---
title: "POST /create-dfc-key"
method: POST
path: "/create-dfc-key"
tags: ["v2"]
---

# POST /create-dfc-key

`POST /create-dfc-key`

## Request body

- CreateDFCKey
  - `alg` string, required — DFCKey type; options: [AES128GCM, AES256GCM, AES128SIV, AES256SIV, AES128CBC, AES256CBC, RSA1024, RSA2048, RSA3072, RSA4096]
  - `auto-rotate` string — Whether to automatically rotate every rotation_interval days, or disable existing automatic rotation [true/false]
  - `certificate-common-name` string — Common name for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-country` string — Country name for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-digest-algo` string — Digest algorithm to be used for the certificate key signing.
  - `certificate-format` string
  - `certificate-locality` string — Locality for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-organization` string — Organization name for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-province` string — Province name for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-ttl` integer — TTL in days for the generated certificate. Required only for generate-self-signed-certificate.
  - `conf-file-data` string — The csr config data in base64 encoding
  - `customer-frg-id` string — The customer fragment ID that will be used to create the DFC key (if empty, the key will be created independently of a customer fragment)
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `description` string — Description of the object
  - `expiration-event-in` string[] — How many days before the expiration of the certificate would you like to be notified.
  - `generate-self-signed-certificate` boolean — Whether to generate a self signed certificate with the key. If set, --certificate-ttl must be provided.
  - `hash-algorithm` string — Specifies the hash algorithm used for the encryption key's operations, available options: [SHA256, SHA384, SHA512]
  - `item-custom-fields` object — Additional custom fields to associate with the item
  - `json` boolean — Set output format to JSON
  - `metadata` string — Deprecated - use description
  - `name` string, required — DFCKey name
  - `rotation-event-in` string[] — How many days before the rotation of the item would you like to be notified
  - `rotation-interval` string — The number of days to wait between every automatic rotation (7-365)
  - `split-level` integer — The number of fragments that the item will be split into (not includes customer fragment)
  - `tag` string[] — List of the tags attached to this DFC key
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication

## Response `200`

createDFCKeyResponse wraps response body.

- CreateDFCKeyOutput
  - `fragment_results` Duration[]

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)