Updated on 2026-10-12 GMT+08:00

Creating a Plaintext-free DEK

Function

This API is used to create a data encryption key (DEK). The returned result contains only ciphertext.

Calling Method

For details, see Calling APIs.

URI

POST /v1.0/{project_id}/kms/create-datakey-without-plaintext

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID. For details, see Obtaining a Project ID. Constraints N/A Range The value returned by the IAM API is used, which contains 32 characters. Default Value N/A

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. It can be obtained by calling the IAM API. The value of X-Subject-Token in the response header is the user token. Constraints N/A Range Obtain the value by calling the IAM API for obtaining the user token. Default Value N/A

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
key_id	Yes	String	Definition Key ID Constraints The value must be a 36-byte ID. The value must match the regular expression ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$. Range N/A Default Value N/A
key_spec	No	String	Definition Bit length of the generated key Constraints Set either datakey_length or key_spec. If neither of them is specified, a 256-bit key is generated by default. If both of them are specified, only datakey_length takes effect. Range AES_256: A 256-bit symmetric key AES_128: A 128-bit symmetric key SM4: An SM4 key HMAC_256: An HMAC_256 key HMAC_384: An HMAC_384 key HMAC_512: An HMAC_512 key HMAC_SM3: An HMAC_SM3 key Default Value N/A
datakey_length	No	String	Definition Bit length of a key Constraints Set either datakey_length or key_spec. If neither of them is specified, a 256-bit key is generated by default. If both of them are specified, only datakey_length takes effect. The value must be a multiple of 8. Range 8 to 8192 Default Value N/A
additional_authenticated_data	No	String	Definition Non-sensitive extra data used for authentication Constraints Maximum length: 128 bytes Range Any string Default Value N/A
pin	No	String	Definition PIN code, which is used to authenticate the DEK. This parameter is valid only in the level-4 cryptography test scenario. Constraints N/A Range N/A Default Value N/A
pin_type	No	String	Definition PIN code type Constraints N/A Range PlainText: plaintext PIN CipherText: ciphertext PIN Default Value CipherText
sequence	No	String	Definition A 36-byte serial number of a request message, for example, 919c82d4-8046-4722-9094-35c3c6524cff. Constraints N/A Range N/A Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
key_id	String	Key ID.
cipher_text	String	Definition Encrypted ciphertext Range N/A

Example Requests

Create a 512-bit plaintext DEK and encrypt it using the key whose ID is 0d0466b0-e727-4d9c-b35d-f84bb474a37f. Do not return the plaintext key and add 123add as the associated data.

{
  "key_id" : "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
  "datakey_length" : "512",
  "additional_authenticated_data" : "123aad"
}

Example Responses

Status code: 200

{
  "key_id" : "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
  "cipher_text" : "020098009EEAFCE122CAA5927D2XXX..."
}

Status Codes

Status Code	Description
200	Request succeeded.

Error Codes

See Error Codes.

Parent Topic: DEK Management