Package co.ankatech.ankasecure.sdk.model

Class KeyMetadata

java.lang.Object
co.ankatech.ankasecure.sdk.model.KeyMetadata
public final class KeyMetadata extends Object
Metadata for a cryptographic key in the ANKASecure platform.

This class provides a complete view of a key's identity, configuration, lifecycle, and usage statistics. It is returned by the read-only key query operations (listKeys / getKeyMetadata).

Key Type Detection:

  • Simple key: kty is "ML-KEM", "ML-DSA", "RSA", "EC", "oct", etc.
  • Composite KEM: kty is "COMPOSITE_KEM_COMBINE"
  • Composite Signature: kty is "COMPOSITE_SIGNATURE"

Usage Examples

Check Key Type


 KeyMetadata metadata = sdk.getKeyMetadata(kid);

 if (metadata.isComposite()) {
     System.out.println("Composite key: " + metadata.getKty());
     if (metadata.isCompositeKem()) {
         System.out.println("KDF used: " + metadata.getKdf());
     }
 } else {
     System.out.println("Simple key: " + metadata.getKty());
 }

Check Lifecycle Status


 System.out.println("Status: " + metadata.getStatus());
 System.out.println("Created: " + metadata.getCreatedAt());
 System.out.println("Expires: " + metadata.getExpiresAt());
 System.out.println("Usage: " + metadata.getUsageCount() + " / " + metadata.getMaxUsageLimit());

Lifecycle States

The getStatus() field indicates the current lifecycle state:

  • ACTIVE: Key is operational and can be used for cryptographic operations
  • ROTATED: Key material superseded by a newer version under the same kid
  • EXPIRED: Key past getExpiresAt() timestamp, cannot be used
  • REVOKED: Key manually revoked, permanently disabled
  • DISABLED: Key temporarily disabled by administrator
  • USAGE_EXCEEDED: Key reached getMaxUsageLimit(), cannot be used

Thread Safety

Instances are immutable value objects safe to share across threads.

Since:
3.0.0
See Also:

  • Constructor Details

  • Method Details

    • getKid

      public String getKid()
      Returns the unique key identifier.
      Returns:
      key identifier (never null)

    • getKty

      public String getKty()
      Returns the key type.

      Examples: "ML-KEM", "ML-DSA", "RSA", "EC", "oct", "COMPOSITE_KEM_COMBINE", "COMPOSITE_SIGNATURE"

      Returns:
      key type (never null)

    • getAlg

      public String getAlg()
      Returns the algorithm identifier.

      For simple keys: Single algorithm (e.g., "ML-KEM-768", "RSA-4096")
      For composite keys: Combined algorithms (e.g., "X25519+ML-KEM-768", "Ed25519+ML-DSA-44")

      Returns:
      algorithm identifier (never null)

    • getKdf

      public String getKdf()
      Returns the key derivation function for composite KEM keys.

      Only present for kty="COMPOSITE_KEM_COMBINE". Common values: "HKDF-SHA256", "HKDF-SHA512"

      Returns:
      KDF identifier, or null if not a composite KEM key

    • getKeyOps

      public List<String> getKeyOps()
      Returns the permitted key operations.

      Common values: "encrypt", "decrypt", "sign", "verify", "wrapKey", "unwrapKey"

      Returns:
      unmodifiable list of operations (never null, may be empty)

    • getExportable

      public Boolean getExportable()
      Returns whether the key can be exported.
      Returns:
      true if exportable, false otherwise, or null if unspecified

    • getOrigin

      public KeyOrigin getOrigin()
      Returns the key origin.
      Returns:
      key origin (GENERATED, IMPORTED, DERIVED), or null if unspecified

    • getRestricted

      public Boolean getRestricted()
      Returns whether the key is restricted (legacy format).
      Returns:
      true if restricted, false otherwise, or null if unspecified

    • getStatus

      public String getStatus()
      Returns the current lifecycle status.

      Common values: "active", "rotated", "expired", "revoked", "disabled", "usage_exceeded"

      Returns:
      status string (never null)

    • getCreatedAt

      public ZonedDateTime getCreatedAt()
      Returns the key creation timestamp.
      Returns:
      creation timestamp (never null)

    • getExpiresAt

      public ZonedDateTime getExpiresAt()
      Returns the hard expiration timestamp.
      Returns:
      expiration timestamp, or null if no expiration set

    • getSoftLimitExpiration

      public ZonedDateTime getSoftLimitExpiration()
      Returns the soft expiration (warning threshold) timestamp.
      Returns:
      soft limit timestamp, or null if no soft limit set

    • getUsageCount

      public Integer getUsageCount()
      Returns the current usage counter.
      Returns:
      usage count (never null, defaults to 0)

    • getSoftUsageLimit

      public Integer getSoftUsageLimit()
      Returns the soft usage limit (warning threshold).
      Returns:
      soft usage limit, or null if no soft limit set

    • getMaxUsageLimit

      public Integer getMaxUsageLimit()
      Returns the hard usage limit.
      Returns:
      maximum usage limit, or null if no limit set

    • isComposite

      public boolean isComposite()
      Checks if this is a composite key.
      Returns:
      true if kty starts with "COMPOSITE_"

    • isCompositeKem

      public boolean isCompositeKem()
      Checks if this is a composite KEM key.
      Returns:
      true if kty is "COMPOSITE_KEM_COMBINE"

    • isCompositeSignature

      public boolean isCompositeSignature()
      Checks if this is a composite signature key.
      Returns:
      true if kty is "COMPOSITE_SIGNATURE"