---
title: "POST /v1/{+parent}/singleTenantHsmInstances"
method: POST
path: "/v1/{+parent}/singleTenantHsmInstances"
tags: ["projects"]
---

# POST /v1/{+parent}/singleTenantHsmInstances

`POST /v1/{+parent}/singleTenantHsmInstances`

Creates a new SingleTenantHsmInstance in a given Project and Location. User must create a RegisterTwoFactorAuthKeys proposal with this single-tenant HSM instance to finish setup of the instance.

## Path parameters

- `parent` string, required

## Query parameters

- `singleTenantHsmInstanceId` string

## Request body

- SingleTenantHsmInstance — A SingleTenantHsmInstance represents a single-tenant HSM instance. It can be used for creating CryptoKeys with a ProtectionLevel of HSM_SINGLE_TENANT, as well as performing cryptographic operations using keys created within the SingleTenantHsmInstance.
  - `unrefreshedDurationUntilDisable` string, google-duration — Output only. The system-defined duration that an instance can remain unrefreshed until it is automatically disabled. This will have a value of 730 days.
  - `createTime` string, google-datetime — Output only. The time at which the SingleTenantHsmInstance was created.
  - `name` string — Identifier. The resource name for this SingleTenantHsmInstance in the format `projects/*/locations/*/singleTenantHsmInstances/*`.
  - `quorumAuth` QuorumAuth — Configuration for M of N quorum auth.
    - `requiredApproverCount` integer — Output only. The required numbers of approvers. The M value used for M of N quorum auth. Must be greater than or equal to 2 and less than or equal to total_approver_count - 1.
    - `twoFactorPublicKeyPems` string[] — Output only. The public keys associated with the 2FA keys for M of N quorum auth.
    - `totalApproverCount` integer — Required. The total number of approvers. This is the N value used for M of N quorum auth. Must be greater than or equal to 3 and less than or equal to 16.
  - `disableTime` string, google-datetime — Output only. The time at which the instance will be automatically disabled if not refreshed. This field is updated upon creation and after each successful refresh operation and enable. A RefreshSingleTenantHsmInstance operation must be made via a SingleTenantHsmInstanceProposal before this time otherwise the SingleTenantHsmInstance will become disabled.
  - `deleteTime` string, google-datetime — Output only. The time at which the SingleTenantHsmInstance was deleted.
  - `state` 'STATE_UNSPECIFIED' | 'CREATING' | 'PENDING_TWO_FACTOR_AUTH_REGISTRATION' | 'ACTIVE' | 'DISABLING' | 'DISABLED' | 'DELETING' | 'DELETED' | 'FAILED' — Output only. The state of the SingleTenantHsmInstance.
  - `keyPortabilityEnabled` boolean — Optional. Immutable. Indicates whether key portability is enabled for the SingleTenantHsmInstance. This can only be set at creation time. Key portability features are disabled by default and not yet available in GA.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/cloudkms.md) · [All operations](https://skmtc.net/google/apis/cloudkms/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/cloudkms/versions/576b283e53dd/schema)