Retrieve the AKV configuration for an SVM specified by the UUID

security key-manager external azure show
security key-manager external azure check

Parameters

Name	Type	In	Required	Description
uuid	string	path	True	AKV UUID
fields	array[string]	query	False	Specify the fields to return.

Name

Type

In

Required

Description

uuid

string

path

True

AKV UUID

fields

array[string]

query

False

Specify the fields to return.

Response

Status: 200, Ok

Name Type Description

Name	Type	Description
_links	_links
authentication_method	string	Authentication method for the AKV instance.
azure_reachability	azure_reachability	Indicates whether or not the AKV service is reachable from all the nodes in the cluster. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the `fields` query parameter or GET for all advanced properties is enabled.
client_id	string	Application client ID of the deployed Azure application with appropriate access to an AKV.
configuration	configuration	Security keystore object reference.
ekmip_reachability	array[ekmip_reachability]
enabled	boolean	Indicates whether the configuration is enabled.
key_id	string	Key Identifier of AKV key encryption key.
name	string	Name of the deployed AKV that will be used by ONTAP for storing keys. example: https://kmip-akv-keyvault.vault.azure.net/ format: uri Introduced in: 9.8 readCreate: 1 x-nullable: true
oauth_host	string	Open authorization server host name.
port	integer	Authorization server and vault port number.
proxy_host	string	Proxy host.
proxy_port	integer	Proxy port.
proxy_type	string	Type of proxy.
proxy_username	string	Proxy username.
scope	string	Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster".
skip_verification	boolean	Set to true to skip the verification of the updated user credentials when updating credentials. The default value is false.
state	state	Indicates whether or not the AKV wrapped internal key is available cluster wide. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the `fields` query parameter or GET for all advanced properties is enabled.
svm	svm	SVM, applies only to SVM-scoped objects.
tenant_id	string	Directory (tenant) ID of the deployed Azure application with appropriate access to an AKV.
uuid	string	A unique identifier for the Azure Key Vault (AKV).
vault_host	string	AKV host subdomain.
verify_host	boolean	Verify the identity of the AKV host name.
verify_ip	boolean	Verify the identity of the AKV IP address.

_links

authentication_method

string

Authentication method for the AKV instance.

azure_reachability

Indicates whether or not the AKV service is reachable from all the nodes in the cluster. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the fields query parameter or GET for all advanced properties is enabled.

client_id

string

Application client ID of the deployed Azure application with appropriate access to an AKV.

configuration

Security keystore object reference.

ekmip_reachability

array[ekmip_reachability]

enabled

boolean

Indicates whether the configuration is enabled.

key_id

string

Key Identifier of AKV key encryption key.

name

string

Name of the deployed AKV that will be used by ONTAP for storing keys.

example: https://kmip-akv-keyvault.vault.azure.net/
format: uri
Introduced in: 9.8
readCreate: 1
x-nullable: true

oauth_host

string

Open authorization server host name.

port

integer

Authorization server and vault port number.

proxy_host

string

Proxy host.

proxy_port

integer

Proxy port.

proxy_type

string

Type of proxy.

proxy_username

string

Proxy username.

scope

string

Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster".

skip_verification

boolean

Set to true to skip the verification of the updated user credentials when updating credentials. The default value is false.

state

Indicates whether or not the AKV wrapped internal key is available cluster wide. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the fields query parameter or GET for all advanced properties is enabled.

svm

SVM, applies only to SVM-scoped objects.

tenant_id

string

Directory (tenant) ID of the deployed Azure application with appropriate access to an AKV.

uuid

string

A unique identifier for the Azure Key Vault (AKV).

vault_host

string

AKV host subdomain.

verify_host

boolean

Verify the identity of the AKV host name.

verify_ip

boolean

Verify the identity of the AKV IP address.

Example response

{
  "_links": {
    "self": {
      "href": "/api/resourcelink"
    }
  },
  "authentication_method": "client_secret",
  "azure_reachability": {
    "code": "346758",
    "message": "AKV service is not reachable from all nodes - reason."
  },
  "client_id": "aaaaaaaa-bbbb-aaaa-bbbb-aaaaaaaaaaaa",
  "configuration": {
    "_links": {
      "self": {
        "href": "/api/resourcelink"
      }
    },
    "name": "default",
    "uuid": "1cd8a442-86d1-11e0-ae1c-123478563434"
  },
  "ekmip_reachability": [
    {
      "code": "346758",
      "message": "embedded KMIP server status unavailable on node.",
      "node": {
        "_links": {
          "self": {
            "href": "/api/resourcelink"
          }
        },
        "name": "node1",
        "uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
      }
    }
  ],
  "key_id": "https://keyvault1.vault.azure.net/keys/key1/12345678901234567890123456789012",
  "name": "https://kmip-akv-keyvault.vault.azure.net/",
  "oauth_host": "login.microsoftonline.com",
  "port": 443,
  "proxy_host": "proxy.eng.com",
  "proxy_port": 1234,
  "proxy_type": "http",
  "proxy_username": "proxyuser",
  "scope": "string",
  "skip_verification": "",
  "state": {
    "code": "346758",
    "message": "Top-level internal key protection key (KEK) is unavailable on the following nodes with the associated reasons: Node: node1. Reason: No volumes created yet for the SVM. Wrapped KEK status will be available after creating encrypted volumes."
  },
  "svm": {
    "_links": {
      "self": {
        "href": "/api/resourcelink"
      }
    },
    "name": "svm1",
    "uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
  },
  "tenant_id": "zzzzzzzz-yyyy-zzzz-yyyy-zzzzzzzzzzzz",
  "uuid": "1cd8a442-86d1-11e0-ae1c-123478563412",
  "vault_host": "vault.azure.net",
  "verify_host": "",
  "verify_ip": ""
}

