{ "swagger": "2.0", "info": { "title": "TiDB Cloud Premium API", "description": "TiDB Cloud Premium API", "version": "v1beta2" }, "tags": [ { "name": "CustomerManagedEncryptionKeyService" } ], "host": "cloud.tidbapi.com", "basePath": "/v1beta2", "schemes": [ "https" ], "consumes": [ "application/json" ], "produces": [ "application/json" ], "paths": { "/cmeks:principal": { "get": { "summary": "Get CMEK IAM principal", "description": "Retrieves the IAM principal required for customer-managed encryption key (CMEK) access. Use this to get the TiDB Cloud account information needed to configure your KMS key policy.", "operationId": "CustomerManagedEncryptionKeyService_GetCmekAccessIamPrincipal", "responses": { "200": { "description": "A successful response.", "schema": { "$ref": "#/definitions/nextgenv1beta2CmekAccessIamPrincipal" } }, "400": { "description": "A request field is invalid.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "401": { "description": "The API key cannot be authenticated.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "403": { "description": "The API key does not have permission to access the resource.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "429": { "description": "You have exceeded the rate limit.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "500": { "description": "Internal server error.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "default": { "description": "An unexpected error response.", "schema": { "$ref": "#/definitions/googlerpcStatus" } } }, "parameters": [ { "name": "regionId", "in": "query", "required": false, "type": "string" }, { "name": "servicePlan", "in": "query", "required": true, "type": "string", "enum": [ "Starter", "Essential", "Premium", "BYOC", "Dedicated", "Premium_Reserved", "Essential_V2" ] } ], "tags": [ "CustomerManagedEncryptionKeyService" ] } }, "/cmeks:verifyPrincipal": { "post": { "summary": "Verify CMEK IAM principal", "description": "Verifies that the CMEK IAM principal configuration is valid. Use this to validate your KMS key policy before creating a TiDB Cloud Premium instance with CMEK enabled.", "operationId": "CustomerManagedEncryptionKeyService_VerifyCmekAccessIamPrincipal", "responses": { "200": { "description": "A successful response.", "schema": { "$ref": "#/definitions/nextgenv1beta2VerifyCmekAccessIamPrincipalResponse" } }, "400": { "description": "A request field is invalid.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "401": { "description": "The API key cannot be authenticated.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "403": { "description": "The API key does not have permission to access the resource.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "429": { "description": "You have exceeded the rate limit.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "500": { "description": "Internal server error.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "default": { "description": "An unexpected error response.", "schema": { "$ref": "#/definitions/googlerpcStatus" } } }, "parameters": [ { "name": "key", "in": "body", "required": true, "schema": { "$ref": "#/definitions/nextgenv1beta2CustomerManagedEncryptionKey" } }, { "name": "tidbId", "description": "Optional existing TiDB ID. Omit this when validating CMEK before creating\na TiDB; provide it when validating CMEK for an existing TiDB.", "in": "query", "required": false, "type": "string" } ], "tags": [ "CustomerManagedEncryptionKeyService" ] } }, "/cmeks/{customerManagedEncryptionKeyId}": { "get": { "summary": "Get a CMEK", "description": "Retrieves details of a specific customer-managed encryption key (CMEK).", "operationId": "CustomerManagedEncryptionKeyService_GetCustomerManagedEncryptionKey", "responses": { "200": { "description": "A successful response.", "schema": { "$ref": "#/definitions/nextgenv1beta2CustomerManagedEncryptionKey" } }, "400": { "description": "A request field is invalid.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "401": { "description": "The API key cannot be authenticated.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "403": { "description": "The API key does not have permission to access the resource.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "429": { "description": "You have exceeded the rate limit.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "500": { "description": "Internal server error.