# PaymentEncryptionKeyEntry

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

One key serial identifier entry on a `MerchantPaymentEncryptionBinding`: the map from a
terminal's key serial number to the HSM key that decrypts what the terminal sent.

## Fields
- `ksi` (string) required: The key serial identifier: six to ten significant hex characters, stored upper-case with leading  `F` padding stripped. Unique within a binding. Conditional: When Ksi is not empty. (nullable)
- `label` (string): An operator-facing label for this key, such as the device family it was injected into. Shown  wherever the key reference itself must not be. (nullable, max length 100)
- `scheme` ([PaymentEncryptionScheme](https://devportal.demo.winkpg.io/docs/api/models/PaymentEncryptionScheme.md)): Which encryption scheme the terminals under this key produce. Required: When Status != Deactivated. (nullable)
  Values:
  - `Dukpt`: Generic DUKPT (ANSI X9.24 data variant), TDES or AES.
  - `OnGuard`: The Ingenico On-Guard protocol.
- `dukptMode` ([PaymentEncryptionDukptMode](https://devportal.demo.winkpg.io/docs/api/models/PaymentEncryptionDukptMode.md)): The DUKPT key derivation algorithm this key uses. (nullable)
  Values:
  - `Tdes`: Triple DES DUKPT (ANSI X9.24 Part 1).
  - `Aes`: AES DUKPT (ANSI X9.24 Part 3). Carries a working-key type alongside it.
- `aesWorkingKeyType` (string): The AES working-key type, required when `dukptMode` is  `Aes` and meaningless otherwise. A provider token value  rather than an enum, because the vocabulary belongs to the vendor's command set. Required: When DukptMode == Aes. Conditional: When DukptMode is not null and DukptMode != Aes. (nullable, max length 16)
- `keyReference` (string): The HSM key reference: a storage-table slot or a wrapped key block. <b>Always stored encrypted,  and never returned on a read that leaves the server.</b> (nullable, max length 1024)
- `isKeyReferenceConfigured` (boolean): Whether a key reference is stored, set on reads so an operator can tell a configured key from an  empty one without the reference ever being sent. Server-owned: the save paths ignore whatever  arrives here. (nullable)
- `majorKey` (string): The major key the reference is stored under, in the provider's own token vocabulary. Null leaves  the provider's default in force. (nullable, max length 16)
- `onGuardExtendedEncryption` (boolean): On-Guard extended encryption, when the device family uses it. Meaningful only when  `scheme` is `OnGuard`. Conditional: When Scheme is not null and Scheme != OnGuard. (nullable)
- `onGuardEndingPanDigitsEncrypted` (boolean): Whether the device family encrypts the ending PAN digits. Meaningful only for  `OnGuard`. Conditional: When Scheme is not null and Scheme != OnGuard. (nullable)
- `onGuardClearPanDigits` (integer(int32)): How many leading PAN digits the device family leaves in the clear. Meaningful only for  `OnGuard`. Conditional: When Scheme is not null and Scheme != OnGuard. Conditional: When OnGuardClearPanDigits is not null. Range: 0 to 6. (nullable)
- `status` ([PaymentEncryptionKeyEntryStatus](https://devportal.demo.winkpg.io/docs/api/models/PaymentEncryptionKeyEntryStatus.md)): Whether the entry may be matched. Null reads as  `Deactivated`: an entry whose status nobody set has  not been through the boarding step that activates it, and matching it would use a key the  platform cannot confirm is live. (nullable)
  Values:
  - `Active`: The entry may be matched against an inbound key serial number.
  - `Deactivated`: The entry is retired. It stays readable for explaining past transactions, and is never matched.
- `requireMac` (boolean): Reserved: whether the device family attaches a MAC that should be verified during decryption. (nullable)
- `createdAtUtc` (string(date-time)): When the entry was created, in UTC. (nullable)
- `statusChangedAtUtc` (string(date-time)): When `status` last changed, in UTC. Separate from the audit log because it is shown  on the key table itself, where an operator decides whether a key is still in rotation. (nullable)

## See also

- [All documentation](https://devportal.demo.winkpg.io/llms.txt): the machine-readable index of every public page on this site.