Hanzo KMS API

Hanzo KMS is a key management service for managing secrets, API keys,

Hanzo KMS API · Guide & examples → · All API references →


Base URL	`https://kms.hanzo.ai`
Version	1.0.0
Operations	95
Guide	Hanzo KMS API guide

Authentication

bearerAuth — HTTP bearer
BearerAuth — HTTP bearer

All Hanzo APIs share one bearer credential and common error and pagination conventions. See API conventions.

curl -H "Authorization: Bearer $HANZO_API_KEY" https://kms.hanzo.ai

Endpoints

Admin

Method	Endpoint	Description
`GET`	`/v1/kms/admin/config`	Get server configuration
`PATCH`	`/v1/kms/admin/config`	Update server configuration

App Connections

Method	Endpoint	Description
`GET`	`/v1/kms/app-connections`	List app connections
`POST`	`/v1/kms/app-connections`	Create an app connection
`GET`	`/v1/kms/app-connections/{connectionId}`	Get an app connection by ID
`PATCH`	`/v1/kms/app-connections/{connectionId}`	Update an app connection
`DELETE`	`/v1/kms/app-connections/{connectionId}`	Delete an app connection

Approval Policies

Method	Endpoint	Description
`GET`	`/v1/kms/approval-policies/change`	List secret change approval policies
`POST`	`/v1/kms/approval-policies/change`	Create a secret change approval policy

Audit Logs

Method	Endpoint	Description
`GET`	`/v1/kms/events`	List audit log events

Auth

Method	Endpoint	Description
`POST`	`/v1/kms/auth/login1`	Login step 1 - SRP init
`POST`	`/v1/kms/auth/token/renew`	Renew access token

Certificate Authorities

Method	Endpoint	Description
`POST`	`/v1/kms/cert-manager/ca`	Create a certificate authority
`GET`	`/v1/kms/cert-manager/ca/{caId}`	Get a certificate authority by ID
`PATCH`	`/v1/kms/cert-manager/ca/{caId}`	Update a certificate authority
`DELETE`	`/v1/kms/cert-manager/ca/{caId}`	Delete a certificate authority

Certificates

Method	Endpoint	Description
`GET`	`/v1/kms/cert-manager/certificates`	List certificates
`POST`	`/v1/kms/cert-manager/ca/{caId}/issue-certificate`	Issue a certificate from a CA
`GET`	`/v1/kms/cert-manager/certificates/{certificateId}`	Get a certificate by ID
`DELETE`	`/v1/kms/cert-manager/certificates/{certificateId}`	Revoke a certificate

Dashboard

Method	Endpoint	Description
`GET`	`/v1/kms/dashboard/{projectId}/secrets-overview`	Get secrets overview for the dashboard

Environments

Method	Endpoint	Description
`GET`	`/v1/kms/projects/{projectId}/environments`	List project environments
`POST`	`/v1/kms/projects/{projectId}/environments`	Create an environment
`PATCH`	`/v1/kms/projects/{projectId}/environments/{envId}`	Update an environment
`DELETE`	`/v1/kms/projects/{projectId}/environments/{envId}`	Delete an environment

Identities

Method	Endpoint	Description
`POST`	`/v1/kms/identities`	Create a machine identity
`GET`	`/v1/kms/identities/{identityId}`	Get an identity by ID
`PATCH`	`/v1/kms/identities/{identityId}`	Update an identity
`DELETE`	`/v1/kms/identities/{identityId}`	Delete an identity

Identity Auth

Method	Endpoint	Description
`POST`	`/v1/kms/auth/universal-auth/login`	Login with Universal Auth
`POST`	`/v1/kms/auth/token-auth/identities/{identityId}/tokens`	Create an identity token
`GET`	`/v1/kms/auth/universal-auth/identities/{identityId}`	Get Universal Auth configuration for an identity
`POST`	`/v1/kms/auth/universal-auth/identities/{identityId}`	Attach Universal Auth to an identity
`POST`	`/v1/kms/auth/universal-auth/identities/{identityId}/client-secrets`	Create a client secret for Universal Auth

Integrations

Method	Endpoint	Description
`POST`	`/v1/kms/integration`	Create an integration
`PATCH`	`/v1/kms/integration/{integrationId}`	Update an integration
`DELETE`	`/v1/kms/integration/{integrationId}`	Delete an integration

KMS

Method	Endpoint	Description
`GET`	`/v1/kms/kms/keys`	List KMS encryption keys
`POST`	`/v1/kms/kms/keys`	Create a KMS encryption key
`PATCH`	`/v1/kms/kms/keys/{keyId}`	Update a KMS key
`DELETE`	`/v1/kms/kms/keys/{keyId}`	Delete a KMS key
`POST`	`/v1/kms/kms/keys/{keyId}/encrypt`	Encrypt data with a KMS key
`POST`	`/v1/kms/kms/keys/{keyId}/decrypt`	Decrypt data with a KMS key

