# Alibaba Cloud KeyManagementService API

> Alibaba Cloud KeyManagementService API on Apizie: 92 endpoints (Decrypts data by using an asymmetric key, Encrypts data by using the public key of an asymmetric CMK, Generates a digital signature by using an asymmetric CMK, Verifies a digital signature by using the public key of an asymmetric CMK, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:aliyun-kms/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-kms`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/kms
- Page: https://zieapi.vercel.app/api/cloud/aliyun-kms
- OpenAPI: https://zieapi.vercel.app/api/cloud/aliyun-kms/openapi.json

Alibaba Cloud OpenAPI for KeyManagementService (kms, version 2016-01-20). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Decrypts data by using an asymmetric key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/asymmetric-decrypt` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| CiphertextBlob | string | yes | The ciphertext to be decrypted. The ciphertext is Base64-encoded. You can call the https://help.aliyun.com/document_detail/148131.html… |
| KeyId | string | yes | The ID of the key. You can also specify the alias or Alibaba Cloud Resource Name (ARN) of the key. For more information about aliases, see… |
| KeyVersionId | string | yes | The ID of the key version. The ID is the globally unique identifier (GUID) of the key version |
| Algorithm | string | yes | The decryption algorithm |
| DryRun | string | no | Specifies whether to enable the dry run mode. true: enables the dry run mode. false: disables the dry run mode. This is the default value.… |
| Recipient | string | no | The remote attestation |

### Encrypts data by using the public key of an asymmetric CMK
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/asymmetric-encrypt` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Plaintext | string | yes | The plaintext to be encrypted. The value must be Base64-encoded |
| KeyId | string | yes | The ID of the key. You can also specify the alias or the Amazon Resource Name (ARN) of the key. For more information about aliases, see… |
| KeyVersionId | string | yes | The ID of the key version. The ID must be a globally unique identifier. To obtain the key version ID, call the… |
| Algorithm | string | yes | The encryption algorithm |
| DryRun | string | no | Specifies whether to enable the dry run feature. true: enables the feature. false (default): disables the feature. The dry run feature is… |

### Generates a digital signature by using an asymmetric CMK
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/asymmetric-sign` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique identifier (GUID) of the customer master key (CMK). You can also specify the alias that is bound to the CMK. For more… |
| KeyVersionId | string | yes | The ID of the key version. The ID must be the GUID of the key version |
| Algorithm | string | yes | The signature algorithm |
| Digest | string | yes | The digest of the original message. The digest is generated using the hash algorithm that corresponds to the value of the Algorithm… |
| DryRun | string | no | Specifies whether to enable the dry-run feature. true: enables the feature. false (default): disables the feature. The dry-run feature is… |

### Verifies a digital signature by using the public key of an asymmetric CMK
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/asymmetric-verify` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique identifier (GUID) of the customer master key (CMK). You can also specify the alias that is bound to the CMK. For more… |
| KeyVersionId | string | yes | The ID of the key version. The ID must be the GUID of the key version |
| Algorithm | string | yes | The signature algorithm |
| Digest | string | yes | The digest that is generated using the hash algorithm that corresponds to the value of Algorithm to hash the original message. The value… |
| Value | string | yes | The signature value to be verified. The value is Base64-encoded |
| DryRun | string | no | Specifies whether to perform a dry run. true: performs a dry run. false (default): does not perform a dry run. A dry run is used to test… |

### Retrieves secret values in batches
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/batch-get-secret-value` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretsList | string | no | The list of secret information. You can query up to 20 different secrets at a time (JSON-encoded) |

### Cancels the deletion task of a CMK
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/cancel-key-deletion` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the CMK. The ID must be globally unique |

### Enables a Key Management Service (KMS) instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/connect-kms-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KmsInstanceId | string | yes | The ID of the KMS instance that you want to enable |
| VpcId | string | yes | The ID of the virtual private cloud (VPC) that is associated with the KMS instance |
| ZoneIds | string | yes | The two zones for the KMS instance. Dual-zone deployment improves service availability and disaster recovery capabilities |
| VSwitchIds | string | yes | The vSwitch in the two zones. The vSwitch must have at least one available IP address |
| KMProvider | string | yes | The provider of the KMS instance. Set the value to Aliyun |

### Creates an alias for a key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/create-alias` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the CMK. The ID must be globally unique |
| AliasName | string | yes | The alias of the CMK. The alias must be 1 to 255 characters in length and must contain the prefix `alias/`. The alias cannot be prefixed… |

### Creates an application access point (AAP)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/create-application-access-point` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the AAP |
| Description | string | no | The description of the AAP |
| AuthenticationMethod | string | no | The authentication method. Currently, only ClientKey is supported |
| Policies | string | yes | The permission policy. You can bind up to three permission policies to each AAP |

