方法：包裝
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
傳回已加密的資料加密金鑰 (DEK) 和相關資料。
詳情請參閱加密與解密資料。
HTTP 要求
POST https://KACLS_URL/wrap
將 KACLS_URL 替換為金鑰存取控制清單
服務 (KACLS)
網址。
路徑參數
無。
要求主體
要求主體的資料會採用以下結構：
| JSON 表示法 |
{
"authentication": string,
"authorization": string,
"key": string,
"reason": string
}
|
| 欄位 |
authentication |
string
由 IdP 核發的使用者核發的 JWT。請參閱驗證權杖。
|
authorization |
string
JWT 宣告允許使用者包裝 resource_name 的金鑰。查看授權權杖。
|
key |
string
Base64 編碼的 DEK。大小上限：128 個位元組。
|
reason |
string (UTF-8)
直通式 JSON 字串，提供作業的其他背景資訊。提供的 JSON 必須先經過處理，才會顯示。大小上限：1 KB。
|
回應主體
如果成功的話，這個方法會傳回不透明的二進位物件。這個物件即將儲存
透過加密物件的方式傳送，並在後續
金鑰解除包裝作業。
如果作業失敗，
結構化錯誤回覆
。
二進位物件應包含加密 DEK 的唯一副本。
可以儲存實作專屬資料。
請勿將 DEK 儲存在金鑰存取控制清單服務 (KACLS) 系統中
而是將其加密，然後傳回包裝在 wrap_key 物件中。這麼做可以避免
文件及其金鑰之間的生命週期差異。舉例來說
使用者要求時，他們的資料會遭到徹底清除，或確保
從備份還原的先前版本可以解密。
| JSON 表示法 |
{
"wrapped_key": string
}
|
| 欄位 |
wrapped_key |
string
Base64 編碼的二進位物件。大小上限：1 KB。
|
範例
這個範例提供了 wrap 方法的要求和回應範例。
要求
POST https://mykacls.example.com/v1/wrap
{
"key":"wHrlNOTI9mU6PBdqiq7EQA==",
"authorization": "eyJhbGciOi…"
"authentication": "eyJhbGciOi…"
"reason": "{client:'drive' op:'update'}"
}
回應
{
"wrapped_key": "3qTh6Mp+svPwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg=="
}
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-25 (世界標準時間)。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[[["\u003cp\u003eReturns an encrypted Data Encryption Key (DEK) along with associated data for secure storage and later retrieval.\u003c/p\u003e\n"],["\u003cp\u003eThe request body requires authentication, authorization, the base64-encoded DEK, and an optional reason for the operation.\u003c/p\u003e\n"],["\u003cp\u003eThe response provides a wrapped key containing the encrypted DEK, which should be stored securely by the application.\u003c/p\u003e\n"],["\u003cp\u003eThe KACLS system itself does not store the DEK, ensuring data security and preventing lifetime discrepancies.\u003c/p\u003e\n"],["\u003cp\u003eRefer to the provided links for detailed information on encrypting and decrypting data, authentication tokens, and authorization tokens.\u003c/p\u003e\n"]]],["The `wrap` method encrypts a Data Encryption Key (DEK) and returns it as a base64-encoded binary object (`wrapped_key`). The request includes authentication and authorization JWTs, the base64-encoded DEK (`key`), and a JSON string (`reason`) for context. The response contains only the `wrapped_key`. The service should not store the DEK; the returned object is the only copy of the encrypted DEK. Deletion requests for the objects are not sent to the KACLS.\n"],null,["# Method: wrap\n\nReturns encrypted Data Encryption Key (DEK) and associated data.\n\nFor more details, see [Encrypt \\& decrypt data](/workspace/cse/guides/encrypt-and-decrypt-data).\n\n### HTTP request\n\n`POST https://`\u003cvar translate=\"no\"\u003eKACLS_URL\u003c/var\u003e`/wrap`\n\nReplace \u003cvar translate=\"no\"\u003eKACLS_URL\u003c/var\u003e with the Key Access Control List\nService (KACLS)\nURL.\n\n### Path parameters\n\nNone.\n\n### Request body\n\nThe request body contains data with the following structure:\n\n| JSON representation ||\n|------------------------------------------------------------------------------------------------|---|\n| ``` { \"authentication\": string, \"authorization\": string, \"key\": string, \"reason\": string } ``` |\n\n| Fields ||\n|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `authentication` | `string` A JWT issued by the IdP asserting who the user is. See [authentication tokens](/workspace/cse/reference/authentication-tokens). |\n| `authorization` | `string` A JWT asserting that the user is allowed to wrap a key for `resource_name`. See [authorization tokens](/workspace/cse/reference/authorization-tokens). |\n| `key` | `string` The base64-encoded DEK. Max size: 128 bytes. |\n| `reason` | `string (UTF-8)` A passthrough JSON string providing additional context about the operation. The JSON provided should be sanitized before being displayed. Max size: 1 KB. |\n\n### Response body\n\nIf successful, this method returns an opaque binary object that will be stored\nby Google Workspace along the encrypted object and sent as-is in any subsequent\nkey unwrapping operation.\n\nIf the operation fails, a\n[structured error reply](/workspace/cse/reference/structured-errors)\nshould be returned.\n\nThe binary object should contain the only copy of the encrypted DEK,\nimplementation specific data can be stored in it.\n\nDon't store the DEK in the Key Access Control List Service (KACLS) system,\ninstead encrypt it and return it in the wrapped_key object. This prevents\nlifetime discrepancies between the document and its keys. For example, to ensure\nthat the user's data is fully wiped out when they request it, or to make sure\nthat previous versions restored from a backup are decryptable.\n| **Note:** Google doesn't send deletion requests to the KACLS when objects are deleted.\n\n| JSON representation ||\n|-----------------------------------|---|\n| ``` { \"wrapped_key\": string } ``` |\n\n| Fields ||\n|---------------|------------------------------------------------------------|\n| `wrapped_key` | `string` The base64-encoded binary object. Max size: 1 KB. |\n\n### Example\n\nThis example provides a sample request and response for the `wrap` method.\n\n#### Request\n\n POST https://mykacls.example.com/v1/wrap\n\n {\n \"key\":\"wHrlNOTI9mU6PBdqiq7EQA==\",\n \"authorization\": \"eyJhbGciOi...\"\n \"authentication\": \"eyJhbGciOi...\"\n \"reason\": \"{client:'drive' op:'update'}\"\n }\n\n#### Response\n\n {\n \"wrapped_key\": \"3qTh6Mp+svPwYPlnZMyuj8WHTrM59wl/UI50jo61Qt/QubZ9tfsUc1sD62xdg3zgxC9quV4r+y7AkbfIDhbmxGqP64pWbZgFzOkP0JcSn+1xm/CB2E5IknKsAbwbYREGpiHM3nzZu+eLnvlfbzvTnJuJwBpLoPYQcnPvcgm+5gU1j1BjUaNKS/uDn7VbVm7hjbKA3wkniORC2TU2MiHElutnfrEVZ8wQfrCEpuWkOXs98H8QxUK4pBM2ea1xxGj7vREAZZg1x/Ci/E77gHxymnZ/ekhUIih6Pwu75jf+dvKcMnpmdLpwAVlE1G4dNginhFVyV/199llf9jmHasQQuaMFzQ9UMWGjA1Hg2KsaD9e3EL74A5fLkKc2EEmBD5v/aP+1RRZ3ISbTOXvxqYIFCdSFSCfPbUhkc9I2nHS0obEH7Q7KiuagoDqV0cTNXWfCGJ1DtIlGQ9IA6mPDAjX8Lg==\"\n }"]]
