> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# KMIP

> Let devices and software that support KMIP manage their keys.

The Key Management Interoperability Protocol (KMIP) is a standard protocol that storage arrays, databases, servers, and backup tools use to get their encryption keys from a key manager. With KMIP, these clients can create and fetch keys in Infisical KMS.

> [!NOTE]
>
> KMIP is available under Infisical's [Enterprise](https://infisical.com/pricing) plan. If you're self-hosting Infisical, contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise license.

> [accordion] How it works
>
> KMIP clients don't connect to Infisical directly. They connect to a KMIP server that you run on your own network with the Infisical CLI, and the KMIP server passes each request on to Infisical:
>
> ```mermaid theme={"dark"}
> flowchart LR
>   subgraph network["Your network"]
>     client["KMIP client"]
>     server["KMIP server"]
>   end
>   client -- "KMIP request, port 5696" --> server
>   server -- "HTTPS, port 443" --> infisical["Infisical KMS"]
>   style network fill:#ffffde,stroke:#aaaa33,color:#000
>   style client fill:#ececff,stroke:#9370db,color:#000
>   style server fill:#e1f5fe,stroke:#01579b,color:#000
>   style infisical fill:#ffffff,stroke:#757575,color:#000
> ```
>
> 1. A KMIP client connects to the KMIP server on port 5696, and authenticates with a client certificate that Infisical issued
> 2. The KMIP server sends the request to Infisical over HTTPS
> 3. Infisical runs the request against the keys in the client's KMS project
>
> You create a KMIP server once for your organization, and any KMS project can use it. You register each client in the KMS project whose keys the client uses.
>
> Unlike the Infisical API, KMIP gives the client the key material, and the client encrypts data itself. This means you shouldn't [rotate](https://infisical.com/docs/documentation/platform/kms/key-rotation.md) a key that a KMIP client uses.

## Set up KMIP

> [card] [Deploy a KMIP server](https://infisical.com/docs/documentation/platform/kms/kmip-server.md)
>
> Run the KMIP server that your KMIP clients connect to.

> [card] [Connect KMIP clients](https://infisical.com/docs/documentation/platform/kms/kmip-clients.md)
>
> Connect a KMIP client to the keys in a KMS project.

To set up a specific client, see [Dell PowerEdge SEKM](https://infisical.com/docs/documentation/platform/kms/kmip-dell-poweredge.md).

## Supported KMIP versions and operations

The KMIP server supports KMIP versions 1.0 to 1.4, and the following operations on symmetric keys:

| Operation | What it does |
| - | - |
| Create | Creates a symmetric key |
| Register | Adds a key that was created outside Infisical |
| Locate | Finds keys by their attributes |
| Get | Returns a key |
| Activate | Makes a key available for use |
| Revoke | Revokes a key |
| Destroy | Deletes a key |
| Get Attributes | Returns a key's attributes |
| Query | Returns the operations and objects that the server supports |

When you register a client, you choose which of these operations the client can run.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.