Google: Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item kacls Key Metadata
Retrieves an existing client-side encryption key pair. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.: response body, field privateKeyMetadata / item / kaclsKeyMetadata. Complete fields and constraints for contract 2026-10-27.
API reference · Contract 2026-10-27
SDK schema: Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item kacls Key Metadata
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Metadata for a cryptographic key managed by an external key access control list service. For details about managing key access, see [Google Workspace CSE API Reference](https://developers.google.com/workspace/cse/reference). |
kaclsData | string | Optional | Opaque data generated and used by the key access control list service. |
kaclsUri | string | Optional | The URI of the key access control list service that manages the key. |