keyprotect

type APIClient struct {
	ImportTokensApi *ImportTokensApiService

	KeysApi *KeysApiService

	PoliciesApi *PoliciesApiService
	// contains filtered or unexported fields
}

type APIKey struct {
	Key    string
	Prefix string
}

type APIResponse struct {
	*http.Response `json:"-"`
	Message        string `json:"message,omitempty"`
	// Operation is the name of the OpenAPI operation.
	Operation string `json:"operation,omitempty"`
	// RequestURL is the request URL. This value is always available, even if the
	// embedded *http.Response is nil.
	RequestURL string `json:"url,omitempty"`
	// Method is the HTTP method used for the request.  This value is always
	// available, even if the embedded *http.Response is nil.
	Method string `json:"method,omitempty"`
	// Payload holds the contents of the response body (which may be nil or empty).
	// This is provided here as the raw response.Body() reader will have already
	// been drained.
	Payload []byte `json:"-"`
}

type ActionOnKeyOpts struct {
	CorrelationId optional.String
	Prefer        optional.String
}

type BasicAuth struct {
	UserName string `json:"userName,omitempty"`
	Password string `json:"password,omitempty"`
}

type CollectionMetadata struct {
	// The number of elements in the resource array.
	CollectionTotal int64 `json:"collectionTotal"`
	// The type of resources in the resource array.
	CollectionType string `json:"collectionType"`
}

type Configuration struct {
	BasePath      string            `json:"basePath,omitempty"`
	Host          string            `json:"host,omitempty"`
	Scheme        string            `json:"scheme,omitempty"`
	DefaultHeader map[string]string `json:"defaultHeader,omitempty"`
	UserAgent     string            `json:"userAgent,omitempty"`
	HTTPClient    *http.Client
}

type CreateKey struct {
	Metadata CollectionMetadata `json:"metadata"`
	// An array of resources.
	Resources []Key `json:"resources"`
}

type CreateKeyOpts struct {
	CorrelationId optional.String
	Prefer        optional.String
}

type CreatePolicy struct {
	Metadata CollectionMetadata `json:"metadata"`
	// An array of resources.
	Resources []Policy `json:"resources"`
}

type DeleteKey struct {
	Metadata CollectionMetadata `json:"metadata"`
	// An array of resources.
	Resources []KeyMetadata `json:"resources"`
}

type DeleteKeyOpts struct {
	CorrelationId optional.String
	Prefer        optional.String
}

type Error struct {
	// The conditions for an error response.
	ErrorMsg string `json:"errorMsg"`
}

type ErrorCollection struct {
	Metadata CollectionMetadata `json:"metadata"`
	// An array of resources.
	Resources []Error `json:"resources"`
}

type GenericOpenAPIError struct {
	// contains filtered or unexported fields
}

type GetImportToken struct {
	// The date the import token was created. The date format follows RFC 3339.
	CreationDate time.Time `json:"creationDate,omitempty"`
	// The time in seconds from the creation of an import token that determines how long its associated public key  remains valid.     The minimum value is `300` seconds (5 minutes), and the maximum value is `86400` (24 hours). The default value is `600` (10 minutes).
	Expiration float32 `json:"expiration,omitempty"`
	// The date the import token expires. The date format follows RFC 3339.
	ExpirationDate time.Time `json:"expirationDate,omitempty"`
	// The number of times that an import token can be retrieved within its expiration time before it is no longer accessible.
	MaxAllowedRetrievals float32 `json:"maxAllowedRetrievals,omitempty"`
	// The number of retrievals that are available for the import token before it is no longer accessible.
	RemainingRetrievals float32 `json:"remainingRetrievals,omitempty"`
	// The nonce value that is used to verify a key import request. Encrypt and provide the encrypted nonce value when you use `POST /keys` to securely import a key to the service.
	Nonce *os.File `json:"nonce,omitempty"`
	// The public encryption key that you can use to encrypt key material before you import it into the service.     This value is a PEM-encoded public key in PKIX format. Because PEM encoding is a binary format, the value is base64 encoded.
	Payload *os.File `json:"payload,omitempty"`
}

type GetImportTokenAllOf struct {
	// The nonce value that is used to verify a key import request. Encrypt and provide the encrypted nonce value when you use `POST /keys` to securely import a key to the service.
	Nonce *os.File `json:"nonce,omitempty"`
	// The public encryption key that you can use to encrypt key material before you import it into the service.     This value is a PEM-encoded public key in PKIX format. Because PEM encoding is a binary format, the value is base64 encoded.
	Payload *os.File `json:"payload,omitempty"`
}

type GetImportTokenOpts struct {
	CorrelationId optional.String
}

type GetKey struct {
	Metadata CollectionMetadata `json:"metadata"`
	// An array of resources.
	Resources []Key `json:"resources"`
}

