decrypt operation needs POST instead of GET. Check the samples form KMS doc below. Decrypt Encrypted Key REQUEST: POST http://HOST:PORT/kms/v1/keyversion/<version-name>/_eek?ee_op=decrypt Content-Type: application/json { "name" : "<key-name>", "iv" : "<iv>", //base64 "material" : "<material>", //base64 } RESPONSE: 200 OK Content-Type: application/json { "name" : "EK", "material" : "<material>", //base64 } ... View more

Hello @mravipati, In order to decrypt an EEK, first you'll need to generate one. Here's what is working for me: 1. Generate EEK # curl --negotiate -u : -iv -X GET "http://<kms-host-fqdn>:9292/kms/v1/key/hr1-ez-key/_eek?eek_op=generate&num_keys=1" 2. Store the EEK data into a json: # cat eek.json { "name" : "hr1-ez-key", "iv" : "38Eb8nTxxxxxUG7Rc6_wrA", "material" : "K8Q0bv8Hxxxxxxn9ByVnT-xxx-Bmwxxxxxy1buCk" } 3. Call decrypt EEK while passing above EEK data: # curl --negotiate -u : -iv -X POST -H "Content-Type: application/json" -d @./eek.json "http://<kms-host-fqdn>:9292/kms/v1/keyversion/hr1-ez-key@0/_eek?eek_op=decrypt" Please note the change in REST URL and keyname while making decrypt request. The error you are getting is because you are trying to do a GET request on a URL which is expecting a POST request. Hope this helps! ... View more