Get supported algorithms (crypto-agility)

Returns the algorithm catalogue with full metadata for crypto-agility decisions.
Supports optional server-side filtering via query parameters.

Query Parameters (all optional)

ParameterTypeLogicDescription
categorystring=CLASSICAL, POST_QUANTUM, or HYBRID
statusstring=RECOMMENDED, EXPERIMENTAL, or LEGACY
minSecurityLevelint>=Minimum NIST level (1, 3, 5)
maxSecurityLevelint<=Maximum NIST level (1, 3, 5)
keyOpsarrayANDRequired operations (must support ALL)
standardsarrayANDRequired standards (must have ALL)
ktyarrayORPublished key types (matches ANY, including COMPOSITE). An unpublished token is refused with 400
algarrayORAlgorithms (matches ANY)

Response fields

FieldTypeDescription
ktystringKey type: ML-KEM, ML-DSA, RSA, EC, oct (simple) or COMPOSITE (every hybrid pairing)
compositeModestringHow a hybrid entry's components are combined. Present only on composite entries
algstringAlgorithm identifier: ML-KEM-768, RSA-4096 (simple) or X25519+ML-KEM-768 (composite)
keyOpsarrayPermitted operations: encrypt, decrypt, sign, verify
statusstringRECOMMENDED, EXPERIMENTAL, or LEGACY
sunsetDatedatePlanned deprecation date (ISO 8601, optional)
advisorystringMigration or security guidance (optional)
securityLevelintegerNIST security level (1-5)
standardsarrayEndorsing standards, from the single platform vocabulary: ANSSI, BSI, CRYPTREC, ENISA, ETSI, GMT, GOST, IETF, ISO, KISA, MYSEAL, NCA_NCS, NIST, NSA
categorystringCLASSICAL, POST_QUANTUM, or HYBRID

Composite algorithm entries

Composite algorithms appear as first-class entries with:

  • category: "HYBRID"
  • kty: the single coarse token COMPOSITE, for every hybrid pairing
  • compositeMode: how the components are combined — the construction, on its own axis
  • alg: Combined identifier (e.g., "X25519+ML-KEM-768", "Ed25519+ML-DSA-65")

Use category=HYBRID to filter composite entries only.

Example queries

# Post-quantum algorithms only
GET /api/key-management/supported-algorithms?category=POST_QUANTUM

# Hybrid/composite algorithms only
GET /api/key-management/supported-algorithms?category=HYBRID

# High security, recommended algorithms
GET /api/key-management/supported-algorithms?minSecurityLevel=3&status=RECOMMENDED

# Signature algorithms with NIST compliance
GET /api/key-management/supported-algorithms?keyOps=sign,verify&standards=NIST

# Find specific composite algorithm
GET /api/key-management/supported-algorithms?alg=X25519+ML-KEM-768
Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Query Params
string

Filter by category: CLASSICAL, POST_QUANTUM, or HYBRID

string

Filter by status: RECOMMENDED, EXPERIMENTAL, or LEGACY

int32

Minimum NIST security level (1, 3, or 5)

int32

Maximum NIST security level (1, 3, or 5)

keyOps
array of strings, unique

Required operations (comma-separated). Must support ALL specified.

keyOps
standards
array of strings, unique

Required standards (comma-separated). Must have ALL specified.

standards
kty
array of strings, unique

Key types (comma-separated, OR logic). Matches ANY specified. Use COMPOSITE for hybrid algorithms — a composite entry's construction is selected with compositeMode, not here. An unpublished token is a 400 that names the accepted set, never a silently empty page.

alg
array of strings, unique

Algorithms (comma-separated, OR logic). Matches ANY specified.

alg
compositeMode
array of strings, unique

Composite construction modes (comma-separated, OR logic): COMPOSITE_KEM_COMBINE or COMPOSITE_SIGNATURE. Selects among hybrid algorithms, which all publish kty=COMPOSITE. Simple algorithms never match. An unpublished construction is a 400 that names the accepted set, never a silently empty page.

Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json