Retiring a Grant

Function

This API is used to retire grants. After grants are retired, the granted users do not have the permission to operate keys.

For example, user A grants user B the permission to operate key A and grants user C the permission to revoke the grant. In this case, all users can retire the grant. After the grant is retired, user B cannot use key A.

Only the following users can retire a grant:

User who created the grant

User who has been granted the retiring_principal permission

User who has been granted the grantee_principal permission if retire-grant is contained in the grant list

Calling Method

For details, see Calling APIs.

URI

POST /v1.0/{project_id}/kms/retire-grant

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Project ID

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	User token. It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is the user token.

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
key_id	Yes	String	A 36-byte Key ID which matches the regular expression ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$, for example, 0d0466b0-e727-4d9c-b35d-f84bb474a37f.
grant_id	Yes	String	A 64-byte grant ID which matches the regular expression ^[A-Fa-f0-9]{64}$, for example, 7c9a3286af4fcca5f0a385ad13e1d21a50e27b6dbcab50f37f30f93b8939827d.
sequence	No	String	36-byte sequence number of a request message. Example: 919c82d4-8046-4722-9094-35c3c6524cff

Response Parameters

Status code: 200

Request succeeded.

Status code: 400

**Table 4** Response body parameters
Parameter	Type	Description
error	Object	Error message

**Table 5** ErrorDetail
Parameter	Type	Description
error_code	String	Error code returned by the error request
error_msg	String	Error information returned by the error request

Status code: 401

**Table 6** Response body parameters
Parameter	Type	Description
error	Object	Error message

**Table 7** ErrorDetail
Parameter	Type	Description
error_code	String	Error code returned by the error request
error_msg	String	Error information returned by the error request

Status code: 403

**Table 8** Response body parameters
Parameter	Type	Description
error	Object	Error message

**Table 9** ErrorDetail
Parameter	Type	Description
error_code	String	Error code returned by the error request
error_msg	String	Error information returned by the error request

Status code: 404

**Table 10** Response body parameters
Parameter	Type	Description
error	Object	Error message

**Table 11** ErrorDetail
Parameter	Type	Description
error_code	String	Error code returned by the error request
error_msg	String	Error information returned by the error request

Status code: 500

**Table 12** Response body parameters
Parameter	Type	Description
error	Object	Error message

**Table 13** ErrorDetail
Parameter	Type	Description
error_code	String	Error code returned by the error request
error_msg	String	Error information returned by the error request

Status code: 502

**Table 14** Response body parameters
Parameter	Type	Description
error	Object	Error message

**Table 15** ErrorDetail
Parameter	Type	Description
error_code	String	Error code returned by the error request
error_msg	String	Error information returned by the error request

Status code: 504

**Table 16** Response body parameters
Parameter	Type	Description
error	Object	Error message

**Table 17** ErrorDetail
Parameter	Type	Description
error_code	String	Error code returned by the error request
error_msg	String	Error information returned by the error request

Example Requests

Delete the grant (ID: 7c9a3286af4fcca5f0a385ad13e1d21a50e27b6dbcab50f37f30f93b8939827d) for the key whose ID is 0d0466b0-e727-4d9c-b35d-f84bb474a37f.

{
  "key_id" : "0d0466b0-e727-4d9c-b35d-f84bb474a37f",
  "grant_id" : "7c9a3286af4fcca5f0a385ad13e1d21a50e27b6dbcab50f37f30f93b8939827d"
}

Example Responses

None

Status Codes

Status Code	Description
200	Request succeeded.
400	Invalid request parameters.
401	Username and password are required for the requested page.
403	Authentication failed.
404	The resource does not exist.
500	Internal service error.
502	Failed to complete the request. The server receives an invalid response from the upstream server.
504	Gateway timed out.