---
title: "POST /v1/{+parent}/cryptoKeys"
method: POST
path: "/v1/{+parent}/cryptoKeys"
tags: ["projects"]
---

# POST /v1/{+parent}/cryptoKeys

`POST /v1/{+parent}/cryptoKeys`

Create a new CryptoKey within a KeyRing. CryptoKey.purpose and CryptoKey.version_template.algorithm are required.

## Path parameters

- `parent` string, required

## Query parameters

- `cryptoKeyId` string
- `skipInitialVersionCreation` boolean
- `trustedWrappingEnabled` boolean

## Request body

- CryptoKey — A CryptoKey represents a logical key that can be used for cryptographic operations. A CryptoKey is made up of zero or more versions, which represent the actual key material used in cryptographic operations.
  - `name` string — Output only. The resource name for this CryptoKey in the format `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
  - `rotationPeriod` string, google-duration — next_rotation_time will be advanced by this period when the service automatically rotates a key. Must be at least 24 hours and at most 876,000 hours. If rotation_period is set, next_rotation_time must also be set. Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted.
  - `versionTemplate` CryptoKeyVersionTemplate — A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.
    - `protectionLevel` 'PROTECTION_LEVEL_UNSPECIFIED' | 'SOFTWARE' | 'HSM' | 'EXTERNAL' | 'EXTERNAL_VPC' | 'HSM_SINGLE_TENANT' — ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
    - `algorithm` 'CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED' | 'GOOGLE_SYMMETRIC_ENCRYPTION' | 'AES_128_GCM' | 'AES_256_GCM' | 'AES_128_CBC' | 'AES_256_CBC' | 'AES_128_CTR' | 'AES_256_CTR' | 'RSA_SIGN_PSS_2048_SHA256' | 'RSA_SIGN_PSS_3072_SHA256' | 'RSA_SIGN_PSS_4096_SHA256' | 'RSA_SIGN_PSS_4096_SHA512' | 'RSA_SIGN_PKCS1_2048_SHA256' | 'RSA_SIGN_PKCS1_3072_SHA256' | 'RSA_SIGN_PKCS1_4096_SHA256' | 'RSA_SIGN_PKCS1_4096_SHA512' | 'RSA_SIGN_RAW_PKCS1_2048' | 'RSA_SIGN_RAW_PKCS1_3072' | 'RSA_SIGN_RAW_PKCS1_4096' | 'RSA_DECRYPT_OAEP_2048_SHA256' | 'RSA_DECRYPT_OAEP_3072_SHA256' | 'RSA_DECRYPT_OAEP_4096_SHA256' | 'RSA_DECRYPT_OAEP_4096_SHA512' | 'RSA_DECRYPT_OAEP_2048_SHA1' | 'RSA_DECRYPT_OAEP_3072_SHA1' | 'RSA_DECRYPT_OAEP_4096_SHA1' | 'EC_SIGN_P256_SHA256' | 'EC_SIGN_P384_SHA384' | 'EC_SIGN_SECP256K1_SHA256' | 'EC_SIGN_ED25519' | 'HMAC_SHA256' | 'HMAC_SHA1' | 'HMAC_SHA384' | 'HMAC_SHA512' | 'HMAC_SHA224' | 'EXTERNAL_SYMMETRIC_ENCRYPTION' | 'ML_KEM_768' | 'ML_KEM_1024' | 'KEM_XWING' | 'PQ_SIGN_ML_DSA_44' | 'PQ_SIGN_ML_DSA_65' | 'PQ_SIGN_ML_DSA_87' | 'PQ_SIGN_SLH_DSA_SHA2_128S' | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256' | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU' | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU' | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU' | 'AES_256_KWP' — Required. Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
  - `keyAccessJustificationsPolicy` KeyAccessJustificationsPolicy — A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey or KeyAccessJustificationsPolicyConfig (the default Key Access Justifications policy).
    - `allowedAccessReasons` string[] — The list of allowed reasons for access to a CryptoKey. Note that empty allowed_access_reasons has a different meaning depending on where this message appears. If this is under KeyAccessJustificationsPolicyConfig, it means allow-all. If this is under CryptoKey, it means deny-all.
  - `labels` object — Labels with user-defined metadata. For more information, see [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
