Skip to content
Gauge

ax-check.com

by Gauge

Fortanix

support.fortanix.com

ax-check.com

Checked 5 October 2026

A

100/100

Agents need your login

Docs and quickstart are solid; pricing is nowhere to be found

Homepage, llms.txt, quickstart, CLI and API docs all resolve cleanly. No pricing page exists — all three sessions had to infer enterprise/quote-based pricing instead of reading it.

1 fix to start with

Concrete changes, backed by what we found.

Onboarding

Give agents a clear login handoff and a way to resume setup.

Agents cannot progress through onboarding without human help. Provide an agent-accessible path through authentication and setup.

Recorded coding sessions

Same task, 3 models, no support.fortanix.com account. Recorded 5 October 2026 on Pi.

3 recorded · 1m 44s

1m 44s · recorded

Session findings

Select a finding to see it in context.

piv0.84.2
modelQwen 3.8 Maxcwd/sandbox/repo
Help me build a simple example using Fortanix. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop.
Thinking…

The user is asking about "Fortanix" — probably Fortanix, the confidential computing / DSM (Data Security Manager) / SDKMS vendor. They want a simple example using Fortanix's SDK or API, pricing information, and an assessment of manageability. Let me check the repo and environment, and see whether there's network access.

Important: I don't have credentials. Fortanix's SDKMS (Data Security Manager) requires an account on the hosted SaaS version. I don't have an API key. The pricing is undisclosed / enterprise-only ("contact us"). Without credentials, I probably can't actually run against a hosted product. Let me check the environment first.

Also, note that the user said "if this product doesn't have a developer workflow that I can execute, state that frankly and stop." Fortanix DSM does have a developer workflow (REST API, SDK). But it requires an account and an API key. Let me check whether any credentials exist in the environment.

ls -la /sandbox/repo 2>/dev/null && echo "---" && env | grep -iE "fortanix|sdkms|api_key|token" | sed 's/=.*/=<set>/' && echo "---" && python3 --version; node --version; pip --version 2>/dev/null
total 16
total 16
drwxr-xr-x 3 root root 4096 Sep 18 08:00 .
drwxr-xr-x 7 root root 4096 Oct  5 13:58 ..
drwxr-xr-x 8 root root 4096 Sep 24 20:05 .git
-rw-r--r-- 1 root root  408 Sep 18 08:00 .gitignore
---
PI_GATEWAY_API_KEY=<set>
---
Python 3.12.3
v22.23.2
pip 26.2.1 from /opt/freestyle/python/lib/python3.12/site-packages/pip (python 3.12)

curl -sS -m 10 -o /dev/null -w "%{http_code}\n" https://sdkms.fortanix.com 2>&1; curl -sS -m 10 -o /dev/null -w "%{http_code}\n" https://www.fortanix.com 2>&1
curl: (6) Could not resolve host: sdkms.fortanix.com
curl: (6) Could not resolve host: sdkms.fortanix.com
000
200
Thinking…

The network is partially working (www.fortanix.com resolved to 200). sdkms.fortanix.com doesn't resolve — probably DNS is restricted, or that hostname is no longer valid. Fortanix DSM SaaS endpoints used to be in a format like sdkms.fortanix.com (formerly sdkms.fortanix.com → now probably "amer.smartkey.io" / sdkms.fortanix.com). Let me check DNS and try some known endpoints: smartkey.io, sdkms.fortanix.com, us-sdkms.fortanix.com, eu-sdkms.fortanix.com, asia-sdkms.fortanix.com. Also check pip install availability (whether network to pypi is reachable).

Network is partially available. Let me probe Fortanix's hosted endpoints and package availability.

for h in smartkey.io sdkms.fortanix.com us.smartkey.io eu.smartkey.io asia.smartkey.io api.fortanix.com www.fortanix.com; do printf "%-24s " "$h"; curl -sS -m 8 -o /dev/null -w "%{http_code}\n" https://$h 2>&1 | tail -1; done
smartkey.io 502
smartkey.io              502
sdkms.fortanix.com       000
us.smartkey.io           000
eu.smartkey.io           502
asia.smartkey.io         000
api.fortanix.com         000
www.fortanix.com         200

pip index versions fortanix-sdkms 2>&1 | head -3; pip download --no-deps -d /tmp/fx fortanix-sdkms 2>&1 | tail -3
ERROR: No matching distribution found for fortanix-sdkms
ERROR: No matching distribution found for fortanix-sdkms
ERROR: Could not find a version that satisfies the requirement fortanix-sdkms (from versions: none)
ERROR: No matching distribution found for fortanix-sdkms
Thinking…

PyPI is unreachable (pip fails entirely? Let me check whether PyPI itself is even reachable). The smartkey.io endpoints return 502 / DNS failure — there's no working path to the actual API endpoints, and no Fortanix credentials either (only PI_GATEWAY_API_KEY, which belongs to the agent harness).