type GetKeyCollectionMetadataOpts struct {
	CorrelationId optional.String
}

type GetKeyOpts struct {
	CorrelationId optional.String
}

type GetKeysOpts struct {
	CorrelationId optional.String
	Limit         optional.Int32
	Offset        optional.Int32
}

type GetPolicyOpts struct {
	CorrelationId optional.String
}

type ImportKey struct {
	Metadata CollectionMetadata `json:"metadata"`
	// An array of resources.
	Resources []Key `json:"resources"`
}

type ImportKeyWithImportToken struct {
	Metadata CollectionMetadata `json:"metadata"`
	// An array of resources.
	Resources []Key `json:"resources"`
}

type ImportToken struct {
	// The date the import token was created. The date format follows RFC 3339.
	CreationDate time.Time `json:"creationDate,omitempty"`
	// The time in seconds from the creation of an import token that determines how long its associated public key  remains valid.     The minimum value is `300` seconds (5 minutes), and the maximum value is `86400` (24 hours). The default value is `600` (10 minutes).
	Expiration float32 `json:"expiration,omitempty"`
	// The date the import token expires. The date format follows RFC 3339.
	ExpirationDate time.Time `json:"expirationDate,omitempty"`
	// The number of times that an import token can be retrieved within its expiration time before it is no longer accessible.
	MaxAllowedRetrievals float32 `json:"maxAllowedRetrievals,omitempty"`
	// The number of retrievals that are available for the import token before it is no longer accessible.
	RemainingRetrievals float32 `json:"remainingRetrievals,omitempty"`
}

type ImportTokensApiService service

type Key struct {
	// Up to 30 tags can be created. Tags can be between 2-30 characters, including spaces. Special characters not permitted include the angled bracket, comma, colon, ampersand, and vertical pipe character (|).    To protect your privacy, do not use personal data, such as your name or location, as a tag for your key.
	Tags []string `json:"tags,omitempty"`
	// The Cloud Resource Name (CRN) that uniquely identifies your cloud network resources.
	Crn string `json:"crn,omitempty"`
	// A text field used to provide a more detailed description of the key. The maximum length is 240 characters.    To protect your privacy, do not use personal data, such as your name or location, as a description for your  key.
	Description string `json:"description,omitempty"`
	// The date the key material expires. The date format follows RFC 3339. You can set an expiration date on any  key on its creation. If you create a key without specifying an expiration date, the key does not expire.
	ExpirationDate time.Time `json:"expirationDate,omitempty"`
	// A boolean value that determines whether the key material can leave the service.       If set to `false`, Key Protect designates the key as a nonextractable root key used for `wrap` and `unwrap` actions. If set to `true`, Key Protect designates the key as a standard key that you can store in your apps and services. Once set to `false` it cannot be changed to `true`.
	Extractable bool `json:"extractable,omitempty"`
	// The v4 UUID used to uniquely identify the resource, as specified by RFC 4122.
	Id string `json:"id,omitempty"`
	// A boolean value that shows whether your key was originally imported or generated in Key Protect. The value is set by Key Protect based on how the key material is initially added to the service.    A value of `true` indicates that you must provide new key material when it's time to rotate the key. A value  of `false` indicates that Key Protect will generate the new key material on a `rotate` operation, as it did in key creation.
	Imported bool `json:"imported,omitempty"`
	// A unique, human-readable alias to assign to your key.    To protect your privacy, do not use personal data, such as your name or location, as an alias for your key.
	Name string `json:"name"`
	// The key state based on NIST SP 800-57. States are integers and correspond to the Pre-activation = 0, Active = 1, Deactivated = 3, and Destroyed = 5 values.
	State int32 `json:"state,omitempty"`
	// Specifies the MIME type that represents the key resource. Currently, only the default is supported.
	Type string `json:"type"`
}

type KeyMetadata struct {
	AlgorithmMetadata KeyMetadataAlgorithmMetadata `json:"algorithmMetadata,omitempty"`
	// The algorithm type used to generate the key. Currently, AES is supported.
	AlgorithmType string `json:"algorithmType,omitempty"`
	// The unique identifier for the resource that created the key.
	CreatedBy string `json:"createdBy,omitempty"`
	// The date the key material was created. The date format follows RFC 3339.
	CreationDate time.Time `json:"creationDate,omitempty"`
	// Updates to show when the key was last rotated. The date format follows RFC 3339.
	LastRotateDate time.Time `json:"lastRotateDate,omitempty"`
	// Updates when any part of the key metadata is modified. The date format follows RFC 3339.
	LastUpdateDate time.Time `json:"lastUpdateDate,omitempty"`
	// A code indicating the reason the key is not in the activation state.
	NonactiveStateReason int32 `json:"nonactiveStateReason,omitempty"`
}

type KeyMetadataAlgorithmMetadata struct {
	// The algorithm bit size used for key encryption.
	BitLength string `json:"bitLength,omitempty"`
	// The encryption scheme used to generate the key. Currently, `CBC_PAD` is supported.
	Mode string `json:"mode,omitempty"`
}