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "default": { "description": "An unexpected error response.", "schema": { "$ref": "#/definitions/googlerpcStatus" } } }, "parameters": [ { "name": "customerManagedEncryptionKeyId", "in": "path", "required": true, "type": "string" } ], "tags": [ "CustomerManagedEncryptionKeyService" ] } }, "/cmeks": { "get": { "summary": "List CMEKs", "description": "Lists all customer-managed encryption keys (CMEKs) for the current organization.", "operationId": "CustomerManagedEncryptionKeyService_ListCustomerManagedEncryptionKeys", "responses": { "200": { "description": "A successful response.", "schema": { "$ref": "#/definitions/nextgenv1beta2ListCustomerManagedEncryptionKeysResponse" } }, "400": { "description": "A request field is invalid.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "401": { "description": "The API key cannot be authenticated.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "403": { "description": "The API key does not have permission to access the resource.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "429": { "description": "You have exceeded the rate limit.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "500": { "description": "Internal server error.", "schema": { "$ref": "#/definitions/googlerpcStatus" } }, "default": { "description": "An unexpected error response.", "schema": { "$ref": "#/definitions/googlerpcStatus" } } }, "parameters": [ { "name": "regionId", "in": "query", "required": false, "type": "string" }, { "name": "servicePlan", "in": "query", "required": false, "type": "string", "enum": [ "Starter", "Essential", "Premium", "BYOC", "Dedicated", "Premium_Reserved", "Essential_V2" ] }, { "name": "pageSize", "in": "query", "required": false, "type": "integer", "format": "int32" }, { "name": "pageToken", "in": "query", "required": false, "type": "string" } ], "tags": [ "CustomerManagedEncryptionKeyService" ] } } }, "definitions": { "commonv1beta1ServicePlan": { "type": "string", "enum": [ "Starter", "Essential", "Premium", "BYOC", "Dedicated", "Premium_Reserved", "Essential_V2" ] }, "googlerpcStatus": { "type": "object", "properties": { "code": { "type": "integer", "format": "int32", "description": "The status code, which should be an enum value of\n[google.rpc.Code][google.rpc.Code]." }, "message": { "type": "string", "description": "A developer-facing error message, which should be in English. Any\nuser-facing error message should be localized and sent in the\n[google.rpc.Status.details][google.rpc.Status.details] field, or localized\nby the client." }, "details": { "type": "array", "items": { "type": "object", "$ref": "#/definitions/protobufAny" }, "description": "A list of messages that carry the error details. There is a common set of\nmessage types for APIs to use." } }, "description": "The `Status` type defines a logical error model that is suitable for\ndifferent programming environments, including REST APIs and RPC APIs. It is\nused by [gRPC](https://github.com/grpc). Each `Status` message contains\nthree pieces of data: error code, error message, and error details.\n\nYou can find out more about this error model and how to work with it in the\n[API Design Guide](https://cloud.google.com/apis/design/errors)." }, "nextgenv1beta2CmekAccessIamPrincipal": { "type": "object", "properties": { "regionId": { "type": "string", "readOnly": true }, "servicePlan": { "$ref": "#/definitions/commonv1beta1ServicePlan" }, "aws": { "$ref": "#/definitions/nextgenv1beta2CmekAccessIamPrincipalAwsCmekPrincipal" }, "aliyun": { "$ref": "#/definitions/nextgenv1beta2CmekAccessIamPrincipalAliyunCmekPrincipal" } }, "required": [ "servicePlan" ] }, "nextgenv1beta2CmekAccessIamPrincipalAliyunCmekPrincipal": { "type": "object", "properties": { "accountId": { "type": "string", "description": "The Alibaba Cloud account ID of the CMEK IAM principal.", "readOnly": true } } }, "nextgenv1beta2CmekAccessIamPrincipalAwsCmekPrincipal": { "type": "object", "properties": { "accountId": { "type": "string", "description": "The AWS account ID of the CMEK IAM principal.", "readOnly": true }, "externalId": { "type": "string", "description": "The AWS STS AssumeRole `ExternalId` that must be pinned in the KMS\nkey policy's `Condition` block when granting access to this principal.", "readOnly": true } } }, "nextgenv1beta2CustomerManagedEncryptionKey": { "type": "object", "properties": { "name": { "type": "string", "description": "The unique name of the CMEK, in the format of `cmeks/{cmek_id}`.", "readOnly": true }, "customerManagedEncryptionKeyId": { "type": "string", "description": "The ID of the CMEK.", "readOnly": true }, "regionId": { "type": "string", "description": "The region where the CMEK is located, in the format of `{cloud_provider}-{region_code}`. For example, `aws-us-west-2`." }, "cloudProvider": { "description": "The cloud provider where the CMEK is located.