---
title: "Enable CMEK For Cloud Services Provider"
method: PUT
path: "/v4/organizations/{organizationId}/cmek/providers"
tags: ["CMEK"]
---

# Enable CMEK For Cloud Services Provider

`PUT /v4/organizations/{organizationId}/cmek/providers`

Enables the customer-managed encryption keys feature for the specified cloud service provider within the
organization.

For AWS and GCP enabling the customer-managed encryption keys feature is only required if no AWS or GCP cluster
respectively has ever been created in the organization.

The customer-managed encryption keys feature must always be enabled for Azure before Azure keys can be created.
This operation provisions a multi-tenant Azure Entra ID application for the organization, which is required for
Capella to access customer-managed encryption keys.

In order to access this endpoint, the provided API key must have at least one of the following roles:
- Organization Owner

To learn more, see [Organization, Project, and Database Access Overview](https://docs.couchbase.com/cloud/organizations/organization-projects-overview.html).

## Request body

- object
  - `cloudProvider` 'aws' | 'gcp' | 'azure', required — Cloud provider for CMEK keys.

## Response `204`

Successfully enabled the CMEK feature for the cloud services provider.

## Other responses

- `400` — Returned when we are unable to decode the recevied payload.
- `403` — The client does not have the necessary permissions to access this resource.
- `422` — Request validation error.
- `429` — Returned when the client exceeds the rate limit for the given APIKey.
- `500` — An unexpected error occurred in the server while processing this request.

---

[API](https://skmtc.net/couchbase/apis/couchbase-capella-management-api.md) · [All operations](https://skmtc.net/couchbase/apis/couchbase-capella-management-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/couchbase/couchbase-capella-management-api/revisions/e67df5d1f74e/schema)