<value>

Specify a value for this parameter.

[parameter]

The parameter is optional.

value1|value2

Choose one of the listed values.

--flag

Enable the option by including the flag in the command; no value is shown in the syntax.

hicli csp list

List configured CSPs.

hicli csp new

Create a CSP configuration for AWS, Azure, GCP, OCI, or Salesforce.

hicli csp detail

Display details for a CSP.

hicli csp check

Check a CSP configuration.

hicli csp rm

Remove a CSP configuration.

hicli csp set

Update a CSP's description, credentials, or provider-specific settings.

hicli csp rotate

Rotate a CSP certificate.

hicli csp users

List users associated with a CSP.

hicli csp roles

List roles associated with a CSP.

hicli csp regions

List regions available for a CSP.

hicli csp keyvaults

List key vaults available for a CSP.

hicli csp managedhsms

List managed HSMs available for a CSP.

hicli csp keyrings

List keyrings for a CSP and optionally request synchronization.

hicli csp ekmconnections

List EKM connections at the specified location.

hicli csp key_algorithms

List key algorithms supported by a CSP.

hicli csp kaj_policy

Apply a KAJ policy to a CSP, optionally using a file.

hicli csp kaj_policy_state

Enable or disable a CSP's KAJ policy.

hicli csp ekm_acls

Apply EKM ACLs to a CSP, optionally using a file.

hicli csp cert_auth

Configure certificate authentication for a CSP.

hicli csp get_cert_details

Display certificate details for a CSP.

<name>

Name to assign to a new CSP.

<group>

Group associated with the new CSP.

--name

Select an existing CSP by name.

--guid

Select an existing CSP by GUID.

--csp_type

CSP provider type: AWS, AZURE, GCP, OCI, or SFDC.

--description

Optional human-readable description.

--aws_access_key_id

AWS access key ID.

--aws_secret_access_key

Secret access key corresponding to the AWS access key ID.

--default_region

Default AWS region used for CSP operations.

--azure_tenant_id

Azure tenant ID.

--azure_subscription_id

Azure subscription ID.

--azure_client_id

Client ID of the Azure application used for authentication.

--azure_application_objectid

Object ID of the Azure application.

--azure_client_secret

Client secret for the Azure application.

--use_cert_auth

Enable or disable certificate-based Azure authentication.

--generate_new_cert

Specify whether to generate a new certificate when updating the Azure CSP.

--self_sign_cert

Specify whether the certificate should be self-signed.

--cert_expiry

Certificate validity period in days.

--common_name

Common name to use for the certificate.

--signed_cert_file

Path to the signed certificate file.

--private_key_file

Path to the private key file.

--passphrase

Passphrase used to protect the private key.

--gcp_key_file

Path to the GCP key file.

--ekm_uri

URI for the GCP EKM configuration.

--ekm_service_account

Service account used for the GCP EKM configuration.

--oci_user_ocid

OCI user OCID.

--oci_fingerprint

Fingerprint associated with the OCI signing key.

--oci_key_content

OCI API signing key content.

--oci_key_passphrase

Passphrase for the OCI API signing key.

--oci_tenancy_ocid

OCI tenancy OCID.

--oci_bucket

OCI bucket used by the configuration.

--oci_storage_namespace

OCI object storage namespace.

--sfdc_client_id

Salesforce client ID.

--sfdc_client_secret

Salesforce client secret.

--sfdc_domain

Salesforce domain.

--sfdc_wrapping_cert

Certificate used for Salesforce key wrapping.

--sfdc_named_credential

Salesforce named credential.

--access_key_rotation_interval

Access-key rotation interval in days.

--sync

Specify whether to synchronize keyrings: yes or no.

--location

Location used when listing EKM connections.

--in

Input file containing KAJ policy or EKM ACL data.

hicli keyset list

List keysets.

hicli keyset new

Create a keyset and optionally configure its CSP, HSM, caching, rekey, XKS, and TDE settings.

hicli keyset detail

Display details for a keyset.

hicli keyset select

Select a keyset.

hicli keyset rm

Remove a keyset.

hicli keyset keyrings

List keyrings associated with a keyset.

hicli keyset verify_hsm

Verify HSM configuration for a keyset.

hicli keyset set

Update keyset settings.

hicli keyset add_tde_connector

Add a TDE connector to a keyset.

hicli keyset list_tde_connectors

List TDE connectors associated with a keyset.

hicli keyset tde_connector enable

Enable the named TDE connector.

hicli keyset tde_connector disable

Disable the named TDE connector.

hicli keyset tde_connector delete

Delete the named TDE connector.

hicli keyset create_tde_connector_token

Create a token for a TDE connector.

hicli keyset verify_tde_connector_token

Verify a token for a TDE connector.

hicli keyset set_sync_schedule

Set an automatic synchronization schedule for a resource.

hicli keyset container_purge

Purge a container in a key vault or managed HSM.

<name>

Name to assign to a new keyset.

<group>

Group associated with the new keyset.

--name

Select an existing keyset by name.

--guid

Select an existing keyset by GUID.

--csp_guid

GUID of the CSP to associate with the keyset.

--description

Optional human-readable description.

--rekey_interval

Rekey interval. The set command describes this value in days.

--enable_hsm

Enable or disable HSM use: yes or no.

