when kty = COMPOSITE_SIGNATURE.

ALL: Both signatures must verify (strictest, recommended)
ANY: At least one signature must verify
CLASSICAL_REQUIRED: Classical required, PQC optional
PQC_REQUIRED: PQC required, classical optional
Ignored for simple keys and COMPOSITE_KEM_COMBINE.

Allowed:

composite

boolean

compositeKem

boolean

compositeSignature

boolean

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200Existing key metadata updated (same public key).

201New key created (metadata-only response).

400Invalid input: missing or malformed fields.

401Unauthorized: missing or invalid JWT token.

403Forbidden: authenticated user lacks the required scope.

409Conflict: key collision or key in an invalid state.

413Payload Too Large: one or more parameters exceed limits.

500Internal Server Error: unexpected cryptographic/keystore error.