type KeysApiService service

type ListKeys struct {
	Metadata CollectionMetadata `json:"metadata"`
	// An array of resources.
	Resources []Key `json:"resources"`
}

type PoliciesApiService service

type Policy struct {
	// The unique identifier for the resource that created the policy.
	CreatedBy string `json:"createdBy,omitempty"`
	// The date the policy was created. The date format follows RFC 3339.
	CreationDate time.Time `json:"creationDate,omitempty"`
	// The Cloud Resource Name (CRN) that uniquely identifies your cloud network resources.
	Crn string `json:"crn,omitempty"`
	// Updates when the policy is replaced or modified. The date format follows RFC 3339.
	LastUpdateDate time.Time      `json:"lastUpdateDate,omitempty"`
	Rotation       PolicyRotation `json:"rotation"`
	// Specifies the MIME type that represents the policy resource. Currently, only the default is supported.
	Type string `json:"type"`
	// The unique identifier for the resource that updated the policy.
	UpdatedBy string `json:"updatedBy,omitempty"`
}

type PolicyRotation struct {
	// Specifies the key rotation time interval in months
	IntervalMonth int32 `json:"interval_month,omitempty"`
}

type PostImportTokenOpts struct {
	CorrelationId optional.String
}

type PutPolicyOpts struct {
	CorrelationId optional.String
}

type RotateKey struct {
	// The key material that you want to import into the service for rotating an existing root key. This value is  required for a `rotate` action if you initially imported the key material when you created the key.     To rotate an imported root key, provide a base64 encoded payload in the request entity-body. To rotate a root key that was initially generated by Key Protect, omit the `payload` property and pass in an empty request entity-body.
	Payload string `json:"payload,omitempty"`
}

type SecureImport struct {
	// The encrypted nonce value that protects a key import request against replay attacks. This value must be encrypted by using the encrypted `payload` value that represents the key that you want to import into the service.    To retrieve a nonce value, use `GET /import_token`. Then, encrypt the value by using an AES-GCM encryption  method that is compatible with your environment.
	EncryptedNonce *os.File `json:"encryptedNonce"`
	// The RSA encryption algorithm that is used to encrypt the key material that you want to import into the  service. Currently, `RSAES_OAEP_SHA_256` is supported.
	EncryptionAlgorithm string `json:"encryptionAlgorithm"`
	// The initialization vector (IV) that is generated by the AES-GCM algorithm when you encrypt a nonce. The IV  value is required to decrypt the encrypted nonce value that you provide when you make a key import request  to the service.    To generate an IV, encrypt the `nonce` value by using an AES-GCM encryption method that is compatible with your environment. Then, supply the generated IV value when you import a key to the service.
	Iv *os.File `json:"iv"`
	// The encrypted key material that you want to store and manage in the service. The value must be base64 encoded.    First, retrieve the public key that is associated with your service instance by calling `GET /import_token`.  Then, use the public key to run RSA encryption on the key material that you want to import to the service.
	Payload *os.File `json:"payload"`
}

type UnwrapKey struct {
	// The additional authentication data (AAD) used to further secure the key.     If you supply AAD when you make a `wrap` call, you must specify the same AAD during a subsequent `unwrap` call.
	Aad []string `json:"aad,omitempty"`
	// The wrapped data encryption key (DEK) used in wrap actions when the query parameter is set to `unwrap`. The system requires a base64 encoded ciphertext and returns a base64 encoded plaintext in the response entity-body when you perform an `unwrap` action on a key.       **Note:** When you unwrap a wrapped data encryption key (WDEK) by using a rotated root key, the service returns a new ciphertext in the response entity-body. Each ciphertext remains available for `unwrap` actions.  If you unwrap a DEK with a previous ciphertext, the service also returns the latest ciphertext in the response.  Use the latest ciphertext for future unwrap operations.
	Ciphertext string `json:"ciphertext"`
	// The original data encryption key (DEK) that was used in wrap action. The value is base64 encoded.
	Plaintext string `json:"plaintext,omitempty"`
}

type WrapKey struct {
	// The additional authentication data (AAD) used to further secure the key.     If you supply AAD when you make a `wrap` call, you must specify the same AAD during a subsequent `unwrap` call.
	Aad []string `json:"aad,omitempty"`
	// The wrapped data encryption key (DEK) that you can export to your app or service. The value is base64 encoded.
	Ciphertext string `json:"ciphertext,omitempty"`
	// The data encryption key (DEK) used in wrap actions when the query parameter is set to `wrap`. The system returns a base64 encoded plaintext in the response entity-body when you perform an `unwrap` action on a key.     To wrap an existing DEK, provide a base64 encoded plaintext during a `wrap` action. To generate a new DEK, omit the `plaintext` property. Key Protect generates a random plaintext (32 bytes) that is rooted in an HSM and then wraps that value.
	Plaintext string `json:"plaintext"`
}