### Creates a client key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/create-client-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| AapName | string | yes | The operation that you want to perform. Set the value to CreateClientKey |
| Password | string | yes | The name of the AAP |
| NotAfter | string | no | The encryption password of the client key. The password must be 8 to 64 characters in length and must contain at least two of the… |
| NotBefore | string | no | The end of the validity period of the client key. Specify the time in the ISO 8601 standard. The time must be in UTC. The time must be in… |

### Creates a customer master key (CMK) for envelope encryption, digital signatures, or other cryptographic…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/create-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Description | string | no | The description of the key. The description can be 0 to 8,192 characters in length. |
| KeyUsage | string | no | The usage of the key. Valid values: ENCRYPT/DECRYPT: encrypts and decrypts data. SIGN/VERIFY: generates and verifies digital signatures.… |
| Origin | string | no | The source of the key material. Valid values: Aliyun_KMS (default): The key material is generated by Alibaba Cloud KMS. EXTERNAL: The key… |
| ProtectionLevel | string | no | You do not need to specify this parameter. KMS automatically sets an appropriate protection level for your key. The protection level of… |
| EnableAutomaticRotation | string | no | Specifies whether to enable automatic key rotation. Valid values: true: enables automatic key rotation. false (default): disables… |
| RotationInterval | string | no | The automatic rotation period. The format is \`integer\[unit]\`. \`integer\` indicates the length of the period. \`unit\` indicates the… |
| KeySpec | string | no | The specification of the key. The valid values vary based on the key management type. For more information about key specifications,… |
| DKMSInstanceId | string | no | The ID of the KMS instance. This parameter is required when you create a key for a KMS instance. This parameter is not required when you… |
| Tags | string | no | The tags to bind to the key. Each tag consists of a key-value pair (Key:Value), which includes a tag key and a tag value. Specify a… |
| Policy | string | no | The content of the key policy. The value is in the JSON format. The policy can be up to 32,768 bytes in length. For more information about… |
| KeyStorageMechanism | string | no | The key storage location. This parameter is valid only when DKMSInstanceId is specified for a hardware key management instance. Valid… |

### Creates a version for a customer master key (CMK)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/create-key-version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the CMK. The ID must be globally unique. You can also set the value to an alias that is bound to the CMK. For more information,… |

### Creates a network access rule to configure the private IP addresses or private CIDR blocks that are allowed…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/create-network-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the access control rule |
| Type | string | yes | The network type. Only private IP addresses are supported. Set the value to Private |
| Description | string | no | The description |
| SourcePrivateIp | string | no | The private IP address or private CIDR block. Separate multiple items with commas (,) |

### Creates a permission policy to configure the keys and secrets that are allowed to access
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/create-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the permission policy |
| Description | string | no | The description |
| KmsInstance | string | no | The scope of the permission policy. You need to specify the KMS instance that you want to access |
| Permissions | string | yes | The operations that can be performed. Valid values: RbacPermission/Template/CryptoServiceKeyUser: allows you to perform cryptographic… |
| Resources | string | yes | The key and secret that are allowed to access. Key: Enter a key in the `key/${KeyId}` format. To allow access to all keys of a KMS… |
| AccessControlRules | string | no | The name of the access control rule. For more information about how to query created access control rules, see… |

### Creates a secret and stores the initial version of the secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/create-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The secret name. The secret name must be unique within the current region. The name can be up to 192 characters in length and can contain… |
| VersionId | string | yes | The version ID of the initial version. The version ID must be unique within the secret. The version ID can be up to 64 characters in length |
| EncryptionKeyId | string | no | The ID of the key used to encrypt the secret value. The key and the secret must belong to the same KMS instance, and the key must be a… |
| SecretData | string | yes | The secret value. The value can be up to 30,720 bytes (30 KB) in length. KMS encrypts the value by using the specified key and stores it… |
| SecretDataType | string | no | The type of the secret value. Valid values: text: text. This is the default value. binary: binary data. When SecretType is set to Rds,… |
| Description | string | no | The description of the secret |
| Tags | string | no | The tags of the secret. Each tag is a key-value pair that consists of a tag key and a tag value. The tag key and tag value can be up to… |
| SecretType | string | no | The type of the secret. Valid values: Generic: generic secret. This is the default value. Rds: ApsaraDB RDS secret. Redis: Redis secret.… |
| ExtendedConfig | string | no | The extended configuration of the secret, which is used to specify the property of a specific secret type. The value can be up to 1,024… |
| EnableAutomaticRotation | string | no | Specifies whether to enable automatic rotation. Valid values: true: enables automatic rotation. false: disables automatic rotation. This… |
| RotationInterval | string | no | The interval for automatic rotation. Valid values: 6 hours to 8,760 hours (365 days). The value must be in the `integer[unit]` format.… |
| DKMSInstanceId | string | no | The instance ID of the KMS instance |
| Policy | string | no | The content of the access policy in JSON format. The maximum length is 32,768 bytes. For more information about secret policies, see… |

