You want to store an API key in SSM Parameter Store encrypted at rest. Which parameter type do you use?

Use SecureString. KMS encrypts these parameters with a KMS key. To read the plaintext value, you need both SSM permission and KMS decrypt permission.

String and StringList are stored as plain text. EncryptedString is not a real parameter type.