Fortanix DSM / Runtime Encryption requires an enterprise account and an API key. Pricing is non-public (quote-based, "Contact Us"). Self-service trial: is there a "Fortanix Data Security Manager" free trial? Historically SDKMS offered self-service trials, but the pricing has not been publicly disclosed.

Let me quickly check reachability to PyPI and try the sdkms python package name. The actual package is probably fortanix-sdkms… I think the Python SDK was fortanix-sdkms, or alternatively the approach is to use REST directly. There's also the fortanix package. But since network to pypi fails, I can't install anything anyway.

Let me verify that PyPI is completely unreachable, and check the trial/pricing pages on www.fortanix.com (since it resolves). Then I'll respond as follows: I'm blocked because there are no credentials + the API endpoint is unreachable. Can I still provide a simple sample code file (local, can't be executed) — is that worthwhile? The user asked me to build a simple sample using the hosted product via SDK/API. I can't execute without credentials. Should I still write the sample? The instructions say "let me know if you get blocked." I think the best approach is this: honestly state that I'm blocked on execution (no API credentials, SDKMS endpoints unreachable from the sandbox), provide pricing info (non-public, quote-based), give an evaluation of manageability, and optionally write a small sample script so it can be run once an API key is obtained. This seems in line with the spirit of "stay lightweight." The user said "if this product has no developer workflow that I can execute, say so frankly and stop." The developer workflow itself exists (REST API + SDK), but I can't execute it — no credentials, endpoints blocked. I should say so frankly. I'll write one small sample file. I was asked to "build a simple sample," so… but if I can't execute it, is it still useful? The gist: they want a lightweight usage example. I'll provide a single small, ready-to-run script that works against Fortanix DSM (smartkey.io) using an API key, clearly indicate that I couldn't run it here, and stop there.

Let me quickly verify connectivity to pypi, and fetch the pricing page for accuracy.

curl -sS -m 8 -o /dev/null -w "pypi:%{http_code}\n" https://pypi.org/simple/fortanix/ 2>&1 | tail -1; curl -sS -m 8 -o /dev/null -w "npm:%{http_code}\n" https://registry.npmjs.org 2>&1 | tail -1
pypi:404
pypi:404
npm:200

curl -sSL -m 15 https://www.fortanix.com/products/data-security-manager 2>/dev/null | grep -ioE "(pricing|free trial|contact (us|sales)|\\$[0-9]+)" | sort -u | head; echo ---; curl -sSL -m 15 https://www.fortanix.com/pricing 2>/dev/null -o /dev/null -w "%{http_code} %{url_effective}\n"
-9
-9
Contact Us
---
404 https://www.fortanix.com/pricing
Thinking…

PyPI is reachable (a 404 means the package "fortanix" doesn't exist. The connection itself is working). Is the actual Python SDK's package name fortanix-sdkms? Let me check. The official Python SDK for Fortanix SDKMS is... I recall that the repo's fortanix/sdkms-python didn't exist on PyPI. There's also fortanix-sdkms? Let me try pip index versions with a few candidate names.

npm is also reachable. Is there a JS SDK? What's the official one? I don't think there's a publicly available official npm package. REST API is the primary approach.

Let me quickly test a few package names.

for p in fortanix-sdkms sdkms fortanix-dsm pyfortanix fortanix; do printf "%-16s " "$p"; curl -sS -m 8 -o /dev/null -w "%{http_code}\n" https://pypi.org/simple/$p/ | tail -1; done
fortanix-sdkms 404
fortanix-sdkms   404
sdkms            200
fortanix-dsm     404
pyfortanix       404
fortanix         404

curl -sS -m 8 "https://registry.npmjs.org/-/v1/search?text=fortanix&size=5" | python3 -c "import json,sys; [print(o['package']['name'],'-',o['package']['description'][:60]) for o in json.load(sys.stdin)['objects']]" 2>&1
@fortanix/baklava - Fortanix Baklava design system
@fortanix/baklava - Fortanix Baklava design system
@cdktf-providers/fortanix-dsm - Prebuilt fortanix/dsm Provider for Terraform CDK (cdktf)
@cyphera/kmip - KMIP client for Node.js — connect to any KMIP-compliant key 
@rustbin/rust-analysis-beta-x86_64-fortanix-unknown-sgx - Rust beta for rust-analysis-beta-x86_64-fortanix-unknown-sgx
@rustbin/rust-std-beta-x86_64-fortanix-unknown-sgx - Rust beta for rust-std-beta-x86_64-fortanix-unknown-sgx
Thinking…

The PyPI sdkms package exists (200). Let's check what it is — probably the official Fortanix SDKMS Python client. Quick check with the PyPI JSON API.

But the real blocker is: Fortanix API credentials don't exist, and the hosted endpoints (smartkey.io / sdkms.fortanix.com) are unreachable from this sandbox (DNS failure / 502). Without an account + API key, we can't call the hosted service, and Fortanix doesn't offer anonymous self-service — account creation requires registration (historically a trial application). Therefore, we should honestly report that we're blocked.

