# Alibaba Cloud CloudHSM API

> Alibaba Cloud CloudHSM API on Apizie: 44 endpoints (Enables or disables the audit log feature and delivers audit logs to buckets, Configure the name and remark information of a backup, Modifies the execution pattern of a backup task, Configures a certificate for a cluster of hardware security modules (HSMs) outside the Chinese mainland, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:aliyun-hsm/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-hsm`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/hsm
- Page: https://zieapi.vercel.app/api/cloud/aliyun-hsm
- OpenAPI: https://zieapi.vercel.app/api/cloud/aliyun-hsm/openapi.json

Alibaba Cloud OpenAPI for CloudHSM (hsm, version 2023-11-13). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Enables or disables the audit log feature and delivers audit logs to buckets
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-audit-log` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| RegionId | string | yes | The ID of the region |
| AuditOssBucket | string | no | The bucket to which audit logs are delivered |
| AuditAction | string | yes | Specifies whether to enable the audit log feature. Valid values: enable disable |

### Configure the name and remark information of a backup
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-backup-remark` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| BackupId | string | yes | The backup ID |
| Remark | string | no | The remark information of the backup |
| Name | string | no | The backup name |

### Modifies the execution pattern of a backup task
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-backup-task` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| BackupId | string | yes | The backup ID |
| BackupPeriod | integer | yes | The automatic backup interval, in days. Valid values: 1, 3, 7, and 30 |
| BackupHourInDay | integer | yes | The backup time in 24-hour format. Valid values: 1 to 24 |
| Manual2PeriodicList | string | no | A list of image IDs to change from manual backup to automatic backup (JSON-encoded) |
| Periodic2ManualList | string | no | A list of image IDs to change from automatic backup to manual backup (JSON-encoded) |

### Configures a certificate for a cluster of hardware security modules (HSMs) outside the Chinese mainland
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-cluster-certificate` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The ID of the cluster |
| IssuerCertificate | string | yes | The self-signed certificate |
| ClusterCertificate | string | yes | The cluster certificate |

### Modifies the name of a cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-cluster-name` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The cluster ID |
| ClusterName | string | yes | The cluster name |

### Modifies a list of vSwitches that are associated with a hardware security module (HSM) cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-cluster-subnet` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The ID of the cluster. You can call the ListCluster operation to obtain cluster IDs |
| RegionId | string | yes | The ID of the region |
| VpcId | string | yes | The ID of the virtual private cloud (VPC) |
| VSwitchIds | string | yes | A list of vSwitches that are associated with the cluster. Note: You must include all vSwitches that you want to associate with the cluster… |

### Modifies the IP address whitelist of a cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-cluster-whitelist` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The ID of the cluster |
| Whitelist | string | yes | The IP address whitelist of the cluster |

### Modifies the remarks for an image
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-image-remark` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ImageId | string | yes | The image ID |
| Remark | string | yes | The remarks of the image |

### Modifies the virtual private cloud (VPC) endpoint of a hardware security module (HSM)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-instance-ip-address` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| RegionId | string | yes | The ID of the region |
| InstanceId | string | yes | The ID of the HSM |
| VpcId | string | yes | The ID of the VPC to which the HMS belongs |
| VSwitchId | string | yes | The ID of the vSwitch to which the HMS belongs |
| Ip | string | yes | The endpoint of the VPC to which the HMS belongs |

### Modifies the remark of an instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-instance-remark` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The ID of the HSM instance |
| Remark | string | yes | The remarks |

### Modifies the whitelist for an instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-instance-whitelist` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The ID of the HSM instance |
| Whitelist | string | yes | The list of IP addresses to add to the whitelist. Separate multiple IP addresses with spaces or commas (,) |

### Copies an image to another region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/copy-image` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ImageUid | string | no | The image ID |
| TargetRegionId | string | no | The ID of the destination region |

### Creates a cluster by designating an HSM instance as the master HSM
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/create-cluster` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterName | string | yes | The name of the cluster |
| RegionId | string | yes | The region ID |
| MasterInstanceId | string | yes | The ID of the master HSM instance |

### Deletes the specified cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/delete-cluster` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The cluster ID |

### Queries the regions that support Cloud Hardware Security Module (CloudHSM)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/describe-regions` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| AcceptLanguage | string | no | The language of the query results. Valid values: zh: Chinese en: English |

### Download cluster managed certificate
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/download-cluster-managed-cert` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | Cluster ID |

### Enables backup for a specified instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/enable-backup` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The ID of the HSM instance |
| BackupId | string | yes | The ID of the backup |

### Exports an image of a specified Encryption Service instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/export-image` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The Encryption Service instance ID |
| ImageId | string | yes | The image ID |

### Queries the status of the audit log feature in the current region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/get-audit-log-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| RegionId | string | yes | The ID of the region |
| GetOssBucket | string | no | Specifies whether to obtain the list of OSS buckets that can be used to store audit logs. Valid values: true false |