### Decrypts ciphertext
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/decrypt` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| CiphertextBlob | string | yes | The ciphertext to be decrypted. The ciphertext can be generated by calling the following API operations:… |
| EncryptionContext | string | no | The JSON string of key-value pairs. If you specify EncryptionContext when you call the https://help.aliyun.com/document_detail/28948.html,… |
| DryRun | string | no | Specifies whether to enable the dry run mode. Valid values: true: Enabled. false: Disabled. This is the default value. The dry run mode is… |
| Recipient | string | no | The trusted environment authentication information. AttestationDocument // The Base64-encoded trusted environment attestation document,… |

### Deletes an alias
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/delete-alias` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| AliasName | string | yes | The alias that you want to delete. The value must be 1 to 255 characters in length and must include the alias/ prefix |

### Deletes an application access point (AAP)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/delete-application-access-point` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the AAP that you want to delete |

### Deletes a client key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/delete-client-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| ClientKeyId | string | yes | The ID of the client key |

### Deletes the imported key material from a CMK. After deletion, the CMK enters the PendingImport state until…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/delete-key-material` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique ID of the CMK |

### Deletes a network access rule
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/delete-network-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the network control rule to delete |

### Deletes a permission policy
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/delete-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the permission policy that you want to delete |

### Deletes a secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/delete-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name of the secret |
| ForceDeleteWithoutRecovery | string | no | Specifies whether to forcibly delete the secret. If this parameter is set to true, the secret cannot be recovered. Valid values: true… |
| RecoveryWindowInDays | string | no | Specifies the recovery period of the secret if you do not forcibly delete it. Default value: 30. Unit: Days |

### Queries the status of Key Management Service (KMS) within your Alibaba Cloud account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/describe-account-kms-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |

### Retrieves the details of an application access point (AAP)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/describe-application-access-point` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the application access point (AAP) to query |

### Queries the metadata of a CMK, such as the key state, usage, and rotation configuration
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/describe-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the CMK. The ID must be globally unique. You can also set this parameter to an alias that is bound to the CMK. For more… |

### Queries the metadata of a specific CMK version
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/describe-key-version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique ID of the CMK. You can also set this parameter to an alias that is bound to the CMK. For more information, see… |
| KeyVersionId | string | yes | The globally unique ID of the CMK version. You can call the https://help.aliyun.com/document_detail/133966.html operation to query the… |

### Retrieves the details of a network access rule
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/describe-network-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the network rule to query |

### Retrieves the details of a permission policy
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/describe-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the permission policy that you want to query |

### Queries the regions where KMS is available
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/describe-regions` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |

### Queries the metadata of a secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/describe-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name of the secret |
| FetchTags | string | no | Specifies whether to return the resource tags of the secret. Valid values: true: The resource tags are returned. false: The resource tags… |

### Disables a key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/disable-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the CMK. The ID must be globally unique |

### Enables a key to encrypt and decrypt data
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/enable-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique ID of the CMK |

### Encrypts plaintext by using a symmetric CMK
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/encrypt` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the key. You can also specify the alias or Amazon Resource Name (ARN) of the key. For more information about aliases, see… |
| Plaintext | string | yes | The plaintext to be encrypted. The plaintext must be Base64-encoded |
| EncryptionContext | string | no | A JSON string that consists of key-value pairs. If you specify this parameter, you must specify the same parameter when you call the… |
| DryRun | string | no | Specifies whether to enable the dry run feature. true: enables the dry run feature. false (default): disables the dry run feature. The dry… |

### Exports a data key encrypted by a CMK. The data key is re-encrypted by a public key that you specify for…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/export-data-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| CiphertextBlob | string | yes | The ciphertext of the data key that is encrypted using a master key (CMK) |
| EncryptionContext | string | no | A JSON string that consists of key-value pairs. EncryptionContext is the encryption context that is passed in when the data key is… |
| PublicKeyBlob | string | yes | The public key in Base64 format |
| WrappingKeySpec | string | yes | The type of the public key specified by PublicKeyBlob. For more information about key types, see… |
| WrappingAlgorithm | string | yes | The encryption algorithm that is used to encrypt the data key using the public key specified by PublicKeyBlob. For more information about… |
| DryRun | string | no | Specifies whether to enable the DryRun mode. true false (default) The DryRun mode is used to test the API call and verify the permissions… |

