Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

back

Luna HSM APIs

Luna HSM Partition APIs

search

Please Note:

Luna HSM Partition APIs

This section describes how CCKM manages the Luna HSM partitions that have their data, access controls, security policies, and separate administration access for at least some roles, independent of other Luna HSM partitions (if your Luna HSM supports more than one). CCKM can manage a single partition or a group of partitions that form an HA group.

Use the Luna HSM partition APIs to:

  • Add, list, and update Luna HSM partitions

  • View details of Luna HSM partitions

  • Grant permissions to users or groups to perform specific actions on the Luna HSM partitions

  • Delete Luna HSM partitions

Adding Luna HSM Partitions

Use the post /v1/cckm/hsm/luna/add-partition API to add a new Luna HSM partition.

Syntax


curl -k '<IP>/api/v1/cckm/hsm/luna/add-partition' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n  "connection": "<hsm-connection>"\n}' --compressed

Request Parameters

ParameterTypeDescription
AUTHTOKENstringAuthorization token.
connectionstringName or ID of the connection.

Example Request


curl -k 'https://127.0.0.1/api/v1/cckm/hsm/luna/add-partition' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxZDQyNWE3Ny1jZjU3LTQwNDItYWRhOC04NWE2MTBjZjcyYWIiLCJzdWIiOiJsb2NhbHxmM2ExYTQ5MS0yMzIzLTQ5MTQtODZhYS03ODM4MjRlZGMyZGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMzE2YTI1ODItODdmNi00M2ZhLTk2YzYtY2YwOGExNDQwMjY5Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImM5Nzk4MDlhLTMxMWYtNDFhZS1hNzQ1LWIyNGUzOTNlYzIyMiIsImlhdCI6MTYwNzk0MzIzMSwiZXhwIjoxNjA3OTQzNTMxfQ.s4cXZzKrNFrc8frI-ceq7ok4gJKMnMU3Lj1IXTd7AEM' -H 'Content-Type: application/json' --data-binary $'{\n  "connection": "hsm-connection"\n}' --compressed

Example Response


{
    "id": "fe192148-82eb-403f-96b2-125bf28d3824",
    "uri": "kylo:kylo:cckm:luna-partitions:fe192148-82eb-403f-96b2-125bf28d3824",
    "account": "kylo:kylo:admin:accounts:kylo",
    "application": "ncryptify:gemalto:admin:apps:kylo",
    "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
    "createdAt": "2020-12-14T10:49:17.331641485Z",
    "updatedAt": "2020-12-14T10:49:17.330136109Z",
    "label": "cckm-1607942872",
    "manufacturer_id": "Safenet, Inc.",
    "model": "LunaVirtual",
    "flags": 1069,
    "max_session_count": 0,
    "session_count": 0,
    "max_rw_session_count": 0,
    "rw_session_count": 0,
    "max_pin_len": 255,
    "min_pin_len": 7,
    "total_public_memory": 409783,
    "free_public_memory": 329839,
    "total_private_memory": 409783,
    "free_private_memory": 329839,
    "firmware_version": "7.4",
    "ha_enabled": true,
    "members": {
        "1429964054507": "cckm1",
        "1429964054508": "cckm2",
        "1429964054509": "user1",
        "1429964054510": "user2"
    },
    "connection": "hsm-connection"
}

Response Codes

Response CodeDescription
2xxSuccess
4xxClient errors
5xxServer errors

Refer to HTTP status codes for details.

Listing Luna HSM Partitions

Use the get /v1/cckm/hsm/luna/partitions API to list the existing Luna HSM partitions.

Syntax


curl -k '<IP>/api/v1/cckm/hsm/luna/partitions' -H 'Authorization: Bearer AUTHTOKEN' --compressed

Request Parameter

ParameterTypeDescription
AUTHTOKENstringAuthorization token.

