Get KMS Status

GET /admin/tenant-kms

Retrieve the current BYOK KMS configuration, all key versions, seal status, and last KMS error. Auth: This is a control-plane endpoint on the admin host (e.g. admin.knoxcall.com / any knoxcall.com host). It is authenticated with a session JWT (Authorization: Bearer <token>) plus the X-Tenant-ID header and requires an owner or admin role — not an api.knoxcall.com API key. No step-up required.

Response

{
  "config": {
    "provider": "customer_kms_aws",
    "kms_key_ref": "arn:aws:kms:us-east-1:111122223333:key/abcd-1234",
    "config": {
      "region": "us-east-1",
      "role_arn": "arn:aws:iam::111122223333:role/KnoxCallKMSAccess"
    },
    "sealed_since": null,
    "last_verified_at": "2026-05-25T10:00:00Z",
    "last_verify_error": null
  },
  "keys": [
    {
      "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
      "version": 2,
      "wrap_method": "customer_kms",
      "status": "active",
      "created_at": "2026-05-25T10:00:00Z",
      "retired_at": null
    },
    {
      "id": "a7c1d8f3-2e4b-4c6a-8d9e-1f3b5a7c9d2e",
      "version": 1,
      "wrap_method": "customer_kms",
      "status": "retired",
      "created_at": "2026-01-01T00:00:00Z",
      "retired_at": "2026-05-25T10:00:00Z"
    }
  ]
}

config.provider in the GET response uses the internal format (customer_kms_aws, customer_kms_gcp, customer_kms_azure) — this is different from the short input form (aws, gcp, azure) used in the onboard request. If no customer KMS is configured for this tenant, the endpoint still returns 200 with config: null (and keys: []).

curl https://admin.knoxcall.com/admin/tenant-kms \
  -H "Authorization: Bearer $KC_ADMIN_JWT" \
  -H "X-Tenant-ID: $KC_TENANT_ID"

import requests

resp = requests.get(
    "https://admin.knoxcall.com/admin/tenant-kms",
    headers={
        "Authorization": f"Bearer {KC_ADMIN_JWT}",
        "X-Tenant-ID": KC_TENANT_ID,
    },
)
resp.raise_for_status()
data = resp.json()
sealed = data["config"]["sealed_since"] is not None

const resp = await fetch("https://admin.knoxcall.com/admin/tenant-kms", {
  headers: {
    "Authorization": `Bearer ${KC_ADMIN_JWT}`,
    "X-Tenant-ID": KC_TENANT_ID,
  },
});
const { config, keys } = await resp.json();
const isSealed = config.sealed_since !== null;

Onboard / Configure KMS

Unseal

Overview

Routes

Secrets

Clients

Environments

API Keys

Webhooks

Ephemeral Proxy

AI Gateway

Audit Logs

Account

Tenant KMS

Secret Store Migrations

GET /admin/tenant-kms

Response

​GET /admin/tenant-kms

​Response

GET /admin/tenant-kms

Response