### Generates a random data key, encrypts it by using a CMK and a public key that you specify, and returns both…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/generate-and-export-data-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the key. You can also specify the alias or Amazon Resource Name (ARN) of the key. For more information about aliases, see… |
| KeySpec | string | no | The length of the data key that you want to generate. Valid values: AES_256: a 256-bit symmetric key. AES_128: a 128-bit symmetric key. We… |
| NumberOfBytes | integer | no | The length of the data key that you want to generate. Valid values: 1 to 1024. Unit: bytes |
| EncryptionContext | string | no | A JSON string that consists of key-value pairs. If you specify this parameter, you must specify the same parameter when you call the… |
| PublicKeyBlob | string | yes | The public key that is encoded in Base64 |
| WrappingKeySpec | string | yes | The type of the key specified by PublicKeyBlob. For more information about key types, see… |
| WrappingAlgorithm | string | yes | The encryption algorithm that is used to encrypt the data key using the public key specified by PublicKeyBlob. For more information about… |
| DryRun | string | no | Specifies whether to enable the dry run feature. true: enables the feature. false (default): disables the feature. The DryRun mode is used… |

### Generates a random data key (DK) for local data encryption
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/generate-data-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the key. You can also specify the alias or Alibaba Cloud Resource Name (ARN) of the key. For more information about aliases, see… |
| KeySpec | string | no | Specifies the length of the generated DK. Valid values: AES_256: A 256-bit symmetric key. AES_128: A 128-bit symmetric key. Use KeySpec or… |
| NumberOfBytes | integer | no | Specifies the length of the generated DK in bytes. Valid values: 1 to 1024. Default value: If KeySpec is set to AES_256, the default value… |
| EncryptionContext | string | no | The JSON string of key-value pairs. If this parameter is specified, you must provide the same parameter when you call the… |
| DryRun | string | no | Specifies whether to enable the dry run mode. Valid values: true: Enabled. false: Disabled. Default value: false. The dry run mode is used… |
| Recipient | string | no | The trusted environment authentication information. AttestationDocument // The trusted environment attestation document in Base64… |

### Generates a random data key in only ciphertext form, without the plaintext copy
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/generate-data-key-without-plaintext` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique identifier of the CMK. You can also specify an alias that is bound to the CMK. For more information about how to use… |
| KeySpec | string | no | The length of the data key to generate. Valid values: AES_256: a 256-bit symmetric key AES_128: a 128-bit symmetric key Use KeySpec or… |
| NumberOfBytes | integer | no | The length of the data key to generate. Valid values: 1 to 1024. Unit: bytes |
| EncryptionContext | string | no | A JSON string of key-value pairs. If you specify this parameter, you must provide the same parameter when you call the Decrypt operation.… |
| DryRun | string | no | Specifies whether to enable the DryRun mode. true: enables the DryRun mode. false (default): disables the DryRun mode. The DryRun mode is… |

### Generates an HMAC message authentication code for a message by using a specified key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/generate-mac` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the key. You can also specify a key alias or a key Amazon Resource Name (ARN). For more information about aliases, refer to… |
| Message | string | yes | The data for which you want to generate a message authentication code. The value is Base64-encoded. For example, if the hexadecimal data… |
| Algorithm | string | yes | The algorithm that is used to generate the message authentication code. Valid values vary based on the key specification: HMAC_SM3… |
| DryRun | string | no | Specifies whether to enable DryRun mode. true: enabled false (default): disabled DryRun mode is used to test API calls and verify whether… |

### Retrieves a challenge from Key Management Service (KMS)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-challenge` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |

### Retrieves information about a client key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-client-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| ClientKeyId | string | yes | The ID of the client key |

### Queries the default KMS instance in a specified region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-default-kms-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |

### Queries the key policy of a CMK in a KMS instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-key-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID or Alibaba Cloud Resource Name (ARN) of the key. When you access a key in another Alibaba Cloud account, you must enter the ARN of… |
| PolicyName | string | no | The name of the key policy. Only the static value default is supported |

### Retrieves the details of a KMS instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-kms-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KmsInstanceId | string | yes | The ID of the KMS instance to query |

### Queries the quota usage and limits for a KMS instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-kms-instance-quota-infos` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KmsInstanceId | string | no | The ID of the KMS instance to query |
| ResourceType | string | no | The resource type. Valid values: `key`: key quota `secret`: secret quota `qps`: queries per second (QPS) quota `vpc`: Virtual Private… |

### Retrieves the plaintext of a managed data key (DK)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-managed-data-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| DataKeyName | string | no | The name of the managed data key (DK). This parameter is required |
| DataKeyVersionId | string | no | The version number of the managed data key (DK). This parameter is optional. If you set this parameter to a specific version number, the… |
| UseLatest | string | no | Specifies whether to use the latest version of the managed data key (DK) when no version number is provided. Valid values: true: Returns… |

