// Code generated by software.amazon.smithy.rust.codegen.smithy-rs. DO NOT EDIT.
impl super::Client {
/// Constructs a fluent builder for the [`Encapsulate`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder) operation.
///
/// - The fluent builder is configurable:
/// - [`key_id(impl Into<String>)`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder::key_id) / [`set_key_id(Option<String>)`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder::set_key_id):<br>required: **true**<br><p>Identifies an asymmetric ML-KEM KMS key. KMS uses the public key in the specified key pair to encapsulate the shared secret. ML-KEM KMS keys have a <code>KeySpec</code> value of <code>ML_KEM_512</code>, <code>ML_KEM_768</code>, or <code>ML_KEM_1024</code> and a <code>KeyUsage</code> value of <code>ENCAPSULATE_DECAPSULATE</code>. To find the <code>KeySpec</code> and <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p> <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p> <p>For example:</p> <ul> <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li> <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li> <li> <p>Alias name: <code>alias/ExampleAlias</code></p></li> <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code></p></li> </ul> <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p><br>
/// - [`encapsulation_algorithm(EncapsulationAlgorithmSpec)`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder::encapsulation_algorithm) / [`set_encapsulation_algorithm(Option<EncapsulationAlgorithmSpec>)`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder::set_encapsulation_algorithm):<br>required: **true**<br><p>Specifies the key encapsulation algorithm used to generate the shared secret and its encapsulated form. The only valid value is <code>ML_KEM</code>.</p><br>
/// - [`grant_tokens(impl Into<String>)`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder::grant_tokens) / [`set_grant_tokens(Option<Vec::<String>>)`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder::set_grant_tokens):<br>required: **false**<br><p>A list of grant tokens.</p> <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p><br>
/// - [`dry_run(bool)`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder::dry_run) / [`set_dry_run(Option<bool>)`](crate::operation::encapsulate::builders::EncapsulateFluentBuilder::set_dry_run):<br>required: **false**<br><p>Checks if your request will succeed. <code>DryRun</code> is an optional parameter.</p> <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your permissions</a> in the <i>Key Management Service Developer Guide</i>.</p><br>
/// - On success, responds with [`EncapsulateOutput`](crate::operation::encapsulate::EncapsulateOutput) with field(s):
/// - [`key_id(Option<String>)`](crate::operation::encapsulate::EncapsulateOutput::key_id): <p>The identifier of the ML-KEM KMS key used to encapsulate the shared secret.</p>
/// - [`shared_secret(Option<Blob>)`](crate::operation::encapsulate::EncapsulateOutput::shared_secret): <p>The plaintext shared secret. It is a 32-byte cryptographically random value that both parties can use directly as key material or pass through a key derivation function to generate multiple keys and nonces. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.</p>
/// - [`shared_secret_ciphertext_blob(Option<Blob>)`](crate::operation::encapsulate::EncapsulateOutput::shared_secret_ciphertext_blob): <p>The encapsulated form of the shared secret. Pass this value to the <code>Decapsulate</code> operation to recover the shared secret. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded. The length of <code>SharedSecretCiphertextBlob</code> depends on the ML-KEM key spec. Before Base64 encoding, the encapsulated shared secret is 768 bytes for <code>ML_KEM_512</code>, 1088 bytes for <code>ML_KEM_768</code>, and 1568 bytes for <code>ML_KEM_1024</code>.</p>
/// - [`encapsulation_algorithm(Option<EncapsulationAlgorithmSpec>)`](crate::operation::encapsulate::EncapsulateOutput::encapsulation_algorithm): <p>The key encapsulation algorithm used to generate the shared secret.</p>
/// - On failure, responds with [`SdkError<EncapsulateError>`](crate::operation::encapsulate::EncapsulateError)
pub fn encapsulate(&self) -> crate::operation::encapsulate::builders::EncapsulateFluentBuilder {
crate::operation::encapsulate::builders::EncapsulateFluentBuilder::new(self.handle.clone())
}
}