Multi-party Compute API

Multi-party Compute (MPC) API manages distributed cryptographic keys and signing operations.

Service: mpc.googleapis.com

Service endpoint

A service endpoint is a base URL that specifies the network address of an API service. One service might have multiple service endpoints.

The Multi-party Compute (MPC) API is split across two distinct layers: the instance management API and the data plane API. Most of the services and methods documented here operate on the data plane to manage keys, key rings, and signing proposals. Data plane endpoints are hosted directly by your dedicated MPC instance, so you must connect to your specific instance's API hostname to access them.

Data plane endpoints

The data plane API hostname resembles the following:

  • https://INSTANCE_MONIKER.LOCATION.mpc.goog

For example, the following hostname is for an instance moniker of my-instance in location us-central1:

Instance management endpoint

The instance management API manages the lifecycle of the instances themselves (such as creating or deleting instances) and is accessed via the shared multi-tenant endpoint:

REST Resource: v1beta.projects.locations.instances.keyLists

Methods
addEntries POST /v1beta/{name=projects/*/locations/*/instances/*/keyLists/*}:addEntries
Adds entries to a KeyList and returns the updated KeyList.
create POST /v1beta/{parent=projects/*/locations/*/instances/*}/keyLists
Creates a new KeyList in an instance.
delete DELETE /v1beta/{name=projects/*/locations/*/instances/*/keyLists/*}
Deletes a KeyList.
get GET /v1beta/{name=projects/*/locations/*/instances/*/keyLists/*}
Gets details of a single KeyList.
list GET /v1beta/{parent=projects/*/locations/*/instances/*}/keyLists
Lists KeyLists in an instance.
removeEntries POST /v1beta/{name=projects/*/locations/*/instances/*/keyLists/*}:removeEntries
Removes entries from a KeyList and returns the updated KeyList.

REST Resource: v1beta.projects.locations.instances.keyRings

Methods
create POST /v1beta/{parent=projects/*/locations/*/instances/*}/keyRings
Creates a new KeyRing in an instance.
delete DELETE /v1beta/{name=projects/*/locations/*/instances/*/keyRings/*}
Deletes a KeyRing and its KeyPolicy.
get GET /v1beta/{name=projects/*/locations/*/instances/*/keyRings/*}
Gets details of a single KeyRing.
list GET /v1beta/{parent=projects/*/locations/*/instances/*}/keyRings
Lists KeyRings in an instance.

REST Resource: v1beta.projects.locations.instances.keyRings.keys

Methods
create POST /v1beta/{parent=projects/*/locations/*/instances/*/keyRings/*}/keys
Creates a new Key in a KeyRing by running distributed key generation (DKG).
disable POST /v1beta/{name=projects/*/locations/*/instances/*/keyRings/*/keys/*}:disable
Disables a Key so it can no longer sign.
get GET /v1beta/{name=projects/*/locations/*/instances/*/keyRings/*/keys/*}
Gets details of a single Key.
list GET /v1beta/{parent=projects/*/locations/*/instances/*/keyRings/*}/keys
Lists Keys in a KeyRing.

REST Resource: v1beta.projects.locations.instances.keyRings.keys.transactions

Methods
create POST /v1beta/{parent=projects/*/locations/*/instances/*/keyRings/*/keys/*}/transactions
Creates a new Transaction for a Key.
get GET /v1beta/{name=projects/*/locations/*/instances/*/keyRings/*/keys/*/transactions/*}
Gets details of a single Transaction.
list GET /v1beta/{parent=projects/*/locations/*/instances/*/keyRings/*/keys/*}/transactions
Lists Transactions for a Key, or across Keys.
recordSignerDecision POST /v1beta/{name=projects/*/locations/*/instances/*/keyRings/*/keys/*/transactions/*}:recordSignerDecision
Records a signer's decision to authorize or deny a Transaction.

REST Resource: v1beta.projects.locations.instances.teams

Methods
create POST /v1beta/{parent=projects/*/locations/*/instances/*}/teams
Creates a new Team in an instance.
delete DELETE /v1beta/{name=projects/*/locations/*/instances/*/teams/*}
Deletes a Team.
get GET /v1beta/{name=projects/*/locations/*/instances/*/teams/*}
Gets details of a single Team.
list GET /v1beta/{parent=projects/*/locations/*/instances/*}/teams
Lists Teams in an instance.

REST Resource: v1beta.projects.locations.instances.transactionPolicies

Methods
approve POST /v1beta/{name=projects/*/locations/*/instances/*/transactionPolicies/*}:approve
Records a Policy Author's approval for a policy that is waiting to be activated or disabled.
create POST /v1beta/{parent=projects/*/locations/*/instances/*}/transactionPolicies
Proposes a new TransactionPolicy in an instance.
disable POST /v1beta/{name=projects/*/locations/*/instances/*/transactionPolicies/*}:disable
Starts disabling a policy, or withdraws a policy that is still waiting for activation.
get GET /v1beta/{name=projects/*/locations/*/instances/*/transactionPolicies/*}
Gets details of a single TransactionPolicy, including its Cedar rule, current lifecycle state, and recorded Policy Author approvals.
list GET /v1beta/{parent=projects/*/locations/*/instances/*}/transactionPolicies
Lists TransactionPolicy resources in an instance, including disabled policies.