Error

Status: Default

ONTAP Error Response Codes

Error Code	Description
65537549	The Azure Key Vault Key Management Service is unreachable from one or more nodes.
65537551	Top-level internal key protection key (KEK) unavailable on one or more nodes.
65537552	Embedded KMIP server status not available.

Also see the table of common errors in the Response body overview section of this documentation.

Name	Type	Description
error	returned_error

Name

Type

Description

error

returned_error

Example error

{
  "error": {
    "arguments": [
      {
        "code": "string",
        "message": "string"
      }
    ],
    "code": "4",
    "message": "entry doesn't exist",
    "target": "uuid"
  }
}

Definitions

See Definitions

href

Name	Type	Description
href	string

Name

Type

Description

href

string

_links

Name	Type	Description
self	href

Name

Type

Description

self

href

azure_reachability

Indicates whether or not the AKV service is reachable from all the nodes in the cluster. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the fields query parameter or GET for all advanced properties is enabled.

Name	Type	Description
code	string	Code corresponding to the status message. Returns a 0 if AKV service is reachable from all nodes in the cluster.
message	string	Error message set when reachability is false.
reachable	boolean	Set to true when the AKV service is reachable from all nodes of the cluster.

Name

Type

Description

code

string

Code corresponding to the status message. Returns a 0 if AKV service is reachable from all nodes in the cluster.

message

string

Error message set when reachability is false.

reachable

boolean

Set to true when the AKV service is reachable from all nodes of the cluster.

configuration

Security keystore object reference.

Name	Type	Description
_links	_links
name	string	Name of the configuration.
uuid	string	Keystore UUID.

Name

Type

Description

_links

name

string

Name of the configuration.

uuid

string

Keystore UUID.

node

Name	Type	Description
_links	_links
name	string
uuid	string

Name

Type

Description

_links

name

string

uuid

string

ekmip_reachability

Provides the connectivity status for the given SVM on the given node to all EKMIP servers configured on all nodes of the cluster. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the fields query parameter or GET for all advanced properties is enabled.

Name	Type	Description
code	string	Code corresponding to the error message. Returns a 0 if a given SVM is able to communicate to the EKMIP servers of all of the nodes in the cluster.
message	string	Error message set when cluster-wide EKMIP server availability from the given SVM and node is false.
node	node
reachable	boolean	Set to true if the given SVM on the given node is able to communicate to all EKMIP servers configured on all nodes in the cluster.

Name

Type

Description

code

string

Code corresponding to the error message. Returns a 0 if a given SVM is able to communicate to the EKMIP servers of all of the nodes in the cluster.

message

string

Error message set when cluster-wide EKMIP server availability from the given SVM and node is false.

node

reachable

boolean

Set to true if the given SVM on the given node is able to communicate to all EKMIP servers configured on all nodes in the cluster.

state

Indicates whether or not the AKV wrapped internal key is available cluster wide. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the fields query parameter or GET for all advanced properties is enabled.

Name	Type	Description
available	boolean	Set to true when an AKV wrapped internal key is present on all nodes of the cluster.
code	string	Code corresponding to the status message. Returns a 0 if AKV wrapped key is available on all nodes in the cluster.
message	string	Error message set when top-level internal key protection key (KEK) availability on cluster is false.

Name

Type

Description

available

boolean

Set to true when an AKV wrapped internal key is present on all nodes of the cluster.

code

string

Code corresponding to the status message. Returns a 0 if AKV wrapped key is available on all nodes in the cluster.

message

string

Error message set when top-level internal key protection key (KEK) availability on cluster is false.

svm

SVM, applies only to SVM-scoped objects.

Name	Type	Description
_links	_links
name	string	The name of the SVM. This field cannot be specified in a PATCH method.
uuid	string	The unique identifier of the SVM. This field cannot be specified in a PATCH method.

Name

Type

Description

_links

name

string

The name of the SVM. This field cannot be specified in a PATCH method.

uuid

string

The unique identifier of the SVM. This field cannot be specified in a PATCH method.

error_arguments

Name	Type	Description
code	string	Argument code
message	string	Message argument

Name

Type

Description

code

string

Argument code

message

string

Message argument

returned_error

Name	Type	Description
arguments	array[error_arguments]	Message arguments
code	string	Error code
message	string	Error message
target	string	The target parameter that caused the error.

Name

Type

Description

arguments

array[error_arguments]

Message arguments

code

string

Error code

message

string

Error message

target

string

The target parameter that caused the error.

Retrieve the AKV configuration for an SVM specified by the UUID

Creating your file...

Related ONTAP commands

Parameters

Response

Error

Definitions