---
title: "POST /v1/{+parent}/ekmConnections"
method: POST
path: "/v1/{+parent}/ekmConnections"
tags: ["projects"]
---

# POST /v1/{+parent}/ekmConnections

`POST /v1/{+parent}/ekmConnections`

Creates a new EkmConnection in a given Project and Location.

## Path parameters

- `parent` string, required

## Query parameters

- `ekmConnectionId` string

## Request body

- EkmConnection — An EkmConnection represents an individual EKM connection. It can be used for creating CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC, as well as performing cryptographic operations using keys created within the EkmConnection.
  - `serviceResolvers` ServiceResolver[] — Optional. A list of ServiceResolvers where the EKM can be reached. There should be one ServiceResolver per EKM replica. Currently, only a single ServiceResolver is supported.
    - `hostname` string — Required. The hostname of the EKM replica used at TLS and HTTP layers.
    - `serviceDirectoryService` string — Required. The resource name of the Service Directory service pointing to an EKM replica, in the format `projects/*/locations/*/namespaces/*/services/*`.
    - `endpointFilter` string — Optional. The filter applied to the endpoints of the resolved service. If no filter is specified, all endpoints will be considered. An endpoint will be chosen arbitrarily from the filtered list for each request. For endpoint filter syntax and examples, see https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
    - `serverCertificates` Certificate[] — Required. A list of leaf server certificates used to authenticate HTTPS connections to the EKM replica. Currently, a maximum of 10 Certificate is supported.
      - `parsed` boolean — Output only. True if the certificate was parsed successfully.
      - `subjectAlternativeDnsNames` string[] — Output only. The subject Alternative DNS names. Only present if parsed is true.
      - `serialNumber` string — Output only. The certificate serial number as a hex string. Only present if parsed is true.
      - `subject` string — Output only. The subject distinguished name in RFC 2253 format. Only present if parsed is true.
      - `issuer` string — Output only. The issuer distinguished name in RFC 2253 format. Only present if parsed is true.
      - `rawDer` string, byte — Required. The raw certificate bytes in DER format.
      - `notAfterTime` string, google-datetime — Output only. The certificate is not valid after this time. Only present if parsed is true.
      - `notBeforeTime` string, google-datetime — Output only. The certificate is not valid before this time. Only present if parsed is true.
      - `sha256Fingerprint` string — Output only. The SHA-256 certificate fingerprint as a hex string. Only present if parsed is true.
  - `etag` string — Optional. Etag of the currently stored EkmConnection.
  - `name` string — Output only. The resource name for the EkmConnection in the format `projects/*/locations/*/ekmConnections/*`.
  - `createTime` string, google-datetime — Output only. The time at which the EkmConnection was created.
  - `cryptoSpacePath` string — Optional. Identifies the EKM Crypto Space that this EkmConnection maps to. Note: This field is required if KeyManagementMode is CLOUD_KMS.
  - `keyManagementMode` 'KEY_MANAGEMENT_MODE_UNSPECIFIED' | 'MANUAL' | 'CLOUD_KMS' — Optional. Describes who can perform control plane operations on the EKM. If unset, this defaults to MANUAL.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/cloudkms.md) · [All operations](https://skmtc.net/google/apis/cloudkms/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/cloudkms/versions/576b283e53dd/schema)