FAQ

KMS FAQ and limits

Frequently asked questions

How do I check if KMS is available in my region?

Call GET /v1/kms/summary. The response includes featureEnabled for your organisation and kmsAvailable per region. See Getting started.

Can I rename a key or update its description?

No. Name, description, labels, and annotations are set at creation and cannot be changed. Create a new key and migrate workloads if you need different metadata.

Can I enable export after creating a key?

No. exportAllowed must be set at create time. You cannot enable key material export on an existing key.

Do I need to re-encrypt data after rotation?

No. Ciphertext embeds the key version. KMS decrypts with the correct version automatically after rotation.

Can I use a key across regions?

No. Keys are regional. Crypto operations must call the API path for the key’s region.

Why do I get 404 when I know the key exists?

Insufficient IAM permissions return 404 Not Found instead of 403 Forbidden to avoid revealing key existence. Verify your role bindings and project scope.

Can I import HMAC keys?

No. HMAC key types cannot be imported via BYOK.

Limits

Limit	Value
Encrypt/decrypt plaintext (decoded)	1–65,535 bytes
RSA-2048 direct encrypt plaintext	~190 bytes effective maximum
Automatic rotation period	1–3650 days
Pending deletion retention	30 days
Key metadata updates	Not supported after create

Troubleshooting

HTTP status	Typical cause	What to do
`403`	KMS feature not enabled for organisation	Contact your administrator to enable KMS
`404`	Region/key not found, wrong project scope, or insufficient IAM	Verify region, project header, and role bindings
`400`	Key disabled or pending deletion; wrong operation for key type; export not allowed; invalid payload size	Check key status and key types; validate request
`409`	Duplicate key slug in org/region/project scope	Choose a unique name or slug
`503`	KMS not available in the region	Use a different region or contact support about regional availability

Ciphertext format

KMS returns ciphertext as:

thalassa:v{version}:{payload}