# AWS Key Management Service API Reference

> AWS Key Management Service (AWS KMS) is an encryption and key management web service. This guide describes the AWS KMS operations that you can call programmatically. For general information about AWS KMS, see the AWS Key Management Service Developer Guide.

- [Welcome](https://docs.aws.amazon.com/kms/latest/APIReference/Welcome.md)
- [Common Parameters](https://docs.aws.amazon.com/kms/latest/APIReference/CommonParameters.md)
- [Common Error Types](https://docs.aws.amazon.com/kms/latest/APIReference/CommonErrors.md)

## [Actions](https://docs.aws.amazon.com/kms/latest/APIReference/API_Operations.md)

- [CancelKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.md): Cancels the deletion of a KMS key.
- [ConnectCustomKeyStore](https://docs.aws.amazon.com/kms/latest/APIReference/API_ConnectCustomKeyStore.md): Connects or reconnects a custom key store to its backing key store.
- [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.md): Creates a friendly name for a KMS key.
- [CreateCustomKeyStore](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateCustomKeyStore.md): Creates a custom key store backed by a key store that you own and manage.
- [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.md): Adds a grant to a KMS key.
- [CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.md): Creates a unique customer managed KMS key in your AWS account and Region.
- [Decapsulate](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decapsulate.md): Recovers the shared secret that was encapsulated with the public key of an ML-KEM KMS key.
- [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.md): Decrypts ciphertext that was encrypted by a KMS key using any of the following operations:
- [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.md): Deletes the specified alias.
- [DeleteCustomKeyStore](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteCustomKeyStore.md): Deletes a custom key store.
- [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.md): Deletes key material that was previously imported.
- [DeriveSharedSecret](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.md): Derives a shared secret using a key agreement algorithm.
- [DescribeCustomKeyStores](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeCustomKeyStores.md): Gets information about custom key stores in the account and Region.
- [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.md): Provides detailed information about a KMS key.
- [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.md): Sets the state of a KMS key to disabled.
- [DisableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.md): Disables automatic rotation of the key material of the specified symmetric encryption KMS key.
- [DisconnectCustomKeyStore](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisconnectCustomKeyStore.md): Disconnects the custom key store from its backing key store.
- [EnableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.md): Sets the key state of a KMS key to enabled.
- [EnableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.md): Enables automatic rotation of the key material of the specified symmetric encryption KMS key.
- [Encapsulate](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encapsulate.md): Generates a shared secret and its encapsulated (ciphertext) form using the public key of an ML-KEM KMS key pair.
- [Encrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.md): Encrypts plaintext of up to 4,096 bytes using a KMS key.
- [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.md): Returns a unique symmetric data key for use outside of AWS KMS.
- [GenerateDataKeyPair](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.md): Returns a unique asymmetric data key pair for use outside of AWS KMS.
- [GenerateDataKeyPairWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.md): Returns a unique asymmetric data key pair for use outside of AWS KMS.
- [GenerateDataKeyWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.md): Returns a unique symmetric data key for use outside of AWS KMS.
- [GenerateMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.md): Generates a hash-based message authentication code (HMAC) for a message using an HMAC KMS key and a MAC algorithm that the key supports.
- [GenerateRandom](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateRandom.md): Returns a random byte string that is cryptographically secure.
- [GetKeyLastUsage](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyLastUsage.md): Returns usage information about the last successful cryptographic operation performed with a specified KMS key, including the operation type, timestamp, and associated AWS CloudTrail event ID.
- [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.md): Gets a key policy attached to the specified KMS key.
- [GetKeyRotationStatus](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.md): Provides detailed information about the rotation status for a KMS key, including whether automatic rotation of the key material is enabled for the specified KMS key, the rotation period, and the next scheduled rotation date.
- [GetParametersForImport](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.md): Returns the public key and an import token you need to import or reimport key material for a KMS key.
- [GetPublicKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.md): Returns the public key of an asymmetric KMS key.
- [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.md): Imports or reimports key material into an existing KMS key that was created without key material.
- [ListAliases](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.md): Gets a list of aliases in the caller's AWS account and region.
- [ListGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.md): Gets a list of all grants for the specified KMS key.
- [ListKeyPolicies](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.md): Gets the names of the key policies that are attached to a KMS key.
- [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.md): Returns information about the key materials associated with the specified KMS key.
- [ListKeys](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeys.md): Gets a list of all KMS keys in the caller's AWS account and Region.
- [ListResourceTags](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.md): Returns all tags on the specified KMS key.
- [ListRetirableGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.md): Returns information about all grants in the AWS account and Region that have the specified retiring principal or retiring service principal.
- [PutKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.md): Attaches a key policy to the specified KMS key.
- [ReEncrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.md): Decrypts ciphertext and then reencrypts it entirely within AWS KMS.
- [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.md): Replicates a multi-Region key into the specified Region.
- [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.md): Deletes a grant.
- [RevokeGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.md): Deletes the specified grant.
- [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.md): Immediately initiates rotation of the key material of the specified symmetric encryption KMS key.
- [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.md): Schedules the deletion of a KMS key.
- [Sign](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.md): Creates a digital signature for a message or message digest by using the private key in an asymmetric signing KMS key.
- [TagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.md): Adds or edits tags on a customer managed key.
- [UntagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.md): Deletes tags from a customer managed key.
- [UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.md): Associates an existing AWS KMS alias with a different KMS key.
- [UpdateCustomKeyStore](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateCustomKeyStore.md): Changes the properties of a custom key store.
- [UpdateKeyDescription](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.md): Updates the description of a KMS key.
- [UpdatePrimaryRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdatePrimaryRegion.md): Changes the primary key of a multi-Region key.
- [Verify](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.md): Verifies a digital signature that was generated by the Sign operation.
- [VerifyMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.md): Verifies the hash-based message authentication code (HMAC) for a specified message, HMAC KMS key, and MAC algorithm.