### Queries the parameters that are used to import key material for a customer master key (CMK)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-parameters-for-import` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique ID of the CMK. You can import key material only for CMKs whose Origin parameter is set to EXTERNAL |
| WrappingAlgorithm | string | yes | The algorithm that is used to encrypt key material |
| WrappingKeySpec | string | yes | The type of the public key that is used to encrypt key material |

### Retrieves the public key of an asymmetric key. You can use the public key to encrypt data or verify a…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-public-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique identifier of the customer master key (CMK). This parameter can also be an alias that is bound to the CMK. For more… |
| KeyVersionId | string | yes | The globally unique identifier of the key version |
| DryRun | string | no | Specifies whether to enable the DryRun mode. true: enables the DryRun mode. false (default): disables the DryRun mode. The DryRun mode is… |

### Generates a random password string
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-random-password` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| PasswordLength | string | no | The number of bytes that the password to be generated contains. Valid values: 8 to 128. Default value: 32 |
| ExcludeCharacters | string | no | The characters that are not included in the password to be generated. Valid values: `Valid characters:… |
| ExcludeLowercase | string | no | Specifies whether to exclude lowercase letters. Valid values: true false |
| ExcludeUppercase | string | no | Specifies whether to exclude uppercase letters. Valid values: true false |
| ExcludeNumbers | string | no | Specifies whether to exclude digits. Valid values: true false |
| ExcludePunctuation | string | no | Specifies whether to exclude special characters. Valid values: true false |
| RequireEachIncludedType | string | no | Specifies whether to include all the preceding character types. Valid values: true false |

### Queries the access policy of a specified secret in a KMS instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-secret-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name or Alibaba Cloud Resource Name (ARN) of the credential. If you access a credential that belongs to another Alibaba Cloud account,… |
| PolicyName | string | no | The name of the credential policy. Only the static field default is supported |

### Retrieves the secret value
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/get-secret-value` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name or Alibaba Cloud Resource Name (ARN) of the secret. To access a secret that belongs to another Alibaba Cloud account, you must… |
| VersionStage | string | no | The version stage. Default value: ACSCurrent. If you specify this parameter, the secret value of the specified version stage is returned.… |
| VersionId | string | no | The version ID. ApsaraDB RDS secrets, PolarDB secrets, Redis/Tair secrets, RAM secrets, and ECS secrets do not support the VersionId… |
| FetchExtendedConfig | string | no | Specifies whether to retrieve the extended configuration of the secret. Valid values: true: Retrieves the extended configuration. false:… |
| DryRun | string | no | Specifies whether to enable the dry run mode. Valid values: true: Enables the dry run mode. false: Disables the dry run mode. This is the… |
| Recipient | string | no | The remote attestation |

### Imports externally generated key material into a CMK whose origin is EXTERNAL
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/import-key-material` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the CMK to be imported |
| EncryptedKeyMaterial | string | yes | The key material encrypted with the public key returned by GetParametersForImport, and then Base64-encoded |
| ImportToken | string | yes | The import token obtained by calling GetParametersForImport |
| KeyMaterialExpireUnix | integer | yes | The time when the key material expires. If this parameter is not specified or set this parameter to 0, the key material does not expire.… |

### Queries all aliases in the current region for the current account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-aliases` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| PageNumber | integer | no | The number of the page to return. Pages start from page 1. Default value: 1 |
| PageSize | integer | no | The number of entries to return on each page. Valid values: 0 to 100. Default value: 10 |

### Queries all aliases that are bound to a key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-aliases-by-key-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique ID of the CMK |
| PageNumber | integer | no | The number of the page to return. Valid values: an integer that is greater than 0. Default value: 1 |
| PageSize | integer | no | The number of entries to return on each page. Valid values: 0 to 101. Default value: 10 |

### Queries all application access points (AAPs) in the current region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-application-access-points` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| PageNumber | integer | no | The page number. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Valid values: 1 to 100. Default value: 20 |

### Queries all client keys within an AAP
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-client-keys` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| AapName | string | no | The name of the application access point (AAP) |

### Queries all versions of a specified CMK
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-key-versions` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique ID of the CMK. You can also set this parameter to an alias that is bound to the CMK. For more information, see… |
| PageNumber | integer | no | The number of the page to return. Pages start from page 1. Default value: 1 |
| PageSize | integer | no | The number of entries to return on each page. Valid values: 0 to 101. Default value: 10 |

### Queries the IDs and ARNs of all CMKs in the current region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-keys` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| PageNumber | integer | no | The page number. Valid values: greater than 0. Default value: 1. |
| PageSize | integer | no | The number of entries to return on each page. Valid values: 1 to 100. Default value: 10. |
| Filters | string | no | A filter for master keys. The filter consists of 0 to 10 key-value pairs. Key Description: The property to filter. Type: String. Values… |

