> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/virtual-hsm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/virtual-hsm/cli/security-and-encryption/vhsm-transform.md).

# vhsm transform

The `vhsm transform` command provides a set of subcommands for interacting with vHSM's Transform Secrets Engine. This engine is used for performing cryptographic transformations such as Format-Preserving Encryption (FPE) and related data protection tasks.

Use this command to import keys or manage key versions for secure transformation workflows.

#### **Usage**

```bash
vhsm transform <subcommand> [options] [args]
```

* `<subcommand>`: A specific action under the transform engine (e.g., `import`, `import-version`).
* `[options]` and `[args]`: Additional flags or arguments passed to the specific subcommand.

#### **Subcommands**

| Subcommand       | Description                                                                   |
| ---------------- | ----------------------------------------------------------------------------- |
| `import`         | Import a key into a new transformation under the Transform secrets engine.    |
| `import-version` | Import new key material into an existing transformation key as a new version. |

Each subcommand has its own set of options and arguments. Use `vhsm transform <subcommand> -h` to see more details.

**Examples**

**Example 1:** Import a key into a new FPE transformation

```bash
vhsm transform import transform/transformations/fpe/new-transformation @path/to/key \
    template=identifier \
    allowed_roles=physical-access
```

* `transform/transformations/fpe/new-transformation`: Path to the new transformation.
* `@path/to/key`: Path to the key material to be imported.
* `template=identifier`: The template to be used (e.g., for data masking or FPE).
* `allowed_roles=physical-access`: Restricts transformation usage to a specific role.

**Example 2**: Import key material into a new key version

```bash
vhsm transform import-version transform/transformations/fpe/existing-transformation @new-key-material
```

This command updates an existing transformation with new key material as a new version, enabling key rotation or cryptographic agility.