Method: projects.locations.instances.keyRings.keys.transactions.create

Creates a new Transaction for a Key. The server assigns the Transaction ID.

The request carries the initiator's authorization, which counts as the initiator's AUTHORIZE decision. The initiator is the User whose principal matches the caller's authenticated identity; that User must have the SIGNER role. If the authorizations received are enough to meet the Key's thresholds, the Transaction is signed and returned in state SIGNING_SUCCEEDED. Otherwise it is returned in state PENDING_AUTHORIZATION and other signers authorize it with transactions.recordSignerDecision.

HTTP request

POST https://mpc.googleapis.com/v1beta/{parent=projects/*/locations/*/instances/*/keyRings/*/keys/*}/transactions

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
parent

string

Required. The Key that signs the Transaction. Format: projects/{project}/locations/{location}/instances/{instance}/keyRings/{keyRing}/keys/{key} It takes the form projects/{project}/locations/{location}/instances/{instance}/keyRings/{keyring}/keys/{key}.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "transaction": {
    object (Transaction)
  },
  "authorizationInfo": {
    object (AuthorizationInfo)
  },
  "requestId": string
}
Fields
transaction

object (Transaction)

Required. The Transaction to create. Only signing_input, action, schema, payload, and metadata are read; output-only fields are ignored.
authorizationInfo

object (AuthorizationInfo)

Required. The initiator's authorization over a TransactionSigningPayload, signed with the authorization key of the User whose principal matches the caller, with:

  • key: set to parent
  • decision: AUTHORIZE
  • signing_input: set to transaction.signing_input

Recorded as the first entry in signerDecisions.
requestId

string

Optional. An idempotency key. Because Transaction IDs are server-generated, a client must set this to retry a create safely. If a request with the same requestId was already completed, the server returns the Transaction it created instead of creating another one.

Must be a UUID4 and not the zero UUID.

Response body

If successful, the response body contains a newly created instance of Transaction.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.