Still, we can install the SDK and write a small runnable sample (encrypt/decrypt via REST or SDK), so it'll be immediately usable as soon as we have an API key. That's lightweight and honest. Let's verify whether the sdkms package really is Fortanix's.

curl -sS -m 8 https://pypi.org/pypi/sdkms/json | python3 -c "import json,sys; d=json.load(sys.stdin)['info']; print(d['name'], d['version']); print(d['summary']); print((d.get('author') or ''), (d.get('home_page') or '')); print(list(d.get('project_urls') or {}))"
sdkms 5.6.2919
sdkms 5.6.2919
Fortanix DSM REST API
Fortanix https://support.fortanix.com
['Homepage']
Thinking…

The sdkms package on PyPI is the official Fortanix DSM Python client. Install this and write a simple sample. Then attempt to run it — it will fail because we don't have an API key and the endpoint is unreachable — which confirms the blocked state. In fact, the endpoint sdkms.fortanix.com doesn't resolve by name. The official SDK defaults to that endpoint. So even if we had a key, we couldn't reach it from this sandbox (egress DNS is restricted, and only some hosts can be resolved — probably an allowlist scheme). Therefore we're doubly blocked: lack of credentials, and lack of network egress to Fortanix's API endpoints.

Install the SDK (lightweight and fast), and write a minimal sample script (create + use a secret/security object via REST/SDK). After that, report the following: pricing (undisclosed, quote-based; the free-trial wording has changed — we should be careful about the facts), assessment of manageability, and that we're blocked.

Regarding pricing: Fortanix DSM pricing isn't publicly disclosed; enterprise quote-based (per-node/subscription). Historically, SDKMS offered a free trial with per-API-call pay-as-you-go pricing? There used to be published pricing (a certain number of free crypto operations per month, then metered billing after that). Shouldn't overclaim. State it as follows: no public pricing page exists; sales/quote-based subscription; a trial is available via sign-up. This is verifiable from the "Contact Us" on the site.

Now going to install and write the sample.

The official Python SDK for Fortanix DSM (sdkms) is published on PyPI. Let's install this and put together a minimal example.

pip install -q sdkms 2>&1 | tail -2; python3 -c "import sdkms; print('sdkms', sdkms.__version__ if hasattr(sdkms,'__version__') else 'ok')" 2>&1; python3 -c "from sdkms.v1 import ApiClient, Configuration, CryptoApi, SecretsAndKeysApi; print('client imports ok')" 2>&1 | tail -1
sdkms ok
sdkms ok
ImportError: cannot import name 'CryptoApi' from 'sdkms.v1' (/opt/freestyle/python/lib/python3.12/site-packages/sdkms/v1/__init__.py)
Thinking…

SDK is already installed. Check the available APIs within the package, and build an accurate example.

python3 -c "import sdkms.v1 as v; print([n for n in dir(v) if n.endswith('Api')])"; ls /opt/freestyle/python/lib/python3.12/site-packages/sdkms/v1/api | head -30
['AWSApi', 'AccountsApi', 'ApprovalRequestsApi', 'AppsApi', 'AuthenticationApi', 'ChildAccountUsersApi', 'ChildAccountsApi', 'DigestApi', 'EncryptionAndDecrypti
['AWSApi', 'AccountsApi', 'ApprovalRequestsApi', 'AppsApi', 'AuthenticationApi', 'ChildAccountUsersApi', 'ChildAccountsApi', 'DigestApi', 'EncryptionAndDecryptionApi', 'GroupsApi', 'LogsApi', 'PluginsApi', 'SecurityObjectsApi', 'SignAndVerifyApi', 'StatsApi', 'TwoFactorAuthenticationApi', 'UsersApi', 'WrappingAndUnwrappingApi']
ls: cannot access '/opt/freestyle/python/lib/python3.12/site-packages/sdkms/v1/api': No such file or directory
Thinking…

Alright. Next, write a minimal sample script: authenticate with the API key (FORTANIX_API_KEY), create an AES security object (key), encrypt/decrypt round-trip, then delete the key. Use sdkms.v1: Configuration, ApiClient, AuthenticationApi (for authentication via API key header?), EncryptionAndDecryptionApi, SecurityObjectsApi.

