바이너리 객체는 암호화된 DEK의 유일한 사본을 포함해야 하며 구현별 데이터를 저장할 수 있습니다.
키 액세스 제어 목록 서비스 (KACLS) 시스템에 DEK를 저장하지 말고 대신 암호화하여 wrapped_key 객체로 반환합니다. 이렇게 하면 문서와 키 간에 전체 기간 불일치가 방지됩니다. 예를 들어 사용자가 요청할 때 사용자의 데이터가 완전히 삭제되도록 하거나 백업에서 복원된 이전 버전을 복호화할 수 있도록 하는 경우입니다.
[null,null,["최종 업데이트: 2025-08-01(UTC)"],[[["\u003cp\u003eThe \u003ccode\u003eprivilegedwrap\u003c/code\u003e method encrypts a Data Encryption Key (DEK) for bulk data imports into Google Drive by domain administrators.\u003c/p\u003e\n"],["\u003cp\u003eIt requires a request body containing the DEK, resource name, authentication token, and an optional reason and perimeter ID.\u003c/p\u003e\n"],["\u003cp\u003eA successful response returns a wrapped key, an opaque binary object containing the encrypted DEK, to be stored with the encrypted object.\u003c/p\u003e\n"],["\u003cp\u003eThis wrapped key is essential for subsequent key unwrapping operations and should be the sole copy of the encrypted DEK.\u003c/p\u003e\n"],["\u003cp\u003eThis method helps ensure data security and lifecycle management by avoiding dependencies on the Key Access Control List Service (KACLS) for DEK storage.\u003c/p\u003e\n"]]],["The `privilegedwrap` method encrypts data for bulk import to Google Drive. It requires a base64-encoded Data Encryption Key (DEK), user authentication (JWT), resource identifier, optional perimeter ID, and operation context. Upon success, it returns a base64-encoded binary `wrapped_key` object containing the encrypted DEK, which Google Workspace stores. The DEK should not be directly stored in the Key Access Control List Service (KACLS) and should only be stored encrypted in the `wrapped_key` object.\n"],null,["# Method: privilegedwrap\n\nReturns a wrapped Data Encryption Key (DEK) and associated data. Use this\nmethod to encrypt data imported to Google Drive in bulk by a domain\nadministrator.\n\nFor more details, see [Encrypt \\& decrypt data](/workspace/cse/guides/encrypt-and-decrypt-data).\n\n### HTTP request\n\n`POST https://`\u003cvar translate=\"no\"\u003eKACLS_URL\u003c/var\u003e`/privilegedwrap`\n\nReplace \u003cvar translate=\"no\"\u003eKACLS_URL\u003c/var\u003e with the Key Access Control List\nService (KACLS) URL.\n\n### Path parameters\n\nNone.\n\n### Request body\n\nThe request body contains data with the following structure:\n\n| JSON representation ||\n|------------------------------------------------------------------------------------------------------------------------|---|\n| ``` { \"authentication\": string, \"key\": string, \"perimeter_id\": string, \"reason\": string, \"resource_name\": string } ``` |\n\n| Fields ||\n|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `authentication` | `string` A JWT issued by the identity provider (IdP) asserting who the user is. See [authentication tokens](/workspace/cse/reference/authentication-tokens). |\n| `key` | `string` The base64-encoded DEK. Max size: 128 bytes. |\n| `perimeter_id` | `string (UTF-8)` An optional value tied to the document location that can be used to choose which perimeter is checked when unwrapping. |\n| `reason` | `string (UTF-8)` A passthrough JSON string providing additional context about the operation. The JSON provided should be sanitized before being displayed. Max size: 1 KB. |\n| `resource_name` | `string (UTF-8)` An identifier for the object encrypted by the DEK. |\n\n### Response body\n\nIf successful, this method returns an opaque binary object that is stored\nby Google Workspace along the encrypted object and sent as-is in any subsequent\nkey unwrapping operation.\n\nIf the operation fails, a\n[structured error reply](/workspace/cse/reference/structured-errors)\nis returned.\n\nThe binary object should contain the only copy of the encrypted DEK,\nimplementation specific data can be stored in it.\n\nDon't store the DEK in the Key Access Control List Service (KACLS) system,\ninstead encrypt it and return it in the `wrapped_key` object. This prevents\nlifetime discrepancies between the document and its keys. For example,\nto ensure that the user's data is fully wiped out when they request it,\nor to make sure that previous versions restored from a backup are decryptable.\n| **Note:** Google doesn't send deletion requests to the KACLS when objects are deleted.\n\n| JSON representation ||\n|-----------------------------------|---|\n| ``` { \"wrapped_key\": string } ``` |\n\n| Fields ||\n|---------------|------------------------------------------------------------|\n| `wrapped_key` | `string` The base64-encoded binary object. Max size: 1 KB. |\n\n### Example\n\nThis example provides a sample request and response for the `privilegedwrap`\nmethod.\n\n#### Request\n\n POST https://mykacls.example.com/v1/privilegedwrap\n\n {\n \"key\":\"wHrlNOTI9mU6PBdqiq7EQA==\",\n \"resource_name\": \"wdwqd...\",\n \"authentication\": \"eyJhbGciOi...\",\n \"reason\": \"admin import\"\n }\n\n#### Response\n\n {\n \"wrapped_key\": \"3qTh6Mp+svPwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==\"\n }"]]
