KMS

The KMS REST surface is mounted under /minio/kms/v1 by cmd/kms-router.go. Endpoints proxy the underlying KMS backend (KES in production, single-key for dev). They are restricted to admin credentials.

Endpoints

Path	What it does
GET /minio/kms/v1/status	KMS health + reachable backend.
GET /minio/kms/v1/key/list	List configured KEK names.
POST /minio/kms/v1/key/create	Create a new KEK on the backend.
POST /minio/kms/v1/key/import	Import a KEK from a wrapped blob (KES variants).
POST /minio/kms/v1/key/delete	Delete a KEK on the backend (when supported).
GET /minio/kms/v1/key/status?key-id=...	Per-key status.
GET /minio/kms/v1/policy/list	KES policies (when the backend supports them).
GET /minio/kms/v1/identity/list	KES identities (when the backend supports them).

The full list lives in cmd/kms-handlers.go.

Auth

Same as other admin endpoints: SigV4 with admin-action permissions. The mc admin kms key family is the user-facing CLI.

Backend dependence

Some endpoints work only when the backend is KES (internal/kms/kes.go):

• Policy and identity management are KES-specific.
• Key import requires a KES key-wrapping pubkey.

single-key.go and stub.go backends respond with not implemented for those paths.

Auto-encryption

When MINIO_KMS_AUTO_ENCRYPTION=on, the server ensures every PUT goes through SSE-S3 with the configured KEK. The setting is part of the cluster config so peers stay in sync.

See also

• KMS and encryption — the runtime view.
• crypto and kms — the package-level details.