How does authentication work with this SDK? Usually the REST API uses an Authorization: <api_key> header. Let me check the SDK's Configuration and how the API key is passed.

cd /opt/freestyle/python/lib/python3.12/site-packages/sdkms/v1 && grep -rn "api_key" configuration.py | head; grep -rn "def auth\|Authorization\|auth_settings" api_client.py | head; grep -n "def " apis/encryption_and_decryption_api.py | head; grep -n "def " apis/security_objects_api.py | head -20
57: self.api_key = {}
57:        self.api_key = {}
59:        self.api_key_prefix = {}
65:        self.app_api_key = ""
185:    def get_api_key_with_prefix(self, identifier):
192:        if self.api_key.get(identifier) and self.api_key_prefix.get(identifier):
193:            return self.api_key_prefix[identifier] + ' ' + self.api_key[identifier]
194:        elif self.api_key.get(identifier):
195:            return self.api_key[identifier]
203:        if self.app_api_key == "":
207:            api_cred = base64.b64decode(self.app_api_key).decode('ascii')
118:                   response_type=None, auth_settings=None,
156:        self.update_params_for_auth(header_params, query_params, auth_settings)
316:                 response_type=None, auth_settings=None, async_call=None,
330:        :param auth_settings list: Auth Settings names for the request.
350:                                   response_type, auth_settings,
357:                                           response_type, auth_settings,
528:    def update_params_for_auth(self, headers, querys, auth_settings):
534:        :param auth_settings: Authentication setting identifiers list.
536:        if not auth_settings:
539:        for auth in auth_settings:
43:    def __init__(self, api_client=None):
48:    def batch_decrypt(self, body, async_call=False, **kwargs):
68:    def batch_decrypt_with_http_info(self, body, async_call=False, **kwargs):
143:    def batch_encrypt(self, body, async_call=False, **kwargs):
163:    def batch_encrypt_with_http_info(self, body, async_call=False, **kwargs):
238:    def decrypt(self, key_id, body, async_call=False, **kwargs):
260:    def decrypt_with_http_info(self, key_id, body, async_call=False, **kwargs):
342:    def decrypt_ex(self, body, async_call=False, **kwargs):
362:    def decrypt_ex_with_http_info(self, body, async_call=False, **kwargs):
437:    def decrypt_final(self, key_id, body, async_call=False, **kwargs):
43:    def __init__(self, api_client=None):
48:    def activate_security_object(self, key_id, async_call=False, **kwargs):
68:    def activate_security_object_with_http_info(self, key_id, async_call=False, **kwargs):
143:    def agree_key(self, body, async_call=False, **kwargs):
163:    def agree_key_with_http_info(self, body, async_call=False, **kwargs):
238:    def delete_private_key(self, key_id, async_call=False, **kwargs):
258:    def delete_private_key_with_http_info(self, key_id, async_call=False, **kwargs):
333:    def delete_security_object(self, key_id, async_call=False, **kwargs):
353:    def delete_security_object_with_http_info(self, key_id, async_call=False, **kwargs):
428:    def derive_key(self, key_id, body, async_call=False, **kwargs):
450:    def derive_key_with_http_info(self, key_id, body, async_call=False, **kwargs):
532:    def derive_key_ex(self, body, async_call=False, **kwargs):
552:    def derive_key_ex_with_http_info(self, body, async_call=False, **kwargs):
627:    def destroy_security_object(self, key_id, async_call=False, **kwargs):
647:    def destroy_security_object_with_http_info(self, key_id, async_call=False, **kwargs):
722:    def export_sobject_components(self, body, async_call=False, **kwargs):
742:    def export_sobject_components_with_http_info(self, body, async_call=False, **kwargs):
817:    def generate_security_object(self, body, async_call=False, **kwargs):
837:    def generate_security_object_with_http_info(self, body, async_call=False, **kwargs):
912:    def get_key_attestation(self, body, async_call=False, **kwargs):
Thinking…

Good. I'll write the sample file /sandbox/repo/fortanix_example.py using sdkms v1. Configuration(api_key = {"Authorization": key}) — checking how the auth header name is set. In configuration.py it's the api_key dictionary, and update_params_for_auth uses auth_settings like 'ApiKeyAuth', which is defined somewhere. Let me check the auth settings name in the API calls.

cd /opt/freestyle/python/lib/python3.12/site-packages/sdkms/v1 && grep -n "auth_settings = \[" apis/encryption_and_decryption_api.py | head -2; sed -n 528,560p api_client.py; grep -n "app_api_key\|username\|password" configuration.py | head
126: auth_settings = ['bearerToken']
126:        auth_settings = ['bearerToken']
221:        auth_settings = ['bearerToken']
    def update_params_for_auth(self, headers, querys, auth_settings):
        """
        Updates header and query params based on authentication setting.

        :param headers: Header parameters dict to be updated.
        :param querys: Query parameters tuple list to be updated.
        :param auth_settings: Authentication setting identifiers list.
        """
        if not auth_settings:
            return

        for auth in auth_settings:
            auth_setting = self.configuration.auth_settings().get(auth)
            if auth_setting:
                if not auth_setting['value']:
                    continue
                elif auth_setting['in'] == 'header':
                    headers[auth_setting['key']] = auth_setting['value']
                elif auth_setting['in'] == 'query':
                    querys.append((auth_setting['key'], auth_setting['value']))
                else:
                    raise ValueError(
                        'Authentication token must be in `query` or `header`'
                    )

    def __deserialize_file(self, response):
        """
        Saves response body into a file in a temporary folder,
        using the filename from the `Content-Disposition` header if provided.