Organizations

Method	Endpoint	Description
`GET`	`/v1/kms/organization`	List organizations the user belongs to
`GET`	`/v1/kms/organization/{organizationId}`	Get an organization by ID
`PATCH`	`/v1/kms/organization/{organizationId}`	Update an organization

Projects

Method	Endpoint	Description
`POST`	`/v1/kms/projects`	Create a project
`GET`	`/v1/kms/projects/{projectId}`	Get a project by ID
`PATCH`	`/v1/kms/projects/{projectId}`	Update a project
`DELETE`	`/v1/kms/projects/{projectId}`	Delete a project
`GET`	`/v1/kms/projects/{projectId}/users`	List project members

SDK

Method	Endpoint	Description
`POST`	`/v1/sdk/secrets`	Enveloped secret + threshold-key operation

SSO

Method	Endpoint	Description
`GET`	`/v1/kms/sso/config`	Get SSO configuration for an organization
`POST`	`/v1/kms/sso/config`	Create SSO configuration

Secret Folders

Method	Endpoint	Description
`GET`	`/v1/kms/folders`	List secret folders
`POST`	`/v1/kms/folders`	Create a secret folder
`PATCH`	`/v1/kms/folders/{folderId}`	Update a secret folder
`DELETE`	`/v1/kms/folders/{folderId}`	Delete a secret folder

Secret Imports

Method	Endpoint	Description
`GET`	`/v1/kms/secret-imports`	List secret imports
`POST`	`/v1/kms/secret-imports`	Create a secret import
`PATCH`	`/v1/kms/secret-imports/{importId}`	Update a secret import
`DELETE`	`/v1/kms/secret-imports/{importId}`	Delete a secret import

Method	Endpoint	Description
`GET`	`/v1/kms/secret-sharing/shared`	List shared secrets created by the user
`POST`	`/v1/kms/secret-sharing/shared`	Create a shared secret
`GET`	`/v1/kms/secret-sharing/shared/{sharedSecretId}`	Get a shared secret by ID (consumes a view)
`DELETE`	`/v1/kms/secret-sharing/shared/{sharedSecretId}`	Delete a shared secret

Secret Syncs

Method	Endpoint	Description
`GET`	`/v1/kms/secret-syncs`	List secret syncs
`POST`	`/v1/kms/secret-syncs`	Create a secret sync
`GET`	`/v1/kms/secret-syncs/{syncId}`	Get a secret sync by ID
`PATCH`	`/v1/kms/secret-syncs/{syncId}`	Update a secret sync
`DELETE`	`/v1/kms/secret-syncs/{syncId}`	Delete a secret sync
`POST`	`/v1/kms/secret-syncs/{syncId}/trigger`	Manually trigger a secret sync

Secret Tags

Method	Endpoint	Description
`GET`	`/v1/kms/projects/{projectId}/tags`	List secret tags for a project
`POST`	`/v1/kms/projects/{projectId}/tags`	Create a secret tag
`GET`	`/v1/kms/projects/{projectId}/tags/{tagId}`	Get a secret tag by ID
`PATCH`	`/v1/kms/projects/{projectId}/tags/{tagId}`	Update a secret tag
`DELETE`	`/v1/kms/projects/{projectId}/tags/{tagId}`	Delete a secret tag

Secrets

Method	Endpoint	Description
`GET`	`/v1/kms/orgs/{org}/secrets`	List an org's secret metadata (names only, never values)
`POST`	`/v1/kms/orgs/{org}/secrets`	Create or upsert a secret (value write-only; version bumps)
`GET`	`/v1/kms/orgs/{org}/secrets/{rest}`	Reveal one secret value
`PATCH`	`/v1/kms/orgs/{org}/secrets/{rest}`	Rotate a secret (compare-and-set on version)
`DELETE`	`/v1/kms/orgs/{org}/secrets/{rest}`	Delete a secret
`GET`	`/v1/kms/v4/secrets`	List secrets
`GET`	`/v1/kms/v4/secrets/{secretKey}`	Get a secret by key
`POST`	`/v1/kms/v4/secrets/{secretKey}`	Create a secret
`PATCH`	`/v1/kms/v4/secrets/{secretKey}`	Update a secret
`DELETE`	`/v1/kms/v4/secrets/{secretKey}`	Delete a secret
`POST`	`/v1/kms/v4/secrets/batch`	Batch create, update, and delete secrets

Service Tokens

Method	Endpoint	Description
`GET`	`/v1/kms/service-token`	Get the service token associated with the current request

Users

Method	Endpoint	Description
`GET`	`/v1/kms/user`	Get the current authenticated user

Webhooks

Method	Endpoint	Description
`GET`	`/v1/kms/webhooks`	List webhooks for a project
`POST`	`/v1/kms/webhooks`	Create a webhook
`PATCH`	`/v1/kms/webhooks/{webhookId}`	Update a webhook
`DELETE`	`/v1/kms/webhooks/{webhookId}`	Delete a webhook
`POST`	`/v1/kms/webhooks/{webhookId}/test`	Test a webhook

Hanzo KMS API guide · All Hanzo APIs · OpenAPI spec

On this page