Updated on 2026-10-12 GMT+08:00

Decrypting a DEK

Function

This API is used to decrypt DEKs using specified CMKs.

Calling Method

For details, see Calling APIs.

URI

POST /v1.0/{project_id}/kms/decrypt-datakey

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID. For details, see Obtaining a Project ID. Constraints N/A Range The value returned by the IAM API is used, which contains 32 characters. Default Value N/A

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. It can be obtained by calling the IAM API. The value of X-Subject-Token in the response header is the user token. Constraints N/A Range Obtain the value by calling the IAM API for obtaining the user token. Default Value N/A

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
key_id	Yes	String	Definition Key ID Constraints The value must be a 36-byte ID. The value must match the regular expression ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$. Range N/A Default Value N/A
cipher_text	Yes	String	Definition Hexadecimal string of the DEK ciphertext and metadata Constraints The value is the cipher_text in the DEK encryption result. Range N/A Default Value N/A
datakey_cipher_length	Yes	String	Definition Key byte length. Constraints N/A Range 1 to 1,024 Default Value N/A
additional_authenticated_data	No	String	Definition Non-sensitive extra data used for authentication Constraints Maximum length: 128 bytes Range Any string Default Value N/A
sequence	No	String	Definition A 36-byte serial number of a request message, for example, 919c82d4-8046-4722-9094-35c3c6524cff. Constraints N/A Range N/A Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
data_key	String	Definition Hexadecimal string of the DEK plaintext Range N/A
datakey_length	String	Definition Length of a plaintext DEK, in bytes Range N/A
datakey_dgst	String	Definition Hexadecimal string corresponding to the SHA-256 hash value of the DEK plaintext Range N/A

Example Requests

Decrypt a ciphertext DEK into a 64-byte plaintext DEK using the key whose ID is 0d0466b0-e727-4d9c-b35d-f84bb474a37f and add 123aad as the associated data.

{
  "key_id" : "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
  "cipher_text" : "020098005273E14E6E8E95F5463BECDC27E80AFxxxxxxxxxx...",
  "datakey_cipher_length" : "64",
  "additional_authenticated_data" : "123aad"
}

Example Responses

Status code: 200

{
  "data_key" : "000000e724d9cb35df84bb474a37fXXX...",
  "datakey_length" : "64",
  "datakey_dgst" : "F5A5FD42D16A20302798EF6ED3099XXX..."
}

Status Codes

Status Code	Description
200	Request succeeded.

Error Codes

See Error Codes.

Parent Topic: DEK Management