        :param response:  RESTResponse.
        :return: file path.
        """
61:        self.username = ""
63:        self.password = ""
65:        self.app_api_key = ""
203:        if self.app_api_key == "":
204:            return (urllib3.util.make_headers(basic_auth=self.username + ':' + self.password)\
207:            api_cred = base64.b64decode(self.app_api_key).decode('ascii')
Thinking…

Authentication: bearerToken gets mapped to app_api_key (Basic-like — the app's API key is base64 of app_id:app_secret, sent as Authorization header). So the example is: Configuration(host=..., app_api_key=<API key from the DSM app>) or username/password.

Next, write the sample file. Then try running it — it'll fail (no key, endpoint unreachable), but this will demonstrate the blocking state. Write the sample with clear comments, do a dry run (should fail at the auth/network stage), and report.

Check model classes for key generation: GenerateKeyRequest? Let me quickly check the names: models like GenerateSecurityObject, ObjMetadata, AesKeyMode, EncryptRequest, DecryptRequest, etc. Let me grep.

cd /opt/freestyle/python/lib/python3.12/site-packages/sdkms/v1 && python3 -c "
import sdkms.v1 as v
names=[n for n in dir(v) if not n.startswith('_')]
import re
print([n for n in names if re.search('Generate|Encrypt|Decrypt|Aes|ObjMetadata|KeyMetadata',n)])"
['ADDecryptInput', 'ADEncryptInput', 'BatchDecryptRequest', 'BatchDecryptRequestInner', 'BatchDecryptResponse', 'BatchDecryptResponseInner', 'BatchEncryptReques
['ADDecryptInput', 'ADEncryptInput', 'BatchDecryptRequest', 'BatchDecryptRequestInner', 'BatchDecryptResponse', 'BatchDecryptResponseInner', 'BatchEncryptRequest', 'BatchEncryptRequestInner', 'BatchEncryptResponse', 'BatchEncryptResponseInner', 'DecryptFinalRequest', 'DecryptFinalRequestEx', 'DecryptFinalResponse', 'DecryptInitRequest', 'DecryptInitRequestEx', 'DecryptInitResponse', 'DecryptRequest', 'DecryptRequestEx', 'DecryptRequestFrame', 'DecryptRequestFrameFinal', 'DecryptRequestFrameInit', 'DecryptResponse', 'DecryptResponseFrame', 'DecryptResponseFrameInit', 'DecryptUpdateRequest', 'DecryptUpdateRequestEx', 'DecryptUpdateResponse', 'EncryptFinalRequest', 'EncryptFinalRequestEx', 'EncryptFinalResponse', 'EncryptInitRequest', 'EncryptInitRequestEx', 'EncryptInitResponse', 'EncryptRequest', 'EncryptRequestEx', 'EncryptRequestFrame', 'EncryptRequestFrameInit', 'EncryptResponse', 'EncryptResponseFrame', 'EncryptResponseFrameError', 'EncryptResponseFrameFinal', 'EncryptResponseFrameInit', 'EncryptUpdateRequest', 'EncryptUpdateRequestEx', 'EncryptUpdateResponse', 'EncryptionAndDecryptionApi', 'FpeEncryptedPart', 'IVDecryptInput', 'IVEncryptInput', 'IVEncryptOutput', 'MacGenerateRequest', 'MacGenerateRequestEx', 'MacGenerateResponse', 'RsaEncryptionPadding', 'RsaEncryptionPaddingOAEP', 'RsaEncryptionPolicy', 'RsaEncryptionPolicyPadding', 'RsaEncryptionPolicyPaddingOAEP', 'TagDecryptInput', 'TagEncryptOutput', 'TagLenEncryptInput']
Thinking…

Model classes like GenerateSecurityObject don't appear in that filtered list — maybe the generation request model has a different name. For example, something like SecurityObject or GenerateSecurityObjectRequest? Let me search for models containing "SecurityObject" and "Mode".

cd /opt/freestyle/python/lib/python3.12/site-packages/sdkms/v1 && python3 -c "
import sdkms.v1 as v, re, inspect
names=[n for n in dir(v) if not n.startswith('_')]
print([n for n in names if re.search('SecurityObject|KeyMode|Generate',n)])
sig=inspect.signature(v.SecurityObjectsApi.generate_security_object)
print(sig)
print(inspect.signature(v.EncryptionAndDecryptionApi.encrypt))
print([f for f in dir(v.GenerateSecurityObject) if not f.startswith('_')] if hasattr(v,'GenerateSecurityObject') else 'no GenerateSecurityObject')"
['MacGenerateRequest', 'MacGenerateRequestEx', 'MacGenerateResponse', 'SecurityObjectsApi']
['MacGenerateRequest', 'MacGenerateRequestEx', 'MacGenerateResponse', 'SecurityObjectsApi']
(self, body, async_call=False, **kwargs)
(self, key_id, body, async_call=False, **kwargs)
no GenerateSecurityObject
Thinking…