### Queries all KMS instances in the current region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-kms-instances` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| PageNumber | integer | no | The number of the page to return. The default value is 1 |
| PageSize | integer | no | The number of entries to return on each page. Valid values: 1 to 100. Default value: 20 |

### Lists the key versions of a specified managed data key (DK)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-managed-data-key-versions` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| DataKeyName | string | no | The name of the managed data key (DK) to query. This parameter is required |
| PageNumber | integer | no | The page number. The value must be an integer greater than 0. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Valid values: 1 to 100. Default value: 10 |

### Queries all network access rules in the current region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-network-rules` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| PageNumber | integer | no | The page number. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Valid values: 1 to 100. Default value: 20 |

### Queries all permission policies in the current region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-policies` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| PageNumber | integer | no | The page number. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Valid values: 1 to 100. Default value: 20 |

### Queries the tags of a customer master key (CMK)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-resource-tags` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The globally unique ID of the CMK |

### Queries all version information of a secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-secret-version-ids` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The secret name or secret Amazon Resource Name (ARN). When accessing a secret under another Alibaba Cloud account, you must specify the… |
| IncludeDeprecated | string | no | Specifies whether to include secret versions that do not have version stages in the response. Valid values: false (default): does not… |
| PageNumber | integer | no | The page number of the current page in a paged query. Default value: 1 |
| PageSize | integer | no | The number of entries per page in a paged query. Default value: 20 |

### Queries all secrets in the current region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-secrets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| FetchTags | string | no | Specifies whether to return resource tags for each secret. Valid values: `true`: Resource tags are returned. `false` (default): Resource… |
| PageNumber | integer | no | The page number. The value must be greater than 0. Default: 1. |
| PageSize | integer | no | The page size. The value must be between 1 and 100. Default: 10. |
| Filters | string | no | Filters secrets based on specified conditions. The value is a list of up to 10 key-value pairs. When you filter by tag, the query returns… |

### Lists the tags that are bound to a key or a secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/list-tag-resources` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| RegionId | string | yes | The region ID of the resource. Call https://help.aliyun.com/document_detail/601478.html to query the most recent region list |
| NextToken | string | no | The pagination token that is used in the next request to retrieve a new page of results. If not all results are returned, the NextToken… |
| ResourceType | string | yes | The type of resource whose tags you want to query. Valid value: key secret |
| ResourceId | string | no | A list of resource IDs for which you want to query tags. You can enter a maximum of 50 resource IDs. Enter multiple resource IDs in the… |
| Tag | string | no | A list of tags that you want to query. Valid values of N: 1 to 20 (JSON-encoded) |

### Activates Key Management Service (KMS) for your Alibaba Cloud account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/open-kms-service` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |

### Stores a new version of a secret value for a generic secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/put-secret-value` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| VersionId | string | yes | The version ID of the secret. The version ID must be unique within the secret |
| SecretName | string | yes | The name or Alibaba Cloud Resource Name (ARN) of the secret. When you access a secret that belongs to another Alibaba Cloud account, you… |
| SecretData | string | yes | The secret value. The secret value is encrypted and stored in the specified new version |
| SecretDataType | string | no | The type of the secret value. Valid values: text (default) binary |
| VersionStages | string | no | The version stages that are attached to the secret version when it is stored. If you do not specify this parameter, KMS attaches… |

### Re-encrypts ciphertext under a different CMK without exposing the plaintext
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/re-encrypt` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| CiphertextBlob | string | yes | The ciphertext that you want to re-encrypt. This parameter can be the ciphertext that is returned after symmetric or asymmetric key… |
| SourceKeyId | string | no | The ID of the master key that is used to decrypt the ciphertext. The globally unique identifier of the master key. You must specify this… |
| SourceKeyVersionId | string | no | The ID of the key version that is used to decrypt the ciphertext. You must specify this parameter when CiphertextBlob is the data that is… |
| SourceEncryptionAlgorithm | string | no | If CiphertextBlob is the result of public key encryption, specify the public key encryption algorithm. For more information about the… |
| SourceEncryptionContext | string | no | A JSON string that consists of key-value pairs. If you specify this parameter when you call the… |
| DestinationKeyId | string | yes | The ID of the symmetric master key that is used to re-encrypt the data after the ciphertext is decrypted |
| DestinationEncryptionContext | string | no | A JSON string that consists of key-value pairs. This parameter specifies the encryption context for the destination master key… |
| DryRun | string | no | Specifies whether to enable the DryRun mode. true: enables the DryRun mode. false (default): disables the DryRun mode. The DryRun mode is… |

