# Manage & Operate › Key and Secret Manager API

> Part of the OVHcloud developer hub. Index of every page and section: https://developers.eu.ovhcloud.com/llms.txt
> The Manage & Operate product's sections: https://developers.eu.ovhcloud.com/reference/manage-operate/llms.txt
> Everything in one file: https://developers.eu.ovhcloud.com/llms-full.txt

> 3 operations of the OVHcloud API. Calls carry `authorization: Bearer $OVH_TOKEN`; the EU host is shown, Canada and the United States answer on api.ca.ovhcloud.com and api.us.ovhcloud.com.

Page: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/

OpenAPI v1: https://api.eu.ovhcloud.com/1.0/__schemas/developer-hub-navigation/manage-operate/key-and-secret-manager.json?format=openapi3
OpenAPI v2: https://api.eu.ovhcloud.com/v2/__schemas/developer-hub-navigation/manage-operate/key-and-secret-manager.json?format=openapi3

## Operations

- `GET /okms/resource` — List OKMS services
- `GET /okms/resource/{okmsId}` — Get an OKMS service
- `PUT /okms/resource/{okmsId}` — Update an OKMS service

## List OKMS services

`GET /v2/okms/resource`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/#get-okms-resource

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:resource/get`

Returns the OKMS services of the account, with their region, KMIP and REST endpoints, and counts of keys, secrets and KMIP objects.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Pagination-Cursor` | header | string |  | Pagination cursor |
| `X-Pagination-Size` | header | integer |  | Pagination size |
| `iamTags` | query | object |  | Filter resources on IAM tags |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.resource.ResponseWithIAM[] | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `iam` | iam.ResourceMetadata | read-only | IAM resource metadata |
| `iam.displayName` | string | read-only | Resource display name |
| `iam.id` | string (uuid) | read-only | Unique identifier of the resource |
| `iam.state` | iam.ResourceMetadata.StateEnum | read-only | Resource state — one of `EXPIRED`, `IN_CREATION`, `OK`, `SUSPENDED` |
| `iam.tags` | object | read-only | Resource tags. Tags that were internally computed are prefixed with ovh: |
| `iam.urn` | string | read-only | Unique resource name used in policies |
| `id` | string (uuid) | read-only | Unique identifier of the OKMS |
| `kmipEndpoint` | string | read-only | KMS kmip API endpoint |
| `kmipObjectCount` | integer | read-only | Number of KMIP objects (non destroyed) |
| `kmipRsaEndpoint` | string | read-only | KMS kmip RSA API endpoint |
| `pciDssEnabled` | boolean | read-only | Whether PCI-DSS compliance is enabled on the service |
| `pciDssEnabledAt` | string (date-time) | read-only | Tells when PCI-DSS compliance was enabled |
| `publicCA` | string | read-only | KMS public CA (Certificate Authority) |
| `publicRsaCA` | string | read-only | KMS public RSA CA (Certificate Authority) |
| `region` | okms.RegionEnum | read-only | Region the key management service runs in, which is where your keys and secrets are stored — one of `ap-south-mum`, `ap-southeast-sgp`, `ap-southeast-syd`, `ca-east-bhs`, `ca-east-tor`, `eu-central-waw`, `eu-south-mil`, `eu-west-eri`, `eu-west-gra`, `eu-west-lim`, `eu-west-par`, `eu-west-rbx`, … |
| `restEndpoint` | string | read-only | KMS rest API endpoint |
| `secretCount` | integer | read-only | Number of secrets |
| `secretVersionCount` | integer | read-only | Number of secret versions |
| `serviceKeyCount` | integer | read-only | Number of service keys |
| `serviceKeyCountDetails` | okms.resource.ServiceKeyCountDetails | read-only | Number of service keys per protection level |
| `serviceKeyCountDetails.hsm` | integer | read-only | Number of service keys with the HSM protection level |
| `serviceKeyCountDetails.software` | integer | read-only | Number of service keys with the SOFTWARE protection level |
| `swaggerEndpoint` | string | read-only | KMS rest API swagger UI |

```json
[
  {
    "iam": {
      "displayName": "string",
      "id": "00000000-0000-0000-0000-000000000000",
      "state": "EXPIRED",
      "tags": {
        "key": "string"
      },
      "urn": "string"
    },
    "id": "00000000-0000-0000-0000-000000000000",
    "kmipEndpoint": "string",
    "kmipObjectCount": 0,
    "kmipRsaEndpoint": "string",
    "pciDssEnabled": true,
    "pciDssEnabledAt": "2024-01-01T12:00:00Z",
    "publicCA": "string",
    "publicRsaCA": "string",
    "region": "ap-south-mum",
    "restEndpoint": "string",
    "secretCount": 0,
    "secretVersionCount": 0,
    "serviceKeyCount": 0,
    "serviceKeyCountDetails": {
      "hsm": 0,
      "software": 0
    },
    "swaggerEndpoint": "string"
  }
]
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/resource" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/resource")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/resource");

print_r($result);
?>
```