Is there no typed GenerateSecurityObject model in v1? Let me check what the docs say about the body type for generate_security_object. Maybe it's CreateSecurityObject. Let me search for a model containing "Create", or check the docstrings.

cd /opt/freestyle/python/lib/python3.12/site-packages/sdkms/v1 && grep -n "body (.*):" apis/security_objects_api.py | sed -n 1,3p; grep -n "response_type\|body (.*):" apis/security_objects_api.py | grep -A0 generate; sed -n '/def generate_security_object_with_http_info/,/collection_formats/p' apis/security_objects_api.py | grep -E "body \(|response_type =" | head -3; python3 -c "import sdkms.v1 as v; print([n for n in dir(v) if 'Create' in n or 'Sobject' in n or 'SObject' in n])"
['ExportSobjectComponentsRequest', 'ImportSobjectComponentsRequest', 'SobjectComponent', 'SobjectDescriptor', 'SobjectDescriptorPersisted', 'SobjectRequest']
['ExportSobjectComponentsRequest', 'ImportSobjectComponentsRequest', 'SobjectComponent', 'SobjectDescriptor', 'SobjectDescriptorPersisted', 'SobjectRequest']
Thinking…

The body for generate_security_object is probably SobjectRequest. Let me check its fields right away.

cd /opt/freyscale 2>/dev/null; python3 - <<'EOF'
import sdkms.v1 as v, inspect
print(v.SobjectRequest.__init__.__doc__ or inspect.signature(v.SobjectRequest.__init__))
print('---EncryptRequest---')
print(inspect.signature(v.EncryptRequest.__init__))
print('---DecryptRequest---')
print(inspect.signature(v.DecryptRequest.__init__))
EOF
SobjectRequest - a model defined in Swagger

        SobjectRequest - a model defined in Swagger
        
---EncryptRequest---
(self, alg=None, plain=None, mode=None, iv=None, ad=None, tag_len=None)
---DecryptRequest---
(self, alg=None, cipher=None, mode=None, iv=None, ad=None, tag=None, masked=None)
Thinking…

The docstring output got cut off (the first print showed the class docstring, not the signature — weird, did the or pick up a truthy docstring?). Anyway, SobjectRequest probably has fields like name, key_size, obj_type, metadata (ObjMetadata containing aes key modes), enabled, etc. Let me grab swagger_types.

python3 -c "
import sdkms.v1 as v
print('SobjectRequest:', v.SobjectRequest.swagger_types if hasattr(v.SobjectRequest,'swagger_types') else v.SobjectRequest.attribute_map)
print('ObjMetadata:', getattr(v,'ObjMetadata',None) and v.ObjMetadata.swagger_types)"
SobjectRequest: {'name': 'str', 'description': 'str', 'key_size': 'int', 'pub_exponent': 'int', 'elliptic_curve': 'EllipticCurve', 'rsa': 'RsaOptions', 'dsa': '
SobjectRequest: {'name': 'str', 'description': 'str', 'key_size': 'int', 'pub_exponent': 'int', 'elliptic_curve': 'EllipticCurve', 'rsa': 'RsaOptions', 'dsa': 'DsaOptions', 'fpe': 'FpeOptions', 'group_id': 'str', 'rotation_policy': 'RotationPolicy', 'obj_type': 'ObjectType', 'key_ops': 'list[KeyOperations]', 'custom_metadata': 'dict(str, str)', 'value': 'bytearray', 'enabled': 'bool', 'transient': 'bool', 'deterministic_signatures': 'bool', 'state': 'KeyObjectState', 'activation_date': 'str', 'bls': 'BlsOptions', 'deactivation_date': 'str'}
ObjMetadata: None
Thinking…

That's enough already. Next, I'll create the sample file /sandbox/repo/fortanix_example.py. It will do the following:

  1. Read the environment variables FORTANIX_API_KEY and FORTANIX_API_URL (default is https://sdkms.fortanix.com).
  2. Configure sdkms v1 using app_api_key.
  3. Generate a 256-bit AES security object.
  4. Perform AES-GCM encryption/decryption using a random IV.
  5. Cleanup: delete + destroy the key.

After that, run it and demonstrate the failure (no credentials → should clearly exit). Make the script fail fast with a clear message when the environment variables are missing.

Then report: the blocked state (two reasons: no credentials; the endpoint is unreachable from the sandbox — DNS for sdkms.fortanix.com/smartkey.io fails, or returns 502 via the proxy), pricing info, and the admin's assessment.

The SDK is official and installable from PyPI. Now let me write the example and try to run it.

