Get permitted algorithms for tenant (policy-filtered)

Returns cryptographic algorithms filtered by tenant-specific algorithm policies.

Policy Resolution

  1. Tenant-specific algorithm policy (if configured) — applied as a filter
  2. When no active policy exists for the tenant, the full catalog is returned (no restriction)

Filtering Logic

  • Algorithms explicitly denied by policy are excluded
  • Algorithms not mentioned in policy are included by default
  • Composite algorithms inherit filtering from component algorithms

Query Parameters (all optional, same as Core API)

ParameterTypeLogicDescription
categorystring=CLASSICAL, POST_QUANTUM, or HYBRID
statusstring=RECOMMENDED, EXPERIMENTAL, or LEGACY
minSecurityLevelint>=Minimum NIST level (1, 3, 5)
maxSecurityLevelint<=Maximum NIST level (1, 3, 5)
keyOpsarrayANDRequired operations (must support ALL)
standardsarrayANDRequired standards (must have ALL)
ktyarrayORKey types (matches ANY, including COMPOSITE)
algarrayORAlgorithms (matches ANY)

Use Cases

  • Populate key generation UI with permitted algorithms
  • Validate algorithm selection against policy
  • Audit effective algorithm permissions

Authentication & Authorization

  • JWT with tenantId claim matching path parameter
  • Scope: admin.tenant.algorithms.read
  • S2S calls from Core API: tenantId validation skipped (already validated in Core API)
Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
uuid
required

Tenant UUID

Query Params
string

Filter by category: CLASSICAL, POST_QUANTUM, or HYBRID

string

Filter by status: RECOMMENDED, EXPERIMENTAL, or LEGACY

int32

Minimum NIST security level (1, 3, or 5)

int32

Maximum NIST security level (1, 3, or 5)

keyOps
array of strings, unique

Required operations (comma-separated). Must support ALL specified.

keyOps
standards
array of strings, unique

Required standards (comma-separated). Must have ALL specified.

standards
kty
array of strings, unique

Key types (comma-separated, OR logic). Matches ANY specified. Use COMPOSITE for hybrid algorithms — a composite entry's construction is selected with compositeMode, not here. An unpublished token is a 400 that names the accepted set, never a silently empty page.

alg
array of strings, unique

Algorithms (comma-separated, OR logic). Matches ANY specified.

alg
compositeMode
array of strings, unique

Composite construction modes (comma-separated, OR logic): COMPOSITE_KEM_COMBINE or COMPOSITE_SIGNATURE. Selects among hybrid algorithms, which all publish kty=COMPOSITE. Simple algorithms never match. An unpublished construction is a 400 that names the accepted set, never a silently empty page.

Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json