## Get an OKMS service

`GET /v2/okms/resource/{okmsId}`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/#get-okms-resource-okmsid

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:resource/get`

Returns the OKMS service with its endpoints and resource counts. Set `publicCA` to true to include the KMS public CA certificate.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `okmsId` | path | string (uuid) | yes | Okms ID |
| `publicCA` | query | boolean |  | Add KMS public CA (Certificate Authority) in the output |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.resource.ResponseWithIAM | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `iam` | iam.ResourceMetadata | read-only | IAM resource metadata |
| `iam.displayName` | string | read-only | Resource display name |
| `iam.id` | string (uuid) | read-only | Unique identifier of the resource |
| `iam.state` | iam.ResourceMetadata.StateEnum | read-only | Resource state — one of `EXPIRED`, `IN_CREATION`, `OK`, `SUSPENDED` |
| `iam.tags` | object | read-only | Resource tags. Tags that were internally computed are prefixed with ovh: |
| `iam.urn` | string | read-only | Unique resource name used in policies |
| `id` | string (uuid) | read-only | Unique identifier of the OKMS |
| `kmipEndpoint` | string | read-only | KMS kmip API endpoint |
| `kmipObjectCount` | integer | read-only | Number of KMIP objects (non destroyed) |
| `kmipRsaEndpoint` | string | read-only | KMS kmip RSA API endpoint |
| `pciDssEnabled` | boolean | read-only | Whether PCI-DSS compliance is enabled on the service |
| `pciDssEnabledAt` | string (date-time) | read-only | Tells when PCI-DSS compliance was enabled |
| `publicCA` | string | read-only | KMS public CA (Certificate Authority) |
| `publicRsaCA` | string | read-only | KMS public RSA CA (Certificate Authority) |
| `region` | okms.RegionEnum | read-only | Region the key management service runs in, which is where your keys and secrets are stored — one of `ap-south-mum`, `ap-southeast-sgp`, `ap-southeast-syd`, `ca-east-bhs`, `ca-east-tor`, `eu-central-waw`, `eu-south-mil`, `eu-west-eri`, `eu-west-gra`, `eu-west-lim`, `eu-west-par`, `eu-west-rbx`, … |
| `restEndpoint` | string | read-only | KMS rest API endpoint |
| `secretCount` | integer | read-only | Number of secrets |
| `secretVersionCount` | integer | read-only | Number of secret versions |
| `serviceKeyCount` | integer | read-only | Number of service keys |
| `serviceKeyCountDetails` | okms.resource.ServiceKeyCountDetails | read-only | Number of service keys per protection level |
| `serviceKeyCountDetails.hsm` | integer | read-only | Number of service keys with the HSM protection level |
| `serviceKeyCountDetails.software` | integer | read-only | Number of service keys with the SOFTWARE protection level |
| `swaggerEndpoint` | string | read-only | KMS rest API swagger UI |

```json
{
  "iam": {
    "displayName": "string",
    "id": "00000000-0000-0000-0000-000000000000",
    "state": "EXPIRED",
    "tags": {
      "key": "string"
    },
    "urn": "string"
  },
  "id": "00000000-0000-0000-0000-000000000000",
  "kmipEndpoint": "string",
  "kmipObjectCount": 0,
  "kmipRsaEndpoint": "string",
  "pciDssEnabled": true,
  "pciDssEnabledAt": "2024-01-01T12:00:00Z",
  "publicCA": "string",
  "publicRsaCA": "string",
  "region": "ap-south-mum",
  "restEndpoint": "string",
  "secretCount": 0,
  "secretVersionCount": 0,
  "serviceKeyCount": 0,
  "serviceKeyCountDetails": {
    "hsm": 0,
    "software": 0
  },
  "swaggerEndpoint": "string"
}
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/resource/{okmsId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/resource/{okmsId}");

print_r($result);
?>
```