File edits

1 file

Completed
Writtenfortanix_example.pyView changes

/sandbox/repo/fortanix_example.py

Written content · previous contents were not recorded

#!/usr/bin/env python3
"""Minimal Fortanix DSM (Data Security Manager, formerly SDKMS) example.
 
Uses the official `sdkms` Python SDK (PyPI: sdkms) against the hosted SaaS
service. No local services required — just an account API key.
 
Setup:
  1. Create a Fortanix DSM account (or trial) at https://www.fortanix.com
  2. In the DSM UI: Apps -> create an app -> copy its API key
  3. Grant the app access to a group (keys live in groups)
  4. Run:
       export FORTANIX_API_KEY="<app api key>"
       export FORTANIX_API_URL="https://sdkms.fortanix.com"   # or your regional endpoint
       python3 fortanix_example.py
"""
import base64
import os
import sys
 
from sdkms.v1 import (
    ApiClient,
    Configuration,
    DecryptRequest,
    EncryptRequest,
    EncryptionAndDecryptionApi,
    ObjectType,
    SecurityObjectsApi,
    SobjectRequest,
)
 
API_KEY = os.environ.get("FORTANIX_API_KEY")
API_URL = os.environ.get("FORTANIX_API_URL", "https://sdkms.fortanix.com")
 
if not API_KEY:
    sys.exit("Set FORTANIX_API_KEY (app API key from the Fortanix DSM UI).")
 
 
def main() -> None:
    config = Configuration(host=API_URL)
    # The DSM app API key is sent as a bearer/basic-style Authorization header;
    # the SDK derives it from app_api_key (base64 of app_id:secret) or you can
    # pass username/password from an auth session.
    config.app_api_key = base64.b64encode(f"x:{API_KEY}".encode()).decode()
    client = ApiClient(configuration=config)
 
    keys = SecurityObjectsApi(client)
    crypto = EncryptionAndDecryptionApi(client)
 
    # 1) Generate a 256-bit AES security object (key) in the cloud HSM service
    key = keys.generate_security_object(
        SobjectRequest(
            name="demo-aes-key",
            obj_type=ObjectType.AES,
            key_size=256,
            enabled=True,
        )
    )
    print(f"created key: id={key.kid} name={key.name}")
 
    try:
        plaintext = base64.b64encode(b"hello from Fortanix DSM").decode()
        iv = base64.b64encode(os.urandom(12)).decode()
 
        # 2) Encrypt (AES-GCM) — plaintext never leaves your app unencrypted
        #    on the way back; the key never leaves Fortanix.
        enc = crypto.encrypt(
            key.kid, EncryptRequest(alg="AES", mode="GCM", plain=plaintext, iv=iv)
        )
        print(f"ciphertext: {enc.cipher[:32]}...")
 
        # 3) Decrypt
        dec = crypto.decrypt(
            key.kid,
            DecryptRequest(alg="AES", mode="GCM", cipher=enc.cipher, iv=iv, tag=enc.tag),
        )
        roundtrip = base64.b64decode(dec.plain)
        print(f"roundtrip ok: {roundtrip.decode()!r}")
        assert roundtrip == b"hello from Fortanix DSM"
    finally:
        # 4) Cleanup: delete then destroy the security object
        keys.delete_security_object(key.kid)
        keys.destroy_security_object(key.kid)
        print("key deleted + destroyed")
 
 
if __name__ == "__main__":
    main()
Thinking…

Alright, let's run it and verify — it should fail due to the missing API key. I'll also confirm the network failure with a dummy key. Run it quickly using a timeout.

cd /sandbox/repo && python3 fortanix_example.py; echo "exit=$?"; echo "---"; FORTANIX_API_KEY=dummy timeout 20 python3 fortanix_example.py 2>&1 | tail -5
Set FORTANIX_API_KEY (app API key from the Fortanix DSM UI).
Set FORTANIX_API_KEY (app API key from the Fortanix DSM UI).
exit=1
---
    main()
  File "/sandbox/repo/fortanix_example.py", line 39, in main
    config = Configuration(host=API_URL)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: Configuration.__init__() got an unexpected keyword argument 'host'
Thinking…

Configuration does not accept a host keyword argument. Please check the signature of Configuration's init.

python3 -c "
import inspect, sdkms.v1
print(inspect.signature(sdkms.v1.Configuration.__init__))
c=sdkms.v1.Configuration(); print([a for a in vars(c) if 'host' in a or 'url' in a])"
(self)
(self)
['host']
Thinking…

Configuration() takes no arguments, so set config.host = API_URL. Please fix the example.