### Releases a pay-as-you-go KMS instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/release-kms-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KmsInstanceId | string | yes | The ID of the KMS instance |
| ForceDeleteWithoutBackup | string | no | Specifies whether to forcibly release the KMS instance if it has not been backed up. true: forcibly releases the instance. false… |

### Restores a deleted secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/restore-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name of the secret you want to restore |

### Immediately rotates a secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/rotate-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name of the secret |
| VersionId | string | yes | The version number of the secret after the secret is rotated. The version number is used to ensure the idempotence of the request. Secrets… |

### Deletes a specified customer master key (CMK)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/schedule-key-deletion` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the customer master key (CMK). The ID must be globally unique |
| PendingWindowInDays | integer | yes | The scheduled period after which the CMK is deleted. During this period, the CMK is in the PendingDeletion state. After this period ends,… |

### Enables or disables deletion protection for a customer master key (CMK)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/set-deletion-protection` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| ProtectedResourceArn | string | no | The ARN of the CMK for which you want to set deletion protection. You can call the https://help.aliyun.com/document_detail/28952.html… |
| EnableDeletionProtection | string | yes | Specifies whether to enable deletion protection. Valid values: true: enables deletion protection. false (default): disables deletion… |
| DeletionProtectionDescription | string | no | The description of deletion protection. This parameter is valid only when EnableDeletionProtection is set to true |
| KeyId | string | no | The ID of the key |
| KmsInstanceId | string | no | The KmsInstanceId |

### Sets the key policy for a CMK in a KMS instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/set-key-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID or Alibaba Cloud Resource Name (ARN) of the key. To access a key of another Alibaba Cloud account, you must specify the ARN of the… |
| PolicyName | string | no | The name of the key policy. The name can only be \`default\` |
| Policy | string | yes | The key policy. The policy is in the JSON format. The policy can be up to 32,768 bytes in length. A key policy contains the following… |

### Sets the access policy for a secret in a KMS instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/set-secret-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name or Alibaba Cloud Resource Name (ARN) of the secret. When you access a secret in another Alibaba Cloud account, you must specify… |
| PolicyName | string | no | The name of the secret policy. The value can only be \`default\` |
| Policy | string | yes | The content of the secret policy. The value must be in the JSON format. The value can be up to 32,768 bytes in length. A secret policy… |

### Adds tags to a CMK, secret, or certificate
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/tag-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | no | The ID of the customer master key (CMK). The ID must be globally unique. You can configure only one of the KeyId, SecretName, and… |
| Tags | string | yes | One or more tags that you want to add. The value is in the array format. Tag attributes: TagKey: the tag key. TagValue: the tag value |
| SecretName | string | no | The name of the secret. You can configure only one of the KeyId, SecretName, and CertificateId parameters |
| CertificateId | string | no | The ID of the certificate. You can configure only one of the KeyId, SecretName, and CertificateId parameters |

### Adds tags to one or more keys or secrets
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/tag-resources` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| RegionId | string | yes | The region ID of the resource. You can call the https://help.aliyun.com/document_detail/601478.html to query the most recent region list |
| ResourceType | string | yes | The type of the resource to which you want to add tags. Valid values: key secret |
| ResourceId | string | yes | The IDs of the resources to which you want to add tags. You can enter a maximum of 50 resource IDs. Enter multiple resource IDs in the… |
| Tag | string | yes | A list of tags. You can enter up to 20 tags. A tag consists of a key-value pair. Enter multiple tags in the… |

### Removes tags from a CMK, secret, or certificate
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/untag-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | no | The ID of the key. This is the globally unique identifier (GUID) of the master key (CMK). You must specify one and only one of the KeyId,… |
| TagKeys | string | yes | One or more tag keys. Separate multiple tag keys with commas (,). You need to specify only tag keys, not tag values. The tag key can be 1… |
| SecretName | string | no | The name of the credential. You must specify one and only one of the KeyId, SecretName, and CertificateId parameters |
| CertificateId | string | no | The ID of the certificate. You must specify one and only one of the KeyId, SecretName, and CertificateId parameters |

### Removes tags from keys or secrets
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/untag-resources` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| RegionId | string | yes | The region ID of the resource. You can call the https://help.aliyun.com/document_detail/601478.html operation to query the most recent… |
| ResourceType | string | yes | The type of the resource from which you want to remove tags. Valid values: key secret |
| All | string | no | Specifies whether to remove all tags from resources. Valid values: true false (default) This parameter takes effect only when you specify… |
| ResourceId | string | yes | The IDs of the resources from which you want to remove tags. You can enter up to 50 resource IDs. Enter multiple resource IDs in the… |
| TagKey | string | no | The keys of the tags that you want to remove. You can enter up to 20 tag keys. Enter multiple tag keys in the `["key.1","key.2",...]`… |