## [Data Types](https://docs.aws.amazon.com/kms/latest/APIReference/API_Types.md)

- [AliasListEntry](https://docs.aws.amazon.com/kms/latest/APIReference/API_AliasListEntry.md): Contains information about an alias.
- [CustomKeyStoresListEntry](https://docs.aws.amazon.com/kms/latest/APIReference/API_CustomKeyStoresListEntry.md): Contains information about each custom key store in the custom key store list.
- [GrantConstraints](https://docs.aws.amazon.com/kms/latest/APIReference/API_GrantConstraints.md): Use this structure to allow cryptographic operations in the grant only when the operation request meets the specified constraints.
- [GrantListEntry](https://docs.aws.amazon.com/kms/latest/APIReference/API_GrantListEntry.md): Contains information about a grant.
- [KeyLastUsageData](https://docs.aws.amazon.com/kms/latest/APIReference/API_KeyLastUsageData.md): Contains usage information about the last time the KMS key was used for a successful cryptographic operation.
- [KeyListEntry](https://docs.aws.amazon.com/kms/latest/APIReference/API_KeyListEntry.md): Contains information about each entry in the key list.
- [KeyMetadata](https://docs.aws.amazon.com/kms/latest/APIReference/API_KeyMetadata.md): Contains metadata about a KMS key.
- [MultiRegionConfiguration](https://docs.aws.amazon.com/kms/latest/APIReference/API_MultiRegionConfiguration.md): Describes the configuration of this multi-Region key.
- [MultiRegionKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_MultiRegionKey.md): Describes the primary or replica key in a multi-Region key.
- [RecipientInfo](https://docs.aws.amazon.com/kms/latest/APIReference/API_RecipientInfo.md): Contains information about the party that receives the response from the API operation.
- [RotationsListEntry](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotationsListEntry.md): Each entry contains information about one of the key materials associated with a KMS key.
- [Tag](https://docs.aws.amazon.com/kms/latest/APIReference/API_Tag.md): A key-value pair.
- [XksKeyConfigurationType](https://docs.aws.amazon.com/kms/latest/APIReference/API_XksKeyConfigurationType.md): Information about the external key that is associated with a KMS key in an external key store.
- [XksProxyAuthenticationCredentialType](https://docs.aws.amazon.com/kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.md): AWS KMS uses the authentication credential to sign requests that it sends to the external key store proxy (XKS proxy) on your behalf.
- [XksProxyConfigurationType](https://docs.aws.amazon.com/kms/latest/APIReference/API_XksProxyConfigurationType.md): Detailed information about the external key store proxy (XKS proxy).


## Full content

The entire guide is also available as a single markdown file, useful for feeding the full guide to an LLM in one pass:

- [Complete guide (single file)](https://docs.aws.amazon.com/kms/latest/APIReference/full.md)