Overview of Server-Side Encryption APIs

You can use APIs to configure encryption for existing buckets, as well as obtain and delete encryption configuration of existing buckets. For details, see Configuring Bucket Encryption, Obtaining Bucket Encryption Configuration, and Deleting the Encryption Configuration of a Bucket.

You can also configure encryption in the APIs for creating a bucket, uploading, downloading, and copying an object, as well as uploading an object in a multipart upload. The following table lists these APIs and parameters involved.

**Table 1** Server-side encryption APIs and parameters
Type	Header	Description	API for Creating a Bucket	API for Uploading an Object - PUT	API for Uploading an Object - POST
Request headers	x-obs-server-side-encryption	Specifies the encryption method.	kms: SSE-KMS is used for encryption. obs: SSE-OBS is used for encryption.	kms: SSE-KMS is used for encryption. AES256: SSE-OBS and the AES-256 algorithm are used.
	x-obs-server-side-data-encryption	Specifies the algorithm used for server-side encryption.	AES256: The AES-256 algorithm is used. AES-256 can be used for both SSE-KMS and SSE-OBS. SM4: The SM4 algorithm is used. SM4 can only be used for SSE-KMS.	If this header is not included, the AES-256 algorithm is used. SM4: The SM4 algorithm is used.
	x-obs-server-side-encryption-kms-key-id	Specifies the ID of the KMS CMK when SSE-KMS is used.	Key ID	Key ID	Key ID
	x-obs-sse-kms-key-project-id	Specifies the ID of the project to which the KMS CMK belongs when SSE-KMS is used.	Project ID	-	-
	x-obs-server-side-encryption-customer-algorithm	Specifies the algorithm for SSE-C.	-	AES256: SSE-C and the AES-256 algorithm are used.
	x-obs-server-side-encryption-customer-key	Specifies the plaintext key encoded in Base64 when SSE-C is used.	-	The plaintext key encoded in Base64
	x-obs-server-side-encryption-customer-key-MD5	Specifies the MD5 value of the key when SSE-C is used.	-	The Base64-encoded MD5 value of the key
	x-obs-copy-source-server-side-encryption-customer-algorithm	Specifies the algorithm for object copies when SSE-C is used.	-	-	-
	x-obs-copy-source-server-side-encryption-customer-key	Specifies the Base64-encoded key for object copies when SSE-C is used.	-	-	-
	x-obs-copy-source-server-side-encryption-customer-key-MD5	Specifies the MD5 value of the key used for object copies when SSE-C is used.	-	-	-
Response headers	x-obs-server-side-encryption	Specifies the server-side encryption method.	kms: SSE-KMS is used for encryption. obs: SSE-OBS is used for encryption.	kms: SSE-KMS is used for encryption. AES256: SSE-OBS and the AES-256 algorithm are used.
	x-obs-server-side-data-encryption	Specifies the algorithm used for server-side encryption.	AES256: The AES-256 algorithm is used. AES-256 can be used for both SSE-KMS and SSE-OBS. SM4: The SM4 algorithm is used. SM4 can only be used for SSE-KMS.	If this header is not included, the AES-256 algorithm is used. SM4: The SM4 algorithm is used.
	x-obs-server-side-encryption-kms-key-id	Specifies the ID of the KMS CMK when SSE-KMS is used.	The key ID is returned only for custom keys.	The key ID is returned for both default keys and custom keys.
	x-obs-sse-kms-key-project-id	Specifies the ID of the project to which the KMS CMK belongs when SSE-KMS is used.	The project ID is returned only for custom keys.
	x-obs-server-side-encryption-customer-algorithm	Specifies the algorithm for SSE-C.	-	AES256: SSE-C and the AES-256 algorithm are used.
	x-obs-server-side-encryption-customer-key-MD5	Specifies the Base64-encoded MD5 value of the key when SSE-C is used.	-	The Base64-encoded MD5 value of the key

