Import a domain key
POST/v1/repositories/:id/domain-keys/import
Installs a key exported from another cloud, wrapped under this cloud's own key manager. The repository is this cloud's registration of the storage the key belongs to, whatever either cloud named it. Before anything is kept, the key is checked against that storage: it must open what the dedup domain already holds there, or, in a domain holding nothing yet, the domain's key marker must name the repository and cloud the envelope was exported from. A domain keeps one key for life: importing the same key again changes nothing, and a different one is refused.
Operator only: needs a system-scoped token.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 409
- 413
- 415
- 422
- 502
- 503
- default
OK
Bad Request.
invalid_request: The body is not a single JSON object, names a field this operation does not take, or gives a value of the wrong type.
Unauthorized.
unauthenticated: The token is missing, expired or not valid.
Forbidden.
forbidden: The token's roles do not grant repository:register.
forbidden: The envelope will not open. A wrong passphrase and a damaged envelope are deliberately not told apart.
Not Found.
not_found: No repository has this id or name.
Conflict.
conflict: The envelope was exported for another dedup domain.
conflict: The key opens nothing the dedup domain holds in this repository. Or the domain holds nothing yet and its key marker names another repository or cloud, or there is no marker. The envelope is for other storage than this repository names; nothing is kept.
conflict: The dedup domain already holds a different key, or one this cloud cannot unwrap to compare. Nothing is changed, and importing the same key again succeeds.
Request Entity Too Large.
body_too_large: The body is larger than the service accepts.
Unsupported Media Type.
unsupported_media_type: The body is not sent as application/json.
Unprocessable Entity.
validation_failed: domain, passphrase or envelope is missing. Or the envelope is malformed: an unknown format or version, an unsupported derivation, fewer than 100000 iterations, or a salt or nonce of the wrong length.
domain_not_encrypted: domain is plain, which holds unencrypted backups and has no key.
Bad Gateway.
service_unavailable: The repository could not be opened or listed to check the key against, so nothing was kept.
Service Unavailable.
kms_unavailable: No key manager is configured, or the configured one cannot hold a key supplied from outside.
An error, as an RFC 7807 problem document.