curl -X POST http://localhost:8092/api/kms/create-key \
  -H "Content-Type: application/json" \
  -d '{
    "alias": "signing-key-prod",
    "algorithm": "ML-DSA-65",
    "usage": "SIGN"
  }'
# Response: {"status":"success","result":{"keyId":"key-a1b2c3d4","alias":"signing-key-prod","algorithm":"ML-DSA-65","usage":"SIGN","status":"ACTIVE"}}

import requests

resp = requests.post("http://localhost:8092/api/kms/create-key", json={
    "alias": "signing-key-prod",
    "algorithm": "ML-DSA-65",
    "usage": "SIGN"
})
key = resp.json()["result"]
key_id = key["keyId"]  # Use this for all subsequent operations
print(f"Created key: {key_id}, algorithm: {key['algorithm']}")

HttpClient client = HttpClient.newHttpClient();
String body = """
    {"alias":"signing-key-prod","algorithm":"ML-DSA-65","usage":"SIGN"}""";
HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create("http://localhost:8092/api/kms/create-key"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(body))
    .build();
HttpResponse<String> resp = client.send(req, HttpResponse.BodyHandlers.ofString());
// Parse keyId from response for subsequent operations

payload := map[string]string{
    "alias":     "signing-key-prod",
    "algorithm": "ML-DSA-65",
    "usage":     "SIGN",
}
body, _ := json.Marshal(payload)
resp, _ := http.Post("http://localhost:8092/api/kms/create-key",
    "application/json", bytes.NewReader(body))
// Parse keyId from response

# Data must be base64-encoded
DATA=$(echo -n "document to sign" | base64)
curl -X POST http://localhost:8092/api/kms/sign \
  -H "Content-Type: application/json" \
  -d "{\"keyId\":\"key-a1b2c3d4\",\"data\":\"$DATA\"}"
# Response: {"status":"success","result":{"signature":"","keyId":"key-a1b2c3d4","algorithm":"ML-DSA-65"}}

import base64

data_b64 = base64.b64encode(b"document to sign").decode()
resp = requests.post("http://localhost:8092/api/kms/sign", json={
    "keyId": key_id,
    "data": data_b64
})
signature = resp.json()["result"]["signature"]

curl -X POST http://localhost:8092/api/kms/verify \
  -H "Content-Type: application/json" \
  -d '{
    "keyId": "key-a1b2c3d4",
    "data": "",
    "signature": ""
  }'
# Response: {"status":"success","result":{"valid":true,"keyId":"key-a1b2c3d4","algorithm":"ML-DSA-65"}}

resp = requests.post("http://localhost:8092/api/kms/verify", json={
    "keyId": key_id,
    "data": data_b64,
    "signature": signature
})
is_valid = resp.json()["result"]["valid"]
print(f"Signature valid: {is_valid}")

curl -X POST http://localhost:8092/api/kms/rotate-key \
  -H "Content-Type: application/json" \
  -d '{"keyId":"key-a1b2c3d4"}'
# Old key: ROTATED (verify only). New key: ACTIVE (sign + verify)
# Response: {"status":"success","newKey":{"keyId":"key-e5f6g7h8","alias":"signing-key-prod-rotated",...}}

resp = requests.post("http://localhost:8092/api/kms/rotate-key", json={
    "keyId": key_id
})
new_key = resp.json()["newKey"]
new_key_id = new_key["keyId"]
# Old key can still verify existing signatures
# New key is used for all new signing operations

curl -X DELETE http://localhost:8092/api/kms/key/key-a1b2c3d4
# Response: {"status":"success","keyId":"key-a1b2c3d4","newStatus":"DESTROYED"}
# Key cannot be used for any operations after destruction

import requests, base64

KMS = "http://localhost:8092/api/kms"

# 1. Create a signing key
key = requests.post(f"{KMS}/create-key", json={
    "alias": "invoice-signer",
    "algorithm": "ML-DSA-65",
    "usage": "SIGN"
}).json()["result"]
key_id = key["keyId"]
print(f"Created: {key_id} ({key['algorithm']})")

# 2. Sign a document
doc = base64.b64encode(b"Invoice #1234: $50,000").decode()
sig_resp = requests.post(f"{KMS}/sign", json={
    "keyId": key_id, "data": doc
}).json()["result"]
print(f"Signature: {sig_resp['signature'][:40]}...")

# 3. Verify the signature
verify = requests.post(f"{KMS}/verify", json={
    "keyId": key_id,
    "data": doc,
    "signature": sig_resp["signature"]
}).json()["result"]
print(f"Valid: {verify['valid']}")

# 4. Rotate the key
new_key = requests.post(f"{KMS}/rotate-key", json={
    "keyId": key_id
}).json()["newKey"]
print(f"Rotated. New key: {new_key['keyId']}")

# 5. Old key can still verify existing signatures
verify_old = requests.post(f"{KMS}/verify", json={
    "keyId": key_id,  # old key (ROTATED)
    "data": doc,
    "signature": sig_resp["signature"]
}).json()["result"]
print(f"Old key still verifies: {verify_old['valid']}")

# 6. Check audit trail
audit = requests.get(f"{KMS}/audit?keyId={key_id}").json()
for entry in audit["auditLog"]:
    print(f"  {entry['operation']}: {entry['details']}")

import java.net.http.*;
import java.net.URI;
import java.util.Base64;

var client = HttpClient.newHttpClient();
var KMS = "http://localhost:8092/api/kms";

// 1. Create key
var createReq = HttpRequest.newBuilder()
    .uri(URI.create(KMS + "/create-key"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(
        "{\"alias\":\"invoice-signer\",\"algorithm\":\"ML-DSA-65\",\"usage\":\"SIGN\"}"))
    .build();
var createResp = client.send(createReq, HttpResponse.BodyHandlers.ofString());
// Parse keyId from JSON response

// 2. Sign
var data = Base64.getEncoder().encodeToString("Invoice #1234".getBytes());
var signReq = HttpRequest.newBuilder()
    .uri(URI.create(KMS + "/sign"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(
        "{\"keyId\":\"" + keyId + "\",\"data\":\"" + data + "\"}"))
    .build();
var signResp = client.send(signReq, HttpResponse.BodyHandlers.ofString());

// 3. Verify, Rotate, Destroy follow the same pattern

#!/bin/bash
KMS="http://localhost:8092/api/kms"

# Create key
KEY_ID=$(curl -s -X POST $KMS/create-key \
  -H "Content-Type: application/json" \
  -d '{"alias":"test","algorithm":"ML-DSA-65","usage":"SIGN"}' \
  | jq -r '.result.keyId')
echo "Created: $KEY_ID"

# Sign
DATA=$(echo -n "test data" | base64)
SIG=$(curl -s -X POST $KMS/sign \
  -H "Content-Type: application/json" \
  -d "{\"keyId\":\"$KEY_ID\",\"data\":\"$DATA\"}" \
  | jq -r '.result.signature')
echo "Signature: ${SIG:0:40}..."

# Verify
VALID=$(curl -s -X POST $KMS/verify \
  -H "Content-Type: application/json" \
  -d "{\"keyId\":\"$KEY_ID\",\"data\":\"$DATA\",\"signature\":\"$SIG\"}" \
  | jq -r '.result.valid')
echo "Valid: $VALID"

# Audit
curl -s "$KMS/audit?keyId=$KEY_ID" | jq '.auditLog[]'