Request Query Parameters

ParameterTypeDescription
idstringID of the partition.
connectionstringName or ID of the connection.
modelstringName of the Luna HSM model.
labelstringLabel of the partition.
ha_enabledstringWhether HA is enabled.
skipintegerNumber of records to skip. For example, if "skip":5 is specified, the first five records will not be displayed in the output.
limitintegerNumbers of records to display. For example, if "limit":10 is specified, then the next 10 records (after skipping the number of records specified in the skip parameter ) will be displayed in the output.
sortstringComma-delimited list of properties to sort the results.

Example Request


curl -k 'https://127.0.0.1/api/v1/cckm/hsm/luna/partitions?skip=0&limit=10&sort=updatedAt' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxZDQyNWE3Ny1jZjU3LTQwNDItYWRhOC04NWE2MTBjZjcyYWIiLCJzdWIiOiJsb2NhbHxmM2ExYTQ5MS0yMzIzLTQ5MTQtODZhYS03ODM4MjRlZGMyZGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMzE2YTI1ODItODdmNi00M2ZhLTk2YzYtY2YwOGExNDQwMjY5Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImM5Nzk4MDlhLTMxMWYtNDFhZS1hNzQ1LWIyNGUzOTNlYzIyMiIsImlhdCI6MTYwNzk0MzIzMSwiZXhwIjoxNjA3OTQzNTMxfQ.s4cXZzKrNFrc8frI-ceq7ok4gJKMnMU3Lj1IXTd7AEM' --compressed

Example Response


{
    "skip": 0,
    "limit": 10,
    "total": 1,
    "resources": [
        {
            "id": "fe192148-82eb-403f-96b2-125bf28d3824",
            "uri": "kylo:kylo:cckm:luna-partitions:fe192148-82eb-403f-96b2-125bf28d3824",
            "account": "kylo:kylo:admin:accounts:kylo",
            "application": "ncryptify:gemalto:admin:apps:kylo",
            "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
            "createdAt": "2020-12-14T10:49:17.331641Z",
            "updatedAt": "2020-12-14T10:49:17.330136Z",
            "label": "cckm-1607942872",
            "manufacturer_id": "Safenet, Inc.",
            "model": "LunaVirtual",
            "flags": 1069,
            "max_session_count": 0,
            "session_count": 0,
            "max_rw_session_count": 0,
            "rw_session_count": 0,
            "max_pin_len": 255,
            "min_pin_len": 7,
            "total_public_memory": 409783,
            "free_public_memory": 329839,
            "total_private_memory": 409783,
            "free_private_memory": 329839,
            "firmware_version": "7.4",
            "ha_enabled": true,
            "members": {
                "1429964054507": "cckm1",
                "1429964054508": "cckm2",
                "1429964054509": "user1",
                "1429964054510": "user2"
            },
            "connection": "hsm-connection",
            "last_refreshed": "2020-12-21T10:09:49.066875Z"
        }
    ]
}

Response Codes

Response CodeDescription
2xxSuccess
4xxClient errors
5xxServer errors

Refer to HTTP status codes for details.

Viewing Details of Luna HSM Partitions

Use the get /v1/cckm/hsm/luna/partitions/{id} API to view the details of a Luna HSM partition.

Syntax


curl -k '<IP>/api/v1/cckm/hsm/luna/partitions/{id}' -H 'Authorization: Bearer AUTHTOKEN' --compressed

Here, {id} represents the ID of the partition.

Request Parameter

ParameterTypeDescription
AUTHTOKENstringAuthorization token.