REST Resource: v1beta.projects.locations.instances.users

Methods
approveRoleChange POST /v1beta/{name=projects/*/locations/*/instances/*/users/*}:approveRoleChange
Records an Admin's approval of the User's pending role change: the roles in PENDING_ACTIVE or PENDING_DISABLED in role_statuses.
create POST /v1beta/{parent=projects/*/locations/*/instances/*}/users
Creates a new User in an instance.
disable POST /v1beta/{name=projects/*/locations/*/instances/*/users/*}:disable
Disables a User and all of their roles at once.
disableRole POST /v1beta/{name=projects/*/locations/*/instances/*/users/*}:disableRole
Disables one role of a User.
enable POST /v1beta/{name=projects/*/locations/*/instances/*/users/*}:enable
Re-enables a disabled User: sets state back to ACTIVE.
enableRole POST /v1beta/{name=projects/*/locations/*/instances/*/users/*}:enableRole
Enables one role of a User: grants it, or re-enables it if it was disabled.
get GET /v1beta/{name=projects/*/locations/*/instances/*/users/*}
Gets details of a single User.
list GET /v1beta/{parent=projects/*/locations/*/instances/*}/users
Lists Users in an instance.
patch PATCH /v1beta/{user.name=projects/*/locations/*/instances/*/users/*}
Updates a User's display_name.
updateTeamAssignment POST /v1beta/{name=projects/*/locations/*/instances/*/users/*}:updateTeamAssignment
Moves a User to a different Team.

REST Resource: v1alpha1.projects.locations.instances.mpc.keyRings

Methods
create POST /v1alpha1/{parent=projects/*/locations/*/instances/*}/mpc/keyRings
Creates a new KeyRing in a given project and location.
delete DELETE /v1alpha1/{name=projects/*/locations/*/instances/*/mpc/keyRings/*}
Deletes a KeyRing.
get GET /v1alpha1/{name=projects/*/locations/*/instances/*/mpc/keyRings/*}
Gets details of a single KeyRing.
list GET /v1alpha1/{parent=projects/*/locations/*/instances/*}/mpc/keyRings
Lists KeyRings in a given project and location.

REST Resource: v1alpha1.projects.locations.instances.mpc.keyRings.keys

Methods
create POST /v1alpha1/{parent=projects/*/locations/*/instances/*/mpc/keyRings/*}/keys
Initiates a Distributed Key Generation (DKG) ceremony.
get GET /v1alpha1/{name=projects/*/locations/*/instances/*/mpc/keyRings/*/keys/*}
Gets details of a single Key.
list GET /v1alpha1/{parent=projects/*/locations/*/instances/*/mpc/keyRings/*}/keys
Lists Keys in a given KeyRing.
patch PATCH /v1alpha1/{key.name=projects/*/locations/*/instances/*/mpc/keyRings/*/keys/*}
Updates a Key.

REST Resource: v1alpha1.projects.locations.instances.mpc.keyRings.keys.proposals

Methods
create POST /v1alpha1/{parent=projects/*/locations/*/instances/*/mpc/keyRings/*/keys/*}/proposals
Initiates a Signing Proposal for a given Key.
fetchProposalSignature GET /v1alpha1/{name=projects/*/locations/*/instances/*/mpc/keyRings/*/keys/*/proposals/*}:fetchProposalSignature
Retrieves the final assembled signature for a completed Proposal.
get GET /v1alpha1/{name=projects/*/locations/*/instances/*/mpc/keyRings/*/keys/*/proposals/*}
Gets details of a single Proposal.
list GET /v1alpha1/{parent=projects/*/locations/*/instances/*/mpc/keyRings/*/keys/*}/proposals
Lists Proposals for a given Key.
recordParticipantDecision POST /v1alpha1/{name=projects/*/locations/*/instances/*/mpc/keyRings/*/keys/*/proposals/*}:recordParticipantDecision
Submits a cryptographic signature from a key participant, recording their assent (or rejection) for the proposal.

REST Resource: v1alpha1.projects.locations.instances.mpc.signers

Methods
create POST /v1alpha1/{parent=projects/*/locations/*/instances/*}/mpc/signers
Registers a new participant entity capable of holding key shares.
get GET /v1alpha1/{name=projects/*/locations/*/instances/*/mpc/signers/*}
Gets details of a single Participant.
list GET /v1alpha1/{parent=projects/*/locations/*/instances/*}/mpc/signers
Lists Participants in a given project and location.

REST Resource: v1alpha1.projects.locations.instances.policyEngine

Methods
authorizePayload POST /v1alpha1/{instance=projects/*/locations/*/instances/*}/policyEngine:authorizePayload
Authorizes an operation proposal payload against active policies.
getPolicyAuthorTrustBundle GET /v1alpha1/{name=projects/*/locations/*/instances/*/policyEngine/policyAuthorTrustBundle}
Gets details of the PolicyAuthorTrustBundle singleton.
updatePolicyAuthorTrustBundle PATCH /v1alpha1/{policyAuthorTrustBundle.name=projects/*/locations/*/instances/*/policyEngine/policyAuthorTrustBundle}
Updates the PolicyAuthorTrustBundle singleton.

REST Resource: v1alpha1.projects.locations.instances.policyEngine.policies

Methods
addQuorumSignature POST /v1alpha1/{name=projects/*/locations/*/instances/*/policyEngine/policies/*}:addQuorumSignature
Custom Method: Appends a software-backed author signature to a policy.
create POST /v1alpha1/{parent=projects/*/locations/*/instances/*}/policyEngine/policies
Creates a new policy in a given instance.
get GET /v1alpha1/{name=projects/*/locations/*/instances/*/policyEngine/policies/*}
Gets details of a single policy.
list GET /v1alpha1/{parent=projects/*/locations/*/instances/*}/policyEngine/policies
Lists policies in a given instance.
revoke POST /v1alpha1/{name=projects/*/locations/*/instances/*/policyEngine/policies/*}:revoke
Custom Method: Revokes (deletes) a policy.