PgpKeysApi
extends ManagementSupport
in package
OpenPGP keys used for audit signing and encrypted data export.
The pgp_keys namespace handle (CONTRACT.md §27.2), reached as
$client->management()->pgpKeys(). Every method here goes through the one shared ManagementTransport, so §3 CSRF, the §4 cookie jar, the §5 tenant header, §6 TLS, §16 retry
and §19 telemetry apply without this class doing anything to opt in (§27.8).
Table of Contents
Methods
- __construct() : mixed
- encrypt() : EncryptedExport
- `POST /api/v1/pgp-keys/{id}/encrypt`
- forTenant() : static
- A COPY of this handle scoped to `$tenantId` (§27.4 rule 3). See {@see self::inOrg()} for why it copies.
- generate() : GeneratedPgpKey
- `POST /api/v1/pgp-keys`
- get() : PgpKey
- `GET /api/v1/pgp-keys/{id}`
- inOrg() : static
- A COPY of this handle scoped to `$orgId` (§27.4 rule 3).
- listItems() : Page<string|int, PgpKey>
- `GET /api/v1/pgp-keys`
- revoke() : void
- `POST /api/v1/pgp-keys/{id}/revoke`
- signAuditBatch() : SignedAuditBatch
- `POST /api/v1/pgp-keys/sign-audit-batch`
Methods
__construct()
public
__construct(ManagementTransport $transport[, NamespaceScope $scope = new NamespaceScope() ][, string|null $clientOrgId = null ][, string|null $clientTenantId = null ]) : mixed
Parameters
- $transport : ManagementTransport
-
The one wire path (§27.8).
- $scope : NamespaceScope = new NamespaceScope()
-
Per-handle
{org_id}/{tenant_id}overrides. - $clientOrgId : string|null = null
-
The client's own organization id, or
null. - $clientTenantId : string|null = null
-
The client's own tenant id, or
null.
encrypt()
`POST /api/v1/pgp-keys/{id}/encrypt`
public
encrypt(string $id, EncryptRequest $body) : EncryptedExport
POST /api/v1/pgp-keys/{id}/encrypt.
Parameters
- $id : string
-
the
{id}path parameter - $body : EncryptRequest
-
the request body
Return values
EncryptedExportforTenant()
A COPY of this handle scoped to `$tenantId` (§27.4 rule 3). See {@see self::inOrg()} for why it copies.
public
forTenant(string $tenantId) : static
Parameters
- $tenantId : string
Return values
staticgenerate()
`POST /api/v1/pgp-keys`
public
generate(CreatePgpKeyRequest $body) : GeneratedPgpKey
POST /api/v1/pgp-keys.
The response carries a ONE-TIME secret (private_key_armored): the server will not
return it again, so a caller that does not persist it here cannot recover it (§27.5).
Parameters
- $body : CreatePgpKeyRequest
-
the request body
Return values
GeneratedPgpKeyget()
`GET /api/v1/pgp-keys/{id}`
public
get(string $id) : PgpKey
GET /api/v1/pgp-keys/{id}.
Parameters
- $id : string
-
the
{id}path parameter
Return values
PgpKeyinOrg()
A COPY of this handle scoped to `$orgId` (§27.4 rule 3).
public
inOrg(string $orgId) : static
Returns a new handle rather than mutating this one. An administrator holding a handle to their own organization should not find it repointed at someone else's because an unrelated code path re-scoped a shared object — and on a management surface that failure mode writes to the wrong tenant rather than merely reading from it.
Parameters
- $orgId : string
Return values
staticlistItems()
`GET /api/v1/pgp-keys`
public
listItems([PageRequest|null $page = null ]) : Page<string|int, PgpKey>
GET /api/v1/pgp-keys.
Returns ONE page. Page::$total is the server's count across all pages and is not
count($page) — see §27.4 rule 4.
Parameters
- $page : PageRequest|null = null
-
which page to fetch; defaults to the first
Return values
Page<string|int, PgpKey>revoke()
`POST /api/v1/pgp-keys/{id}/revoke`
public
revoke(string $id) : void
POST /api/v1/pgp-keys/{id}/revoke.
Returns nothing; the server answers with an empty body.
Parameters
- $id : string
-
the
{id}path parameter
signAuditBatch()
`POST /api/v1/pgp-keys/sign-audit-batch`
public
signAuditBatch(SignAuditBatchRequest $body) : SignedAuditBatch
POST /api/v1/pgp-keys/sign-audit-batch.
Parameters
- $body : SignAuditBatchRequest
-
the request body