SAF may be invoked to verify the caller is authorized to use this callable service, the key label, or internal secure key tokens that are stored in the PKDS.

This service extracts the public key from the internal or external form of a private key. However, it does not check the cryptographic validity of the private token.

This table lists the required cryptographic hardware for each server type and describes restrictions for this callable service.

Table 242. PKA public key extract build required hardware

Server	Required cryptographic hardware	Restrictions
IBM zSeries 900	None
IBM zSeries 990 IBM zSeries 890	None
IBM System z9 EC IBM System z9 BC	None