{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/stackit/main/json-schema/stackit-wrapping-key-schema.json",
  "title": "wrappingKey",
  "x-generated": "2026-10-18",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/stackit-kms-openapi.yml#/components/schemas/wrappingKey",
  "properties": {
    "access_scope": {
      "$ref": "#/$defs/access_scope"
    },
    "algorithm": {
      "$ref": "#/$defs/wrappingAlgorithm"
    },
    "createdAt": {
      "description": "The date and time the creation of the wrapping key was triggered.",
      "format": "date-time",
      "type": "string"
    },
    "description": {
      "description": "A user chosen description to distinguish multiple wrapping keys.",
      "maxLength": 256,
      "type": "string"
    },
    "displayName": {
      "description": "The display name to distinguish multiple wrapping keys.",
      "maxLength": 64,
      "type": "string"
    },
    "expiresAt": {
      "description": "The date and time the wrapping key will expire.",
      "format": "date-time",
      "type": "string"
    },
    "id": {
      "description": "A auto generated unique id which identifies the wrapping keys.",
      "format": "uuid",
      "type": "string"
    },
    "keyRingId": {
      "description": "The unique id of the key ring this wrapping key is assigned to.",
      "format": "uuid",
      "type": "string"
    },
    "protection": {
      "$ref": "#/$defs/protection"
    },
    "publicKey": {
      "description": "The public key of the wrapping key.",
      "readOnly": true,
      "type": "string"
    },
    "purpose": {
      "$ref": "#/$defs/wrappingPurpose"
    },
    "state": {
      "description": "The current state of the wrapping key.",
      "enum": [
        "active",
        "creating",
        "expired",
        "deleted",
        "key_material_unavailable"
      ],
      "type": "string"
    }
  },
  "required": [
    "id",
    "displayName",
    "state",
    "createdAt",
    "expiresAt",
    "keyRingId",
    "protection",
    "purpose",
    "algorithm",
    "access_scope"
  ],
  "$defs": {
    "access_scope": {
      "default": "PUBLIC",
      "description": "The access scope of the key.",
      "enum": [
        "PUBLIC",
        "SNA"
      ],
      "type": "string"
    },
    "protection": {
      "description": "The underlying system that is responsible for protecting the key material. Possible values are \"software\" or \"hsm\"",
      "type": "string"
    },
    "wrappingAlgorithm": {
      "description": "The wrapping algorithm used to wrap the key to import.",
      "enum": [
        "rsa_2048_oaep_sha256",
        "rsa_3072_oaep_sha256",
        "rsa_4096_oaep_sha256",
        "rsa_4096_oaep_sha512",
        "rsa_2048_oaep_sha256_aes_256_key_wrap",
        "rsa_3072_oaep_sha256_aes_256_key_wrap",
        "rsa_4096_oaep_sha256_aes_256_key_wrap",
        "rsa_4096_oaep_sha512_aes_256_key_wrap"
      ],
      "type": "string"
    },
    "wrappingPurpose": {
      "description": "The wrapping purpose for the wrapping key.",
      "enum": [
        "wrap_symmetric_key",
        "wrap_asymmetric_key"
      ],
      "type": "string"
    }
  }
}