Send a `Revoke` request with the given `reason_code` and `cascade` flag. Returns the parsed `RevokeResponse` on success, or a `KmsError` on failure.

Issue a certificate using KMIP `Certify`. Uses RSA-2048 (FIPS-approved) unless `CryptographicAlgorithm::RSA` is unavailable. When `issuer_cert_id` /

Create a self-signed CA keypair + certificate using `build_certify_request` with `generate_key_pair = true` and no issuer.

Export an Object from the KMS # Arguments `kms_rest_client` - The KMS client connector `object_id_or_tags` - The KMS object id or tags `params` - Exp

Generate a random nonce for the given symmetric cipher.

HTTP `Content-Type` header value for this transport.

This operation is used to indicate to the server that the key material for the specified Managed Object SHALL be destroyed or rendered inaccessible. T

Helper: grant operations on an HSM key

List all the operations that have been granted to a user on an object These operations may have been directly granted or via the wildcard user unless

Converts an `Option<String>` containing an empty or whitespace-only value to `None`. This guards against UI form fields that produce `""` when cleare

Activate the Crypto Officer role via a split-key ceremony. Validates and processes the ceremony activation: - Retrieves and validates all shares. - V

This operation requests the server to revoke a Managed Cryptographic Object or an Opaque Object. The request contains a reason for the revocation (e.g

Filename-safe slug for output files (e.g. `"benchmarks_kmip-json.json"`).

Creates a test application instance using an explicit `ClapConfig`. This is useful for end-to-end KMIP policy tests that need to tune allowlists and

Serialize the data to encrypt to bytes

This operation requests the server to generate a new public/private key pair and register the two corresponding new Managed Cryptographic Object The r

Export a PQC certificate and parse it with `x509_parser`. Returns (Object, Attributes, DER bytes).

Finalize key creation: create the key pair in the KMS and transition from `Pending` to `Persisted`.

Build an [`ObjectHandle`] from an optional `UniqueIdentifier` request field. Extracts and validates the unique identifier from a KMIP request, elimin

This operation requests one or more attributes associated with a Managed Object. The object is specified by its Unique Identifier, and the attributes

Get a slot If a slot has already been opened, returns the opened slot. To close a slot before re-opening it with another password, call `close_slot()`

Spin up a fresh in-process KMS backed by a temporary `SQLite` database.

Privileged users. Base configuration is loaded from `test_data/configs/server/rbac/crypto_officer_users.toml`; the `crypto_officer_users` field is in

Start a server from a pre-loaded (and optionally patched) [`ClapConfig`].

Create a criterion benchmark group and (re)start its per-group timer.

Perform an atomic set of operations on the database. This function executes a series of operations (typically in a transaction) atomically. It assume

Self-signed PQC certificate creation + basic link verification.

Create the given Object in the database. A new UUID will be created if none is supplier. This method will fail if an ` uid ` is supplied and an object

This operation requests the server to generate a new symmetric key or generate Secret Data as a Managed Cryptographic Object. The request contains inf

Call `generate_crl` and return the DER bytes.

This operation requests one or more attributes associated with a Managed Object. The object is specified by its Unique Identifier, and the attributes

Returns the currently configured vendor identification string.

Convert a KMIP Public key to openssl `PKey<Public>` The supported `KeyFormatType` are: PKCS1 PKCS8: actually a SPKI DER (RFC 5480) `TransparentRSAPub

Load the configuration from a toml file. # Errors Return an error if the configuration file is not found or if the file is not a valid toml file.

Return a mutable borrow to the Object Do not use this to set a new object or make sure you clear the cached unwrapped object

This operation is used by the client to interrogate the server to determine its capabilities and/or protocol mechanisms. The Query operation SHOULD be

This operation requests the server to perform a signature operation on the provided data using a Managed Object specified by its Unique Identifier. Th

This method updates the specified object identified by its `uid` in the database. If the `tags` parameter is `None`, the tags will not be updated. #

Override the database backend used by `start_default_test_kms_server` via the `KMS_TEST_DB` environment variable. | `KMS_TEST_DB` value

Generate a random key for the given symmetric cipher.

Send a KMIP request to the server and return the response

Serialize a `RequestMessage` to the wire body for this transport.

Set the wrapping key id This is the key that will be used to wrap the key on creation The wrapping key id is stored as a vendor attribute # Arguments

This operation requests the server to validate a certificate chain and return information on its validity. Only a single certificate chain SHALL be in

Helper: decode a base64url (no-padding) string to bytes, returning `CryptoApiError::BadRequest` with a descriptive message on failure.

Create an AES-256 symmetric key and return its UID.

Decrypt the ciphertext using the given symmetric cipher. Return the decrypted plaintext. The tag is required for AEAD ciphers (`AES GCN`, `ChaCha20 P

Encrypt the plaintext using the given symmetric cipher. Return the ciphertext and the tag. For XTS mode, the nonce is the tweak, the aad is ignored, a

This operation requests the server to Import a Managed Object specified by its Unique Identifier. The request specifies the object being imported and

Helper: revoke operations on an HSM key

Create a test KMS instance from the default HTTPS config.