--- title: "POST /v1/{+parent}/cryptoKeyVersions" method: POST path: "/v1/{+parent}/cryptoKeyVersions" tags: ["projects"] --- # POST /v1/{+parent}/cryptoKeyVersions `POST /v1/{+parent}/cryptoKeyVersions` Create a new CryptoKeyVersion in a CryptoKey. The server will assign the next sequential id. If unset, state will be set to ENABLED. ## Path parameters - `parent` string, required ## Request body - CryptoKeyVersion — A CryptoKeyVersion represents an individual cryptographic key, and the associated key material. An ENABLED version can be used for cryptographic operations. For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS. - `generationFailureReason` string — Output only. The root cause of the most recent generation failure. Only present if state is GENERATION_FAILED. - `attestation` KeyOperationAttestation — Contains an HSM-generated attestation about a key operation. For more information, see [Verifying attestations] (https://cloud.google.com/kms/docs/attest-key). - `certChains` CertificateChains — Certificate chains needed to verify the attestation. Certificates in chains are PEM-encoded and are ordered based on https://tools.ietf.org/html/rfc5246#section-7.4.2. - `caviumCerts` string[] — Cavium certificate chain corresponding to the attestation. - `googleCardCerts` string[] — Google card certificate chain corresponding to the attestation. - `googlePartitionCerts` string[] — Google partition certificate chain corresponding to the attestation. - `content` string, byte — Output only. The attestation data provided by the HSM when the key operation was performed. - `format` 'ATTESTATION_FORMAT_UNSPECIFIED' | 'CAVIUM_V1_COMPRESSED' | 'CAVIUM_V2_COMPRESSED' — Output only. The format of the attestation data. - `name` string — Output only. The resource name for this CryptoKeyVersion in the format `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`. - `destroyTime` string, google-datetime — Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED. - `algorithm` 'CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED' | 'GOOGLE_SYMMETRIC_ENCRYPTION' | 'AES_128_GCM' | 'AES_256_GCM' | 'AES_128_CBC' | 'AES_256_CBC' | 'AES_128_CTR' | 'AES_256_CTR' | 'RSA_SIGN_PSS_2048_SHA256' | 'RSA_SIGN_PSS_3072_SHA256' | 'RSA_SIGN_PSS_4096_SHA256' | 'RSA_SIGN_PSS_4096_SHA512' | 'RSA_SIGN_PKCS1_2048_SHA256' | 'RSA_SIGN_PKCS1_3072_SHA256' | 'RSA_SIGN_PKCS1_4096_SHA256' | 'RSA_SIGN_PKCS1_4096_SHA512' | 'RSA_SIGN_RAW_PKCS1_2048' | 'RSA_SIGN_RAW_PKCS1_3072' | 'RSA_SIGN_RAW_PKCS1_4096' | 'RSA_DECRYPT_OAEP_2048_SHA256' | 'RSA_DECRYPT_OAEP_3072_SHA256' | 'RSA_DECRYPT_OAEP_4096_SHA256' | 'RSA_DECRYPT_OAEP_4096_SHA512' | 'RSA_DECRYPT_OAEP_2048_SHA1' | 'RSA_DECRYPT_OAEP_3072_SHA1' | 'RSA_DECRYPT_OAEP_4096_SHA1' | 'EC_SIGN_P256_SHA256' | 'EC_SIGN_P384_SHA384' | 'EC_SIGN_SECP256K1_SHA256' | 'EC_SIGN_ED25519' | 'HMAC_SHA256' | 'HMAC_SHA1' | 'HMAC_SHA384' | 'HMAC_SHA512' | 'HMAC_SHA224' | 'EXTERNAL_SYMMETRIC_ENCRYPTION' | 'ML_KEM_768' | 'ML_KEM_1024' | 'KEM_XWING' | 'PQ_SIGN_ML_DSA_44' | 'PQ_SIGN_ML_DSA_65' | 'PQ_SIGN_ML_DSA_87' | 'PQ_SIGN_SLH_DSA_SHA2_128S' | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256' | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU' | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU' | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU' | 'AES_256_KWP' — Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports. - `destroyEventTime` string, google-datetime — Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED. - `state` 'CRYPTO_KEY_VERSION_STATE_UNSPECIFIED' | 'PENDING_GENERATION' | 'ENABLED' | 'DISABLED' | 'DESTROYED' | 'DESTROY_SCHEDULED' | 'PENDING_IMPORT' | 'IMPORT_FAILED' | 'GENERATION_FAILED' | 'PENDING_EXTERNAL_DESTRUCTION' | 'EXTERNAL_DESTRUCTION_FAILED' — The current state of the CryptoKeyVersion. - `trustedWrappingEnabled` boolean — Immutable. Field indicating that the key may be wrapped by a trusted key. This field can be set for all key purposes except ENCRYPT_DECRYPT, and is only valid for keys with protection level HSM_SINGLE_TENANT. This field can only be set at creation or import time via CreateCryptoKeyVersion, or ImportCryptoKeyVersion. - `importJob` string — Output only. The name of the ImportJob used in the most recent import of this CryptoKeyVersion. Only present if the underlying key material was imported. - `createTime` string, google-datetime — Output only. The time at which this CryptoKeyVersion was created. - `externalDestructionFailureReason` string — Output only. The root cause of the most recent external destruction failure. Only present if state is EXTERNAL_DESTRUCTION_FAILED. - `generateTime` string, google-datetime — Output only. The time this CryptoKeyVersion's key material was generated. - `importTime` string, google-datetime — Output only. The time at which this CryptoKeyVersion's key material was most recently imported. - `protectionLevel` 'PROTECTION_LEVEL_UNSPECIFIED' | 'SOFTWARE' | 'HSM' | 'EXTERNAL' | 'EXTERNAL_VPC' | 'HSM_SINGLE_TENANT' — Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. - `externalProtectionLevelOptions` ExternalProtectionLevelOptions — ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels. - `externalKeyUri` string — Optional. The URI for an external resource that this CryptoKeyVersion represents. - `ekmConnectionKeyPath` string — Optional. The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection. - `ekmConnectionBackendOverride` string — Optional. The resource name of the backend environment where the key material of CryptoKeyVersions is associated with. Setting this field overrides the CryptoKeyBackend. This field may be set when CryptoKeyVersions is set to EXTERNAL_VPC. Format: `projects/*/locations/*/ekmConnections/*`. - `importFailureReason` string — Output only. The root cause of the most recent import failure. Only present if state is IMPORT_FAILED. - `reimportEligible` boolean — Output only. Whether or not this key version is eligible for reimport, by being specified as a target in ImportCryptoKeyVersionRequest.crypto_key_version. - `hsmTrusted` boolean — Output only. Field indicating that the key wrapping key is trusted. This field is only valid for key purpose AES_256_WRAPPING, and protection level HSM_SINGLE_TENANT. ## Response `200` Successful response --- [API](https://skmtc.net/google/apis/cloudkms.md) · [All operations](https://skmtc.net/google/apis/cloudkms/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/cloudkms/versions/576b283e53dd/schema)