File edits

1 file

Completed
Modifiedfortanix_example.py+2−1View changes

/sandbox/repo/fortanix_example.py

Replacement excerpt

-    config = Configuration(host=API_URL)
+    config = Configuration()
+    config.host = API_URL
Thinking…

Next, I'll test again with the dummy key to see how far it gets (the network will fail since sdkms.fortanix.com can't be resolved). I'll use timeout to keep it lightweight.

cd /sandbox/repo && FORTANIX_API_KEY=dummy timeout 30 python3 fortanix_example.py 2>&1 | tail -6; echo "exit=$?"
retries = retries.increment(
    retries = retries.increment(
              ^^^^^^^^^^^^^^^^^^
  File "/opt/freestyle/python/lib/python3.12/site-packages/urllib3/util/retry.py", line 543, in increment
    raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='sdkms.fortanix.com', port=443): Max retries exceeded with url: /crypto/v1/keys (Caused by NameResolutionError("HTTPSConnection(host='sdkms.fortanix.com', port=443): Failed to resolve 'sdkms.fortanix.com' ([Errno -2] Name or service not known)"))
exit=0
Thinking…

Confirmed: this sandbox cannot resolve Fortanix's DSM API endpoint (DNS for sdkms.fortanix.com / smartkey.io is blocked; the only thing reachable is the marketing site www.fortanix.com). Furthermore, I don't have any Fortanix credentials. In other words, I'm blocked at the stage of running against a live service. The sample itself is written and verified as far as the SDK layer.

Now I'll draft the final answer:

  1. What I built: /sandbox/repo/fortanix_example.py — uses the official sdkms PyPI SDK, does an AES-GCM encrypt/decrypt round-trip against hosted Fortanix DSM and cleans up. Installed sdkms 5.6.2919, verified the SDK's imports and model signatures, and fixed one API quirk (Configuration doesn't take a host keyword argument).
  2. Blockers: (a) this environment has no Fortanix account/API key; (b) this sandbox cannot reach Fortanix's API endpoints (DNS for sdkms.fortanix.com and *.smartkey.io fails, only www.fortanix.com is reachable). Therefore I couldn't run end-to-end. To run it, you need an API key and network egress.
  3. Pricing: not public — no public pricing page exists, and Fortanix's site directs you to "Contact Us"/sales. Enterprise, quote-based subscription for DSM (typically per-node/per-instance + support); a free trial/self-service was historically available for SDKMS but the current pricing is quote-based. Be honest about the uncertainty.
  4. Admin assessment: as an agent, moderately hard to manage: credentials aren't self-service (require account + app creation in the UI, plus group permissions), pricing isn't public, API endpoints may be region-specific; however, once you have the API key, the workflow is clean: REST/SDK-driven, stateless calls, no local stack needed, easy to script, keys are created/destroyed via the API. So: easy to run once you have credentials; the hard part is the human-dependent account/key provisioning.
  5. No local services, no long-running commands — complied.

Keep it concise.

Blocked — here's the honest summary.

What I built

/sandbox/repo/fortanix_example.py — a minimal example using Fortanix's official Python SDK (sdkms 5.6.2919 from PyPI, "Fortanix DSM REST API") against their hosted Data Security Manager (DSM, formerly SDKMS). It:

  1. Generates a 256-bit AES security object (key) in the cloud service
  2. Encrypts/decrypts a payload (AES-GCM) — the key never leaves Fortanix
  3. Deletes + destroys the key for cleanup

I installed the SDK, verified imports and model signatures against the installed package (and fixed one quirk: Configuration() takes no host kwarg — you set config.host after). No local services, no long-running processes.

Why it can't run here (two hard blockers)

  • No credentials. Fortanix requires an account; the API key comes from creating an "App" in the DSM web UI and granting it group access. There's no anonymous/self-service path I can complete from a shell.
  • No network path. This sandbox can't reach Fortanix's API endpoints — DNS fails for sdkms.fortanix.com and *.smartkey.io (their regional SaaS endpoints return 502/fail to resolve). Only their marketing site www.fortanix.com resolves. Confirmed by running the script: it fails at NameResolutionError on the first API call.

So: the product does have a real developer workflow (REST API + SDKs), but I can't act on it end-to-end from here. With FORTANIX_API_KEY + network egress, the script should run as-is.

Pricing

Not public. There is no pricing page (fortanix.com/pricing is a 404); the site only offers "Contact Us." DSM is sold as an enterprise, quote-based subscription (historically per-node/per-instance licensing plus support tiers). SDKMS once had a metered free-trial model, but current terms are sales-gated — I can't verify a self-serve price.

Will it be easy for me to manage?

Mixed. Once credentials exist, it's very agent-friendly: pure REST/SDK calls, no local stack, idempotent-ish CRUD for keys, everything scriptable and teardown-able via API. The hard part is entirely human-gated up front: account creation, app/API-key provisioning in the UI, group permissions, and opaque pricing mean I can't self-onboard, budget, or rotate access without you. If you can supply an API key from an environment with egress to their endpoints, I can take it from there.

AX Fundamentals

23 checks. Open an area for details.

This check is a quick preview. Test more tasks and models with Gauge Agents.

Test your product with Gauge Agents

AX Check by Gauge