There are multiple keys involved in this service — one or two base keys and the target key (the new key created from the base key).

• To use a base key that is a public object, the caller must have SO (READ) authority or USER (READ) authority (any access).
• To use a base key that is a private object, the caller must have USER (READ) authority (user access).
• To derive a target key that is a public object, the caller must have SO (READ) authority or USER (UPDATE) authority.
• To derive a target key that is a private object, the caller must have SO (CONTROL) authority or USER (UPDATE) authority.