**Table 2** Server-side encryption APIs and parameters
Type	Header	Description	API for Copying an Object	API for Initiating a Multipart Upload	API for Uploading Parts	API for Copying Parts	API for Completing a Multipart Upload
Request headers	x-obs-server-side-encryption	Specifies the encryption method.	kms: SSE-KMS is used for encryption. AES256: SSE-OBS and the AES-256 algorithm are used.		-	-	-
	x-obs-server-side-data-encryption	Specifies the algorithm used for server-side encryption.	AES256: The AES-256 algorithm is used. SM4: The SM4 algorithm is used.		-	-	-
	x-obs-server-side-encryption-kms-key-id	Specifies the ID of the KMS CMK when SSE-KMS is used.	Key ID		-	-	-
	x-obs-sse-kms-key-project-id	Specifies the ID of the project to which the KMS CMK belongs when SSE-KMS is used.	-	-	-	-	-
	x-obs-server-side-encryption-customer-algorithm	Specifies the algorithm for SSE-C.	AES256: SSE-C and the AES-256 algorithm are used.				-
	x-obs-server-side-encryption-customer-key	Specifies the plaintext key encoded in Base64 when SSE-C is used.	The plaintext key encoded in Base64				-
	x-obs-server-side-encryption-customer-key-MD5	Specifies the MD5 value of the key when SSE-C is used.	The Base64-encoded MD5 value of the key				-
	x-obs-copy-source-server-side-encryption-customer-algorithm	Specifies the algorithm for object copies when SSE-C is used.	AES256: The target object copy is encrypted using SSE-C and the AES-256 algorithm.	-	-	AES256: The target object copy is encrypted using SSE-C and the AES-256 algorithm.	-
	x-obs-copy-source-server-side-encryption-customer-key	Specifies the Base64-encoded key for object copies when SSE-C is used.	The plaintext key encoded in Base64	-	-	The plaintext key encoded in Base64	-
	x-obs-copy-source-server-side-encryption-customer-key-MD5	Specifies the Base64-encoded MD5 value of the key used for object copies when SSE-C is used.	The Base64-encoded MD5 value of the key	-	-	The Base64-encoded MD5 value of the key	-
Response headers	x-obs-server-side-encryption	Specifies the encryption method.	kms: SSE-KMS is used for encryption. AES256: SSE-OBS and the AES-256 algorithm are used.
	x-obs-server-side-data-encryption	Specifies the algorithm used for server-side encryption.	If this header is not included, the AES-256 algorithm is used. SM4: The SM4 algorithm is used.
	x-obs-server-side-encryption-kms-key-id	Specifies the ID of the KMS CMK when SSE-KMS is used.	Key ID
	x-obs-sse-kms-key-project-id	Specifies the ID of the project to which the KMS CMK belongs when SSE-KMS is used.	The project ID is returned only for custom keys.
	x-obs-server-side-encryption-customer-algorithm	Specifies the algorithm for SSE-C.	AES256: SSE-C and the AES-256 algorithm are used.
	x-obs-server-side-encryption-customer-key-MD5	Specifies the Base64-encoded MD5 value of the key when SSE-C is used.	The Base64-encoded MD5 value of the key

**Table 3** Server-side encryption APIs and parameters
Type	Header	Description	API for Downloading an Object	API for Querying Object Metadata
Request headers	x-obs-server-side-encryption	Specifies the encryption method.	-	-
	x-obs-server-side-data-encryption	Specifies the algorithm used for server-side encryption.	-	-
	x-obs-server-side-encryption-kms-key-id	Specifies the ID of the KMS CMK when SSE-KMS is used.	-	-
	x-obs-sse-kms-key-project-id	Specifies the ID of the project to which the KMS CMK belongs when SSE-KMS is used.	-	-
	x-obs-server-side-encryption-customer-algorithm	Specifies the algorithm for SSE-C.	AES256: SSE-C and the AES-256 algorithm are used.
	x-obs-server-side-encryption-customer-key	Specifies the plaintext key encoded in Base64 when SSE-C is used.	The plaintext key encoded in Base64
	x-obs-server-side-encryption-customer-key-MD5	Specifies the MD5 value of the key when SSE-C is used.	The Base64-encoded MD5 value of the key
	x-obs-copy-source-server-side-encryption-customer-algorithm	Specifies the algorithm for object copies when SSE-C is used.	-	-
	x-obs-copy-source-server-side-encryption-customer-key	Specifies the Base64-encoded key for object copies when SSE-C is used.	-	-
	x-obs-copy-source-server-side-encryption-customer-key-MD5	Specifies the Base64-encoded MD5 value of the key used for object copies when SSE-C is used.	-	-
Response headers	x-obs-server-side-encryption	Specifies the encryption method.	kms: SSE-KMS is used for encryption. AES256: SSE-OBS and the AES-256 algorithm are used.
	x-obs-server-side-data-encryption	Specifies the algorithm used for server-side encryption.	If this header is not included, the AES-256 algorithm is used. SM4: The SM4 algorithm is used.
	x-obs-server-side-encryption-kms-key-id	Specifies the ID of the KMS CMK when SSE-KMS is used.	Key ID
	x-obs-sse-kms-key-project-id	Specifies the ID of the project to which the KMS CMK belongs when SSE-KMS is used.	-	-
	x-obs-server-side-encryption-customer-algorithm	Specifies the algorithm for SSE-C.	AES256: SSE-C and the AES-256 algorithm are used.
	x-obs-server-side-encryption-customer-key-MD5	Specifies the Base64-encoded MD5 value of the key when SSE-C is used.	The Base64-encoded MD5 value of the key