## Update an OKMS service

`PUT /v2/okms/resource/{okmsId}`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/#put-okms-resource-okmsid

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:resource/update`

Enables or disables PCI-DSS enforcement on the service.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Request body (required)

Type: `okms.resource.UpdateRequest`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `pciDssEnabled` | boolean |  | Enable or disable PCI-DSS compliance |

```json
{
  "pciDssEnabled": true
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.resource.Response | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string (uuid) | read-only | Unique identifier of the OKMS |
| `kmipEndpoint` | string | read-only | KMS kmip API endpoint |
| `kmipObjectCount` | integer | read-only | Number of KMIP objects (non destroyed) |
| `kmipRsaEndpoint` | string | read-only | KMS kmip RSA API endpoint |
| `pciDssEnabled` | boolean | read-only | Whether PCI-DSS compliance is enabled on the service |
| `pciDssEnabledAt` | string (date-time) | read-only | Tells when PCI-DSS compliance was enabled |
| `publicCA` | string | read-only | KMS public CA (Certificate Authority) |
| `publicRsaCA` | string | read-only | KMS public RSA CA (Certificate Authority) |
| `region` | okms.RegionEnum | read-only | Region the key management service runs in, which is where your keys and secrets are stored — one of `ap-south-mum`, `ap-southeast-sgp`, `ap-southeast-syd`, `ca-east-bhs`, `ca-east-tor`, `eu-central-waw`, `eu-south-mil`, `eu-west-eri`, `eu-west-gra`, `eu-west-lim`, `eu-west-par`, `eu-west-rbx`, … |
| `restEndpoint` | string | read-only | KMS rest API endpoint |
| `secretCount` | integer | read-only | Number of secrets |
| `secretVersionCount` | integer | read-only | Number of secret versions |
| `serviceKeyCount` | integer | read-only | Number of service keys |
| `serviceKeyCountDetails` | okms.resource.ServiceKeyCountDetails | read-only | Number of service keys per protection level |
| `serviceKeyCountDetails.hsm` | integer | read-only | Number of service keys with the HSM protection level |
| `serviceKeyCountDetails.software` | integer | read-only | Number of service keys with the SOFTWARE protection level |
| `swaggerEndpoint` | string | read-only | KMS rest API swagger UI |

```json
{
  "id": "00000000-0000-0000-0000-000000000000",
  "kmipEndpoint": "string",
  "kmipObjectCount": 0,
  "kmipRsaEndpoint": "string",
  "pciDssEnabled": true,
  "pciDssEnabledAt": "2024-01-01T12:00:00Z",
  "publicCA": "string",
  "publicRsaCA": "string",
  "region": "ap-south-mum",
  "restEndpoint": "string",
  "secretCount": 0,
  "secretVersionCount": 0,
  "serviceKeyCount": 0,
  "serviceKeyCountDetails": {
    "hsm": 0,
    "software": 0
  },
  "swaggerEndpoint": "string"
}
```

### Example

```bash
curl -X PUT \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: okms.resource.UpdateRequest
result = client.put("/v2/okms/resource/{okmsId}",
	pciDssEnabled = None, # Enable or disable PCI-DSS compliance (type: boolean)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: okms.resource.UpdateRequest
$result = $ovh->put("/v2/okms/resource/{okmsId}", array(
	pciDssEnabled => null, // Enable or disable PCI-DSS compliance (type: boolean)
));

print_r($result);
?>
```