Example Request


curl -k 'https://127.0.0.1/api/v1/cckm/hsm/luna/partitions/fe192148-82eb-403f-96b2-125bf28d3824' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxZDQyNWE3Ny1jZjU3LTQwNDItYWRhOC04NWE2MTBjZjcyYWIiLCJzdWIiOiJsb2NhbHxmM2ExYTQ5MS0yMzIzLTQ5MTQtODZhYS03ODM4MjRlZGMyZGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMzE2YTI1ODItODdmNi00M2ZhLTk2YzYtY2YwOGExNDQwMjY5Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImM5Nzk4MDlhLTMxMWYtNDFhZS1hNzQ1LWIyNGUzOTNlYzIyMiIsImlhdCI6MTYwNzk0MzIzMSwiZXhwIjoxNjA3OTQzNTMxfQ.s4cXZzKrNFrc8frI-ceq7ok4gJKMnMU3Lj1IXTd7AEM' --compressed

Example Response


{
    "id": "fe192148-82eb-403f-96b2-125bf28d3824",
    "uri": "kylo:kylo:cckm:luna-partitions:fe192148-82eb-403f-96b2-125bf28d3824",
    "account": "kylo:kylo:admin:accounts:kylo",
    "application": "ncryptify:gemalto:admin:apps:kylo",
    "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
    "createdAt": "2020-12-14T10:49:17.331641Z",
    "updatedAt": "2020-12-14T10:49:17.330136Z",
    "label": "cckm-1607942872",
    "manufacturer_id": "Safenet, Inc.",
    "model": "LunaVirtual",
    "flags": 1069,
    "max_session_count": 0,
    "session_count": 0,
    "max_rw_session_count": 0,
    "rw_session_count": 0,
    "max_pin_len": 255,
    "min_pin_len": 7,
    "total_public_memory": 409783,
    "free_public_memory": 329839,
    "total_private_memory": 409783,
    "free_private_memory": 329839,
    "firmware_version": "7.4",
    "ha_enabled": true,
    "members": {
        "1429964054507": "cckm1",
        "1429964054508": "cckm2",
        "1429964054509": "user1",
        "1429964054510": "user2"
    },
    "connection": "hsm-connection",
    "last_refreshed": "2020-12-21T10:09:49.066875Z"
}

Response Codes

Response CodeDescription
2xxSuccess
4xxClient errors
5xxServer errors

Refer to HTTP status codes for details.

Updating Luna HSM Partitions

Use the patch /v1/cckm/hsm/luna/partitions/{id} API to update the connection in a Luna HSM partition. The connection and partition must be of the same type - HA or single.

Syntax


curl -k '<IP>/api/v1/cckm/hsm/luna/partitions/{id}' -X PATCH -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n  "connection": "<hsm-connection>"\n}' --compressed

Here, {id} represents the ID of the partition.

Request Parameters

ParameterTypeDescription
AUTHTOKENstringAuthorization token.
connectionstringName or ID of the connection. The connection and partition must be of the same type - HA or single.

Example Request


curl -k 'https://127.0.0.1/api/v1/cckm/hsm/luna/partitions/fe192148-82eb-403f-96b2-125bf28d3824' -X PATCH -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxZDQyNWE3Ny1jZjU3LTQwNDItYWRhOC04NWE2MTBjZjcyYWIiLCJzdWIiOiJsb2NhbHxmM2ExYTQ5MS0yMzIzLTQ5MTQtODZhYS03ODM4MjRlZGMyZGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMzE2YTI1ODItODdmNi00M2ZhLTk2YzYtY2YwOGExNDQwMjY5Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImM5Nzk4MDlhLTMxMWYtNDFhZS1hNzQ1LWIyNGUzOTNlYzIyMiIsImlhdCI6MTYwNzk0MzIzMSwiZXhwIjoxNjA3OTQzNTMxfQ.s4cXZzKrNFrc8frI-ceq7ok4gJKMnMU3Lj1IXTd7AEM' -H 'Content-Type: application/json' --data-binary $'{\n  "connection": "hsm-connection"\n}' --compressed

