API Reference
  1. Anka Secure Admin API
  2. Tenant Resources - Key Lifecycle

Import a PUBLIC key (simple or composite) into the tenant keystore

post
https://staging.ankatech.co/api/v3/admin/tenants//keys/import-key

Imports public key material for a simple or composite (hybrid) key, by S2S-proxying to
Core API. This endpoint imports PUBLIC keys only — private key material is never accepted.

Vocabulary constraints (both enforced upstream, both surfaced as 400)

  • kty MUST be a published key type. A stored value outside the vocabulary can neither
    be filtered on nor round-tripped, so it is refused rather than stored.
  • For a composite key, alg MUST name a pairing this deployment's composite catalogue
    carries. The construction — whether the component secrets are combined into one or
    signed independently — is resolved FROM the pairing rather than restated by the
    caller, so an uncatalogued pairing has no resolvable construction and cannot be
    served. Call GET /api/v3/admin/tenants/{tenantId}/supported-algorithms?kty=COMPOSITE
    for the pairings this deployment accepts — the tenant plane, reachable with the same
    tenant-scoped authorization this import already requires.

Authorization: requires scope migration.importKey.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
uuid
required
Body Params

Public-key import specification (kid, kty, alg, publicKey/components). Mirrors core-api KeyImportRequest.

Import request for a simple or composite (hybrid) PUBLIC cryptographic key. Mirrors core-api KeyImportRequest field-for-field.

string
required
length ≥ 1

Unique identifier (kid) for the key. If it exists, the supplied public key is validated against the stored key.

string
required
length ≥ 1

Key type. Simple: RSA, EC, ML-KEM, ML-DSA, etc. — and it must be a PUBLISHED key type; an unpublished spelling is refused with 400 naming the accepted set, because a stored value outside the vocabulary can neither be filtered on nor round-tripped. Composite: the single coarse token COMPOSITE — the construction is carried by compositeMode and follows from the pairing named in alg.

string
required
length ≥ 1

Algorithm identifier. Simple: ML-DSA-87, P-256, RSA-2048. Composite: a combined pairing (e.g., X25519+ML-KEM-768) that MUST be in this deployment's composite catalogue — the construction is resolved FROM the pairing, so an uncatalogued pairing has no resolvable construction and is refused with 400. Call GET /api/v3/admin/tenants/{tenantId}/supported-algorithms?kty=COMPOSITE for the pairings this deployment accepts.

string
enum
Defaults to SIMPLE

Key structure: SIMPLE (default) or COMPOSITE.

Allowed:
string

Base64-encoded public key (X.509 SubjectPublicKeyInfo). Required for simple asymmetric keys; omitted for composite keys (use components).

string

KDF algorithm for COMPOSITE_KEM_COMBINE keys (e.g., HKDF-SHA256).

string
enum
^(ALL|ANY|CLASSICAL_REQUIRED|PQC_REQUIRED)$

Verification policy for COMPOSITE_SIGNATURE keys. Core-api validates against its VerificationPolicy enum authoritatively.

Allowed:
components
array of objects

Component array for COMPOSITE keys (one classical + one PQC, typically). Required when type=COMPOSITE.

components
keyOps
array of strings

Permitted key operations. Public-only operations: encrypt, verify, wrapKey, deriveKey.

keyOps
boolean

Whether this key can be exported from the keystore.

string

ISO-8601 UTC expiration. Null means no expiration.

string

ISO-8601 UTC soft-limit expiration for warnings.

int32

Maximum usage operations allowed. 0 means unlimited.

int32

Soft-limit usage count for warnings.

Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Updated 11 days ago

Did this page help you?
Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json

Updated 11 days ago

Did this page help you?