Locate KMS objects by tags, optionally filtering by `ObjectType`. This avoids returning objects of wrong type when multiple object types share the sam

This operation requests the server to perform message authentication code (MAC) operation on the provided data using a Managed Cryptographic Object as

Minimum length of the plaintext for FPE to be secure. Returns the smallest `n` such that `alphabet_len^n >= RECOMMENDED_THRESHOLD`.

Parse a CNG hash algorithm name (wide string) into a `HashingAlgorithm`. Returns `None` if the pointer is null or the algorithm is unknown.

Single source of truth to parse placeholder index from a UniqueIdentifier text string. Supports raw (uid-N / $UNIQUE_IDENTIFIER_N) and namespaced (tes

Strip the `secret://` prefix and split at the first `/`. Returns `(first_segment, remainder)`.

Send an HTTP POST request with a JSON body. # Errors Returns an error if the request fails.

Convert an error HTTP response into the appropriate `KmsClientError` variant. Returns [`KmsClientError::Unauthorized`] for 401, otherwise [`KmsClient

Record HSM operation. `operation` must be a `'static` literal (e.g. `Op::OP_NAME`, `"Wrap"`, `"Unwrap"`). `hsm_model` is a runtime label from `hsm_mo

Record a KMIP operation

Record KMIP operation duration

Extract the `Id` from a `SearchOptions`, returning an error if `All` was passed. Centralises the "find requires an ID" check shared by four `Backend`

Run an async future on a dedicated thread with a fresh single-threaded tokio runtime. Required because config loading runs before the main runtime.

Helper: wrap a URI in a minimal TOML table and resolve it.

Revoke access to a user

Run all XML vectors in a directory (sorted alphabetically) against the shared test server. Optionally exclude specific filenames (e.g., PKCS11 tests t

Build a `Create` request for a secret data - random Seed of 32 bytes generated server-side

Set the `DeactivationDate` attribute on a key via KMIP `SetAttribute`.

Set the requested validity days This is the number of days the certificate will be valid for The requested validity days is stored as a vendor attribu

Issue a minimal HTTP GET to `url` (on a plain TCP connection) after sleeping `delay_ms` milliseconds. Runs on a dedicated OS thread so it does not co

Spawn a one-shot raw-TCP HTTP/1.1 server on `port` that reads a single request and replies with the supplied `status_line` and JSON `body`. Returns t

Starts the Key Management System (KMS) server based on the provided configuration. The server is started using one of three methods: 1. Plain HTTP, 2

Full key lifecycle exercised against the HSM-backed KMS. Stages (each one exercises HSM wrap/unwrap at the DB layer): 1. **Create** — AES-256 key, s

Helper: create a KMS instance for tests

Attempt to decrypt the given ciphertext response; returns Ok(value) on success.

Create a unique path inside the system temp directory

Insert the object

Check whether `user` is allowed to perform `operation` on this object. Returns `true` if the user is the owner or has been explicitly granted the req

Check if a user has permission to perform an operation on an object. If the user is the owner of the object, it will always return true. For non-HSM o

Validate API version for all requests

Validate the cache entry for `uid` against the current object from the DB. If the fingerprint of the cached entry differs from the fingerprint of `cu

Optional vault-token middleware for scopes that also accept native KMS authentication. This middleware allows AppRole/SPIRE clients that hold a valid

Verify the `wrapping_key_id` write path and `find_wrapped_by` query across every backend: a wrapped object must be discoverable by its wrapping key, w

Write a JSON object to a file # Errors If the file cannot be opened or written, an error is returned.