### Retrieves information about a specific backup
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/get-backup` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| BackupId | string | no | The backup ID |

### Queries information about a specified cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/get-cluster` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The cluster ID |

### Retrieves information about a specified image
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/get-image` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ImageId | string | yes | The image ID |

### Queries information about a specified instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/get-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | no | The instance ID of the Encryption Service instance |

### Retrieves the details of an asynchronous task
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/get-job` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| JobId | string | yes | The ID of the task |

### Authorizes the Encryption Service instance to deliver logs
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/initialize-audit-log` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |

### Initializes a cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/initialize-cluster` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The ID of the cluster |

### Add an HSM instance outside the cluster to the current cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/join-cluster` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | Cluster ID |
| InstanceId | string | yes | The ID of the HSM instance to be added to the cluster |

### Removes a hardware security module (HSM) from the current cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/leave-cluster` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The ID of the cluster |
| InstanceId | string | yes | The ID of the HSM |

### Retrieves a list of backup sets that meet specified conditions
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/list-backups` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| RegionId | string | yes | The region ID |
| CurrentPage | integer | yes | The current page number |
| PageSize | integer | yes | The number of backups to return on each page. Valid values: 1 to 1000 |
| Name | string | no | The name of the backup |
| BackupId | string | no | The ID of the backup |
| InstanceId | string | no | The ID of the Hardware Security Module (HSM) instance |

### Retrieves clusters that match the specified query conditions
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/list-clusters` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| RegionId | string | yes | The region ID |
| KmsInstanceId | string | no | 密钥管理服务实例ID |
| CurrentPage | integer | yes | The current page number |
| PageSize | integer | yes | The number of clusters to display per page. Valid values: 1 to 1000 |

### Queries the images that meet the specified conditions
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/list-images` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| BackupId | string | yes | The ID of the backup |
| RegionId | string | yes | The ID of the region |
| PageSize | integer | yes | The number of images per page. Valid values: 1 to 1000 |
| CurrentPage | integer | yes | The page number |
| Mode | string | no | The image generation mode. Valid values: PERIODIC: It is automatically generated. MANUAL: It is manually generated |

### Retrieves instances that match the specified query conditions
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/list-instances` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| RegionId | string | yes | The region ID |
| KmsInstanceId | string | no | 密钥管理服务实例ID |
| CurrentPage | integer | yes | The current page number |
| PageSize | integer | yes | The number of entries per page. Valid values: 1 to 1000 |
| TenantIsolationType | string | no | The HSM hardware isolation type. Valid values: vsm: virtual HSM. hostedHsm: hosted HSM |

### Moves a resource to a new resource group
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/move-resource-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ResourceId | string | yes | The ID of the hardware security module (HSM) |
| ResourceGroupId | string | yes | The ID of the resource group |
| ResourceType | string | yes | The type of the resource |
| RegionId | string | yes | The ID of the region |

### Disables a hardware security module (HSM)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/pause-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The ID of the HSM |

### Deploys a cluster quickly
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/quick-deploy-cluster` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| VSwitchIdList | string | yes | The list of vSwitches for the cluster (JSON-encoded) |
| VpcId | string | yes | The ID of the VPC to which the HSM instance belongs |
| WhiteList | string | no | The access whitelist for the cluster (JSON-encoded) |
| InstanceList | string | yes | The list of HSM instances (JSON-encoded) |
| ClusterName | string | yes | The cluster name |
| RegionId | string | yes | The region ID |
| CertManaged | string | no | Specifies whether to automatically generate a certificate. true: Yes false: No |

### Initializes an instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/quick-init-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The ID of the HSM instance |

### Disassociates a backup from a hardware security module (HSM)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/reset-backup` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| BackupId | string | no | The ID of the backup |

### Resets a hardware security module (HSM)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/reset-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The ID of the HSM |

### Restores instance data from an image
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/restore-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The ID of the HSM instance |
| ImageId | string | yes | The ID of the image from which to restore the instance |

### Resumes a deactivated instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/resume-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| InstanceId | string | yes | The ID of the HSM instance |

### Rotates a managed certificate for a cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/rotate-cluster-managed-cert` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The cluster ID |

### Switches the master role in a cluster to a subordinate HSM. This operation is not supported for manually…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/switch-cluster-master` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The cluster ID |
| InstanceId | string | yes | The ID of the HSM instance to be set as the master HSM |

### Synchronizes the data of hardware security modules (HSMs) in a cluster
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/sync-cluster` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |
| ClusterId | string | yes | The ID of the cluster |

### version
`POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://hsm.aliyuncs.com |

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-audit-log" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud CloudHSM API?
Create a free Apizie key, then send POST https://zieapi.vercel.app/v1/cloud:aliyun-hsm/config-audit-log with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud CloudHSM API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud CloudHSM itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud CloudHSM API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-hsm.

### What is the status of the Alibaba Cloud CloudHSM API?
Needs your own provider key (bring your own key)