  - `cryptoKeyBackend` string — Immutable. The resource name of the backend environment where the key material for all CryptoKeyVersions associated with this CryptoKey reside and where all related cryptographic operations are performed. Only applicable if CryptoKeyVersions have a ProtectionLevel of EXTERNAL_VPC, with the resource name in the format `projects/*/locations/*/ekmConnections/*`. Only applicable if CryptoKeyVersions have a ProtectionLevel of HSM_SINGLE_TENANT, with the resource name in the format `projects/*/locations/*/singleTenantHsmInstances/*`. Note, this list is non-exhaustive and may apply to additional ProtectionLevels in the future.
  - `importOnly` boolean — Immutable. Whether this key may contain imported versions only.
  - `primary` CryptoKeyVersion — A CryptoKeyVersion represents an individual cryptographic key, and the associated key material. An ENABLED version can be used for cryptographic operations. For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.
    - `generationFailureReason` string — Output only. The root cause of the most recent generation failure. Only present if state is GENERATION_FAILED.
    - `attestation` KeyOperationAttestation — Contains an HSM-generated attestation about a key operation. For more information, see [Verifying attestations] (https://cloud.google.com/kms/docs/attest-key).
      - `certChains` CertificateChains — Certificate chains needed to verify the attestation. Certificates in chains are PEM-encoded and are ordered based on https://tools.ietf.org/html/rfc5246#section-7.4.2.
        - `caviumCerts` string[] — Cavium certificate chain corresponding to the attestation.
        - `googleCardCerts` string[] — Google card certificate chain corresponding to the attestation.
        - `googlePartitionCerts` string[] — Google partition certificate chain corresponding to the attestation.
      - `content` string, byte — Output only. The attestation data provided by the HSM when the key operation was performed.
      - `format` 'ATTESTATION_FORMAT_UNSPECIFIED' | 'CAVIUM_V1_COMPRESSED' | 'CAVIUM_V2_COMPRESSED' — Output only. The format of the attestation data.
    - `name` string — Output only. The resource name for this CryptoKeyVersion in the format `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
    - `destroyTime` string, google-datetime — Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.
    - `algorithm` 'CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED' | 'GOOGLE_SYMMETRIC_ENCRYPTION' | 'AES_128_GCM' | 'AES_256_GCM' | 'AES_128_CBC' | 'AES_256_CBC' | 'AES_128_CTR' | 'AES_256_CTR' | 'RSA_SIGN_PSS_2048_SHA256' | 'RSA_SIGN_PSS_3072_SHA256' | 'RSA_SIGN_PSS_4096_SHA256' | 'RSA_SIGN_PSS_4096_SHA512' | 'RSA_SIGN_PKCS1_2048_SHA256' | 'RSA_SIGN_PKCS1_3072_SHA256' | 'RSA_SIGN_PKCS1_4096_SHA256' | 'RSA_SIGN_PKCS1_4096_SHA512' | 'RSA_SIGN_RAW_PKCS1_2048' | 'RSA_SIGN_RAW_PKCS1_3072' | 'RSA_SIGN_RAW_PKCS1_4096' | 'RSA_DECRYPT_OAEP_2048_SHA256' | 'RSA_DECRYPT_OAEP_3072_SHA256' | 'RSA_DECRYPT_OAEP_4096_SHA256' | 'RSA_DECRYPT_OAEP_4096_SHA512' | 'RSA_DECRYPT_OAEP_2048_SHA1' | 'RSA_DECRYPT_OAEP_3072_SHA1' | 'RSA_DECRYPT_OAEP_4096_SHA1' | 'EC_SIGN_P256_SHA256' | 'EC_SIGN_P384_SHA384' | 'EC_SIGN_SECP256K1_SHA256' | 'EC_SIGN_ED25519' | 'HMAC_SHA256' | 'HMAC_SHA1' | 'HMAC_SHA384' | 'HMAC_SHA512' | 'HMAC_SHA224' | 'EXTERNAL_SYMMETRIC_ENCRYPTION' | 'ML_KEM_768' | 'ML_KEM_1024' | 'KEM_XWING' | 'PQ_SIGN_ML_DSA_44' | 'PQ_SIGN_ML_DSA_65' | 'PQ_SIGN_ML_DSA_87' | 'PQ_SIGN_SLH_DSA_SHA2_128S' | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256' | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU' | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU' | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU' | 'AES_256_KWP' — Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
    - `destroyEventTime` string, google-datetime — Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.