Example Response


{
    "id": "fe192148-82eb-403f-96b2-125bf28d3824",
    "uri": "kylo:kylo:cckm:luna-partitions:fe192148-82eb-403f-96b2-125bf28d3824",
    "account": "kylo:kylo:admin:accounts:kylo",
    "application": "ncryptify:gemalto:admin:apps:kylo",
    "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
    "createdAt": "2020-12-14T10:49:17.331641Z",
    "updatedAt": "2020-12-14T10:49:17.330136Z",
    "label": "cckm-1607942872",
    "manufacturer_id": "Safenet, Inc.",
    "model": "LunaVirtual",
    "flags": 1069,
    "max_session_count": 0,
    "session_count": 0,
    "max_rw_session_count": 0,
    "rw_session_count": 0,
    "max_pin_len": 255,
    "min_pin_len": 7,
    "total_public_memory": 409783,
    "free_public_memory": 329839,
    "total_private_memory": 409783,
    "free_private_memory": 329839,
    "firmware_version": "7.4",
    "ha_enabled": true,
    "members": {
        "1429964054507": "cckm1",
        "1429964054508": "cckm2",
        "1429964054509": "user1",
        "1429964054510": "user2"
    },
    "connection": "hsm-connection",
    "last_refreshed": "2020-12-21T10:09:49.066875Z"
}

Response Codes

Response CodeDescription
2xxSuccess
4xxClient errors
5xxServer errors

Refer to HTTP status codes for details.

Deleting a Luna HSM Partition

Use the delete /v1/cckm/hsm/luna/partitions/{id} API to delete a Luna HSM partition from CCKM.

Syntax


curl -k '<IP>/api/v1/cckm/hsm/luna/partitions/{id}' -X DELETE -H 'Authorization: Bearer AUTHTOKEN' --compressed

Here, {id} represents the ID of the partition.

Request Parameter

ParameterTypeDescription
AUTHTOKENstringAuthorization token.

Example Request


curl -k 'https://127.0.0.1/api/v1/cckm/hsm/luna/partitions/fe192148-82eb-403f-96b2-125bf28d3824' -X DELETE -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxZDQyNWE3Ny1jZjU3LTQwNDItYWRhOC04NWE2MTBjZjcyYWIiLCJzdWIiOiJsb2NhbHxmM2ExYTQ5MS0yMzIzLTQ5MTQtODZhYS03ODM4MjRlZGMyZGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMzE2YTI1ODItODdmNi00M2ZhLTk2YzYtY2YwOGExNDQwMjY5Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImM5Nzk4MDlhLTMxMWYtNDFhZS1hNzQ1LWIyNGUzOTNlYzIyMiIsImlhdCI6MTYwNzk0MzIzMSwiZXhwIjoxNjA3OTQzNTMxfQ.s4cXZzKrNFrc8frI-ceq7ok4gJKMnMU3Lj1IXTd7AEM' --compressed

Example Response


response
204

Response Codes

Response CodeDescription
2xxSuccess
4xxClient errors
5xxServer errors

Refer to HTTP status codes for details.

Granting Permissions to Users or Groups

Use the post /v1/cckm/hsm/luna/partitions/{id}/update-acls API to grant permissions to users or groups to perform specified operations on a Luna HSM partition.

User ID and group are mutually exclusive – specify either. For the first time users or group, actions are permitted as configured by the CCKM administrator. However, if the permissions of a user or group need to be modified later, for example, a new action is to be permitted or an existing action is to be revoked, the CCKM administrator needs to set that particular action to true or false.

For example, a user or group is permitted actions, keycreate, keyupdate, and keyrotate. Now, to permit one more action keydelete to the user or group, set "permit":true and "actions": "keydelete" and run the API. Similarly, now to deny permission to the action keycreate, set "permit":false, "actions": "keycreate", and run the API.

Refer to Actions for actions supported by different APIs.

Syntax


curl -k '<IP>/api/v1/cckm/hsm/luna/partitions/{id}/update-acls' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n  "acls": [\n    {\n      "group": "<group>",\n      "actions": [\n        "<action1>"\n      ],\n      "<action2>": <true|false>\n    }\n  ]\n}' --compressed

Here, {id} represents the ID of the partition.

Request Parameters

ParameterTypeDescription
AUTHTOKENstringAuthorization token.
aclsarray of JSONsPermissions to be granted to users and groups. Refer to ACLs for details.