--key_caching_enabled

Enable or disable key caching: yes or no.

--enable_hsm_key_caching

Enable HSM key caching.

--part_label

HSM partition label.

--part_password

Password for the HSM partition.

--import_all_keys

Request that all keys be imported.

--xks_access_id

XKS access ID.

--xks_access_key

XKS secret access key.

--tde_database_type

Database type for the TDE configuration.

--allow_mdb_key_creation

Controls whether MDB key creation is allowed.

<connectorname>

Name of the TDE connector.

<cvmid>

CVM ID associated with the TDE connector.

--expiration

Expiration date for the TDE connector.

<tde_access_token>

Token to verify for the TDE connector.

--auto_sync_schedule

Automatic synchronization schedule to set.

--region

Region whose synchronization schedule is being configured.

--keyvault

Key vault whose synchronization schedule is being configured or whose container is being purged.

--managedhsm

Managed HSM whose synchronization schedule is being configured or whose container is being purged.

--keyringID

Keyring identifier used when setting a synchronization schedule.

hicli cloudkey list

List keys in a region, key vault, managed HSM, or keyring.

hicli cloudkey new

Create a cloud key and configure its location, algorithm, protection, expiry, and provider-specific settings.

hicli cloudkey set

Update a cloud key's description, rekey, expiry, activation, or provider-specific settings.

hicli cloudkey detail

Display details about a cloud key.

hicli cloudkey disable

Disable a cloud key.

hicli cloudkey enable

Enable a cloud key.

hicli cloudkey delete_from_cloud

Delete a cloud key from the provider.

hicli cloudkey upload_to_cloud

Upload a cloud key to the provider.

hicli cloudkey versions

List versions of a cloud key.

hicli cloudkey rm

Schedule removal of a cloud key or cancel scheduled removal.

hicli cloudkey purge

Purge a cloud key.

hicli cloudkey import

Import a key into a region, key vault, managed HSM, or keyring.

hicli cloudkey rotate

Rotate a cloud key.

hicli cloudkey tag list

List tags on a cloud key.

hicli cloudkey tag set

Set a tag on a cloud key.

hicli cloudkey tag clear

Clear a tag from a cloud key.

hicli cloudkey users

Provide user and administrator lists for a cloud key.

hicli cloudkey policy_get

Get a cloud key policy and optionally write it to a file.

hicli cloudkey policy_set

Set a cloud key policy, optionally reading it from a file.

hicli cloudkey roles_get

Get roles for a keyring key and optionally write them to a file.

hicli cloudkey roles_set

Set roles for a keyring key, optionally reading them from a file.

hicli cloudkey keyops

Set the operations allowed for a cloud key.

hicli cloudkey getpublickey

Get the public key for a cloud key.

hicli cloudkey set_primary

Set a key version as primary.

hicli cloudkey kaj_policy

Apply a KAJ policy to a keyring key.

hicli cloudkey has_ekm_acls enable

Enable EKM ACLs for a keyring key.

hicli cloudkey has_ekm_acls disable

Disable EKM ACLs for a keyring key.

hicli cloudkey ekm_acls

Apply EKM ACLs to a keyring key.

<name>

Name to assign to a new cloud key.

--name

Select a cloud key by name. The command may also require the key's provider resource.

--region

Region containing or used for the key.

--keyvault

Key vault containing or associated with the key.

--managedhsm

Managed HSM containing or associated with the key.

--keyring

Keyring containing or associated with the key.

--handle

Identify a key by its handle where supported.

--description

Optional human-readable description of the key.

--cipher

Cipher to use for the key.

--protection_level

GCP protection level or EKM connection type.

--purpose

Intended purpose of the key.

--algorithm

Key algorithm.

--hardware_protected

Request hardware protection for the key.

--rekey_interval

Rekey interval for the key.

--no-expire

Specify that the key should not expire.

--expire_date

Expiration date in mm/dd/yyyy format or a number of days.

--relative_expiry

Specify whether the expiry value is relative: True or False.

--no-key-wide-expire

Specify that the key should not use key-wide expiry.

--key_wide_expire_date

Key-wide expiration date in mm/dd/yyyy format.

--expire_action

Expiration action: DISABLE, DELETE_FROM_CLOUD, or DELETE.

--operations

Operations to allow for the key.

--activation_date

Date when the key should become active.

--ekm_connection

EKM connection to associate with the key.

--dke_permissions

DKE permissions to configure for the key.

--dke_cache

DKE cache setting.

--oci_compartment_id

OCI compartment ID for the key.

--sfdc_data_type

Salesforce data type associated with the key.

--sfdc_use_derivation

Salesforce key-derivation setting.

--sfdc_cache_only_key

Salesforce cache-only-key setting.

--after_days

Number of days before scheduled key removal.

--cancel

Cancel a scheduled key removal.

--force_purge

Force-purge option for the purge operation.

--key

Tag name to set or clear.

--value

Value to assign to a tag.

--user_list

User list supplied to the cloud key command.

--admin_list

Administrator list supplied to the cloud key command.

--in

Input file containing policy, role, KAJ policy, or EKM ACL data.

--out

Output file for policy or role data.

--guid

GUID of the key version to set as primary.

hicli byok log

Display BYOK logs for the specified group.

<group>

Group whose BYOK logs should be displayed.