    - `state` 'CRYPTO_KEY_VERSION_STATE_UNSPECIFIED' | 'PENDING_GENERATION' | 'ENABLED' | 'DISABLED' | 'DESTROYED' | 'DESTROY_SCHEDULED' | 'PENDING_IMPORT' | 'IMPORT_FAILED' | 'GENERATION_FAILED' | 'PENDING_EXTERNAL_DESTRUCTION' | 'EXTERNAL_DESTRUCTION_FAILED' — The current state of the CryptoKeyVersion.
    - `trustedWrappingEnabled` boolean — Immutable. Field indicating that the key may be wrapped by a trusted key. This field can be set for all key purposes except ENCRYPT_DECRYPT, and is only valid for keys with protection level HSM_SINGLE_TENANT. This field can only be set at creation or import time via CreateCryptoKeyVersion, or ImportCryptoKeyVersion.
    - `importJob` string — Output only. The name of the ImportJob used in the most recent import of this CryptoKeyVersion. Only present if the underlying key material was imported.
    - `createTime` string, google-datetime — Output only. The time at which this CryptoKeyVersion was created.
    - `externalDestructionFailureReason` string — Output only. The root cause of the most recent external destruction failure. Only present if state is EXTERNAL_DESTRUCTION_FAILED.
    - `generateTime` string, google-datetime — Output only. The time this CryptoKeyVersion's key material was generated.
    - `importTime` string, google-datetime — Output only. The time at which this CryptoKeyVersion's key material was most recently imported.
    - `protectionLevel` 'PROTECTION_LEVEL_UNSPECIFIED' | 'SOFTWARE' | 'HSM' | 'EXTERNAL' | 'EXTERNAL_VPC' | 'HSM_SINGLE_TENANT' — Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.
    - `externalProtectionLevelOptions` ExternalProtectionLevelOptions — ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
      - `externalKeyUri` string — Optional. The URI for an external resource that this CryptoKeyVersion represents.
      - `ekmConnectionKeyPath` string — Optional. The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection.
      - `ekmConnectionBackendOverride` string — Optional. The resource name of the backend environment where the key material of CryptoKeyVersions is associated with. Setting this field overrides the CryptoKeyBackend. This field may be set when CryptoKeyVersions is set to EXTERNAL_VPC. Format: `projects/*/locations/*/ekmConnections/*`.
    - `importFailureReason` string — Output only. The root cause of the most recent import failure. Only present if state is IMPORT_FAILED.
    - `reimportEligible` boolean — Output only. Whether or not this key version is eligible for reimport, by being specified as a target in ImportCryptoKeyVersionRequest.crypto_key_version.
    - `hsmTrusted` boolean — Output only. Field indicating that the key wrapping key is trusted. This field is only valid for key purpose AES_256_WRAPPING, and protection level HSM_SINGLE_TENANT.
  - `purpose` 'CRYPTO_KEY_PURPOSE_UNSPECIFIED' | 'ENCRYPT_DECRYPT' | 'ASYMMETRIC_SIGN' | 'ASYMMETRIC_DECRYPT' | 'RAW_ENCRYPT_DECRYPT' | 'MAC' | 'KEY_ENCAPSULATION' | 'AES_WRAPPING' — Immutable. The immutable purpose of this CryptoKey.
  - `destroyScheduledDuration` string, google-duration — Immutable. The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED. If not specified at creation time, the default duration is 30 days.
  - `createTime` string, google-datetime — Output only. The time at which this CryptoKey was created.
  - `nextRotationTime` string, google-datetime — At next_rotation_time, the Key Management Service will automatically: 1. Create a new version of this CryptoKey. 2. Mark the new version as primary. Key rotations performed manually via CreateCryptoKeyVersion and UpdateCryptoKeyPrimaryVersion do not affect next_rotation_time. Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/cloudkms.md) · [All operations](https://skmtc.net/google/apis/cloudkms/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/cloudkms/versions/576b283e53dd/schema)