\n\n- `\"aws\"`: Amazon Web Services\n\n- `\"gcp\"`: Google Cloud (not yet supported, planned for a future release)\n\n- `\"azure\"`: Microsoft Azure (not yet supported, planned for a future release)\n\n- `\"alicloud\"`: Alibaba Cloud", "readOnly": true, "allOf": [ { "$ref": "#/definitions/v1beta1RegionCloudProvider" } ] }, "servicePlan": { "$ref": "#/definitions/commonv1beta1ServicePlan" }, "awsKms": { "description": "The configuration for AWS KMS.", "allOf": [ { "$ref": "#/definitions/nextgenv1beta2CustomerManagedEncryptionKeyAwsKms" } ] }, "aliyunKms": { "description": "The configuration for Alibaba Cloud KMS.", "allOf": [ { "$ref": "#/definitions/nextgenv1beta2CustomerManagedEncryptionKeyAliyunKms" } ] }, "awsPrincipal": { "description": "AWS IAM principal.", "allOf": [ { "$ref": "#/definitions/nextgenv1beta2CmekAccessIamPrincipalAwsCmekPrincipal" } ] }, "aliyunPrincipal": { "description": "Alibaba Cloud RAM principal.", "allOf": [ { "$ref": "#/definitions/nextgenv1beta2CmekAccessIamPrincipalAliyunCmekPrincipal" } ] }, "createTime": { "type": "string", "format": "date-time", "description": "The timestamp when the CMEK was created, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.", "readOnly": true } }, "required": [ "regionId", "servicePlan" ] }, "nextgenv1beta2CustomerManagedEncryptionKeyAliyunKms": { "type": "object", "properties": { "kmsKeyArn": { "type": "string", "description": "The Alibaba Cloud KMS key ARN used for encryption, e.g.\n`acs:kms:ap-southeast-1:5841052134823325:key/key-sgp68887a54phjt9703ut`." } }, "required": [ "kmsKeyArn" ] }, "nextgenv1beta2CustomerManagedEncryptionKeyAwsKms": { "type": "object", "properties": { "kmsKeyArn": { "type": "string", "description": "The Amazon Resource Name (ARN) of the AWS KMS key used for encryption." } }, "required": [ "kmsKeyArn" ] }, "nextgenv1beta2ListCustomerManagedEncryptionKeysResponse": { "type": "object", "properties": { "customerManagedEncryptionKeys": { "type": "array", "items": { "type": "object", "$ref": "#/definitions/nextgenv1beta2CustomerManagedEncryptionKey" } }, "nextPageToken": { "type": "string" } } }, "nextgenv1beta2VerifyCmekAccessIamPrincipalResponse": { "type": "object", "properties": { "valid": { "type": "boolean" }, "failReason": { "type": "string" } } }, "protobufAny": { "type": "object", "properties": { "@type": { "type": "string", "description": "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n URL, or have them precompiled into a binary to avoid any\n lookup. Therefore, binary compatibility needs to be preserved\n on changes to types. (Use versioned type names to manage\n breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com. As of May 2023, there are no widely used type server\nimplementations and no plans to implement one.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics." } }, "additionalProperties": {}, "description": "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n Foo foo = ...;\n Any any;\n any.PackFrom(foo);\n ...\n if (any.UnpackTo(\u0026foo)) {\n ...\n }\n\nExample 2: Pack and unpack a message in Java.\n\n Foo foo = ...;\n Any any = Any.pack(foo);\n ...\n if (any.is(Foo.class)) {\n foo = any.unpack(Foo.class);\n }\n // or ...\n if (any.isSameTypeAs(Foo.getDefaultInstance())) {\n foo = any.unpack(Foo.getDefaultInstance());\n }\n\n Example 3: Pack and unpack a message in Python.\n\n foo = Foo(...)\n any = Any()\n any.Pack(foo)\n ...\n if any.Is(Foo.DESCRIPTOR):\n any.Unpack(foo)\n ...\n\n Example 4: Pack and unpack a message in Go\n\n foo := \u0026pb.Foo{...}\n any, err := anypb.New(foo)\n if err != nil {\n ...\n }\n ...\n foo := \u0026pb.Foo{}\n if err := any.UnmarshalTo(foo); err != nil {\n ...\n }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\nJSON\n====\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n package google.profile;\n message Person {\n string first_name = 1;\n string last_name = 2;\n }\n\n {\n \"@type\": \"type.googleapis.com/google.profile.Person\",\n \"firstName\": \u003cstring\u003e,\n \"lastName\": \u003cstring\u003e\n }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n {\n \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n \"value\": \"1.212s\"\n }" }, "v1beta1RegionCloudProvider": { "type": "string", "enum": [ "aws", "gcp", "azure", "alicloud" ], "description": "Enum of cloud provider names.\n\n - aws: Amazon Web Services.\n - gcp: Google Cloud Platform.\n - azure: Microsoft Azure.\n - alicloud: Alibaba Cloud." } } }