### Binds an existing alias to a different customer master key (CMK) ID
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-alias` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the CMK. The ID must be globally unique |
| AliasName | string | yes | The alias that you want to bind. The value must be 1 to 255 characters in length and must include the alias/ prefix |

### Updates the information about an application access point (AAP)
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-application-access-point` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the AAP that you want to update |
| Description | string | no | The description |
| Policies | string | no | The permission policy that you want to update. You can associate up to three permission policies with each AAP |

### Updates the description of a CMK
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-key-description` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the CMK. The ID must be globally unique |
| Description | string | yes | The description of the CMK. This description includes the purpose of the CMK, such as the types of data that you want to protect and… |

### Updates the VPC bindings of a KMS instance
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-kms-instance-bind-vpc` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KmsInstanceId | string | yes | The ID of the KMS instance |
| BindVpcs | string | yes | The VPC configuration. Each VPC configuration contains the following parameters: VpcId: The ID of the VPC. VSwitchId: The vSwitch in the… |

### Updates a network access rule
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-network-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the network control rule that you want to update |
| Description | string | no | The updated description |
| SourcePrivateIp | string | no | The updated private IP addresses or private CIDR blocks. Separate multiple IP addresses or private CIDR blocks with a comma (,) |

### Updates a permission policy
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| Name | string | yes | The name of the permission policy that you want to update |
| Permissions | string | no | The operations that are supported by the updated policy. Valid values: RbacPermission/Template/CryptoServiceKeyUser: allows you to perform… |
| Resources | string | no | The key and secret that are allowed to access after the update. Key: Enter a key in the `key/${KeyId}` format. To allow access to all keys… |
| AccessControlRules | string | no | The access control rule. For more information about how to query created access control rules, see… |
| Description | string | no | The description |

### Updates the automatic rotation policy of a CMK
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-rotation-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the customer master key (CMK). The ID must be globally unique |
| EnableAutomaticRotation | string | yes | Specifies whether to enable automatic key rotation. Valid values: true: enables automatic key rotation. false: disables automatic key… |
| RotationInterval | string | no | The period of automatic key rotation. Specify the value in the integer[unit] format. The following units are supported: d (day), h (hour),… |

### Updates the metadata of a secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name of the secret |
| Description | string | no | The description of the secret |
| ExtendedConfig.CustomData | string | no | The custom data in the extended configuration of the secret. If this parameter is specified, the existing extended configuration of the… |

### Updates the rotation policy of a secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-secret-rotation-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name of the secret |
| EnableAutomaticRotation | string | yes | Specifies whether to enable automatic rotation. Valid values: true: enables automatic rotation. false: does not enable automatic rotation.… |
| RotationInterval | string | no | The interval for automatic rotation. Valid values: 6 hours to 8,760 hours (365 days). The value is in the `integer[unit]` format.```` The… |

### Moves a version stage label to a different version of a secret
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/update-secret-version-stage` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| SecretName | string | yes | The name or Alibaba Cloud Resource Name (ARN) of the secret. To access a secret in a different Alibaba Cloud account, you must specify the… |
| VersionStage | string | yes | The version stage of the secret. Scenario 1: Add a version stage to a specified secret version. Specify this parameter and MoveToVersion.… |
| RemoveFromVersion | string | no | The version number of the secret. This parameter specifies that the version stage set by VersionStage is removed from this version. You… |
| MoveToVersion | string | no | The version number of the secret. This parameter specifies that the version stage set by VersionStage is attached to this version. You… |

### Verifies the HMAC message authentication code of a specific message by using a specified key
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/verify-mac` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |
| KeyId | string | yes | The ID of the key. You can also specify a key alias or key Amazon Resource Name (ARN). For more information about aliases, refer to… |
| Mac | string | yes | The Base64-encoding message authentication code to verify |
| Message | string | yes | The original message data. Use Base64 encoding. For example, if the hexadecimal content of the message for which you want to generate a… |
| Algorithm | string | yes | The algorithm used to generate the message authentication code. Valid values vary based on the key specification: HMAC_SM3 HMAC_SHA_224… |
| DryRun | string | no | Specifies whether to enable DryRun mode. Valid values: true: enables DryRun mode. false (default): disables DryRun mode. DryRun mode is… |

### version
`POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://kms.ap-southeast-1.aliyuncs.com |

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:aliyun-kms/asymmetric-decrypt" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud KeyManagementService API?
Create a free Apizie key, then send POST https://zieapi.vercel.app/v1/cloud:aliyun-kms/asymmetric-decrypt with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud KeyManagementService API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud KeyManagementService itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud KeyManagementService API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-kms.

### What is the status of the Alibaba Cloud KeyManagementService API?
Needs your own provider key (bring your own key)