ACLs

ParameterTypeDescription
actionsarray of stringsList of actions. The actions can be:
• keycreate
• keydelete
• keyreplicate
• keyupdate
• view
• refresh
• synchronize
Refer to Actions for details.
groupstringName of the user group to be granted permissions. User ID and group are mutually exclusive – specify either.
permitbooleanWhether to permit users to perform specific operations. Set true to permit, false to deny.
user_idstringID of the user to be granted permissions. User ID and group are mutually exclusive – specify either.

Actions

The following table lists the accepted values:

APIsActionsDescription
CreatekeycreatePermission to create Luna HSM keys.
ReplicatekeyreplicatePermission to replicate keys on Luna HSM partitions.
DeletekeydeletePermission to delete keys.
UpdatekeyupdatePermission to update keys.
RefreshrefreshPermission to refresh Luna HSM partitions.
SynchronizesynchronizePermission to synchronize Luna HSM keys.
ListviewPermission to view partitions and their keys.
Get (Luna HSM partition keys)viewPermission to view details of a Luna HSM key.
List (Luna HSM partition)viewPermission to view Luna HSM partitions and their keys.
Get (Luna HSM partition)viewPermission to view details of a Luna HSM partition.

Example Request


curl -k 'https://127.0.0.1/api/v1/cckm/hsm/luna/partitions/fe192148-82eb-403f-96b2-125bf28d3824/update-acls' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxZDQyNWE3Ny1jZjU3LTQwNDItYWRhOC04NWE2MTBjZjcyYWIiLCJzdWIiOiJsb2NhbHxmM2ExYTQ5MS0yMzIzLTQ5MTQtODZhYS03ODM4MjRlZGMyZGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMzE2YTI1ODItODdmNi00M2ZhLTk2YzYtY2YwOGExNDQwMjY5Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImM5Nzk4MDlhLTMxMWYtNDFhZS1hNzQ1LWIyNGUzOTNlYzIyMiIsImlhdCI6MTYwNzk0MzIzMSwiZXhwIjoxNjA3OTQzNTMxfQ.s4cXZzKrNFrc8frI-ceq7ok4gJKMnMU3Lj1IXTd7AEM' -H 'Content-Type: application/json' --data-binary $'{\n  "acls": [\n    {\n      "group": "CCKM Users",\n      "actions": [\n        "view"\n      ],\n      "permit": true\n    }\n  ]\n}' --compressed

Example Response


{
    "id": "fe192148-82eb-403f-96b2-125bf28d3824",
    "uri": "kylo:kylo:cckm:luna-partitions:fe192148-82eb-403f-96b2-125bf28d3824",
    "account": "kylo:kylo:admin:accounts:kylo",
    "application": "ncryptify:gemalto:admin:apps:kylo",
    "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
    "createdAt": "2020-12-14T10:49:17.331641Z",
    "updatedAt": "2020-12-14T10:54:12.327087698Z",
    "label": "cckm-1607942872",
    "manufacturer_id": "Safenet, Inc.",
    "model": "LunaVirtual",
    "flags": 1069,
    "max_session_count": 0,
    "session_count": 0,
    "max_rw_session_count": 0,
    "rw_session_count": 0,
    "max_pin_len": 255,
    "min_pin_len": 7,
    "total_public_memory": 409783,
    "free_public_memory": 329839,
    "total_private_memory": 409783,
    "free_private_memory": 329839,
    "firmware_version": "7.4",
    "ha_enabled": true,
    "members": {
        "1429964054507": "cckm1",
        "1429964054508": "cckm2",
        "1429964054509": "user1",
        "1429964054510": "user2"
    },
    "connection": "hsm-connection",
    "last_refreshed": "2020-12-21T10:09:49.066875Z",
    "acls": [
        {
            "group": "CCKM Users",
            "actions": [
                "view"
            ]
        }
    ]
}

Response Codes

Response CodeDescription
2xxSuccess
4xxClient errors
5xxServer errors

Refer to HTTP status codes for details.