---
title: "POST /create-key"
method: POST
path: "/create-key"
tags: ["v2"]
---

# POST /create-key

`POST /create-key`

## Request body

- CreateKey — createKey is a command that creates a new key. [Deprecated: Use command create-dfc-key]
  - `alg` string, required — Key type; options: [AES128GCM, AES256GCM, AES128SIV, AES256SIV, AES128CBC, AES256CBC, RSA1024, RSA2048, RSA3072, RSA4096]
  - `certificate-common-name` string — Common name for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-country` string — Country name for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-digest-algo` string — Digest algorithm to be used for the certificate key signing.
  - `certificate-locality` string — Locality for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-organization` string — Organization name for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-province` string — Province name for the generated certificate. Relevant only for generate-self-signed-certificate.
  - `certificate-ttl` integer — TTL in days for the generated certificate. Required only for generate-self-signed-certificate.
  - `conf-file-data` string — The csr config data in base64 encoding
  - `customer-frg-id` string — The customer fragment ID that will be used to create the key (if empty, the key will be created independently of a customer fragment)
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `description` string — Description of the object
  - `generate-self-signed-certificate` boolean — Whether to generate a self signed certificate with the key. If set, --certificate-ttl must be provided.
  - `hash-algorithm` string — Specifies the hash algorithm used for the encryption key's operations, available options: [SHA256, SHA384, SHA512]
  - `json` boolean — Set output format to JSON
  - `metadata` string — Deprecated - use description
  - `name` string, required — Key name
  - `split-level` integer — The number of fragments that the item will be split into (not includes customer fragment)
  - `tag` string[] — List of the tags attached to this key
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication

## Response `200`

createKeyResponse wraps response body.

- CreateKeyOutput
  - `display_id` string
  - `fragment_results` Duration[]
  - `item_id` integer

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)