---
title: "Get a CMEK"
method: GET
path: "/v1/cmeks/{cmekId}"
tags: ["CMEK"]
---

# Get a CMEK

`GET /v1/cmeks/{cmekId}`

Get a customer managed encryption key.

## Response `200`

A CMEK

- CMEK
  - `id` string, required
  - `key_arn` string, required — The Amazon Resource Name (ARN) of the Key Management Service (KMS) key to use for encryption and decryption. We recommend using one multi-region key (MRK) per Konnect region to enhance security and compliance, while also supporting failover to other AWS regions.
  - `name` string, required — The name of the CMEK. We recommend you match the key's name used in KMS.
  - `description` string — An optional description of the CMEK.
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/kong/apis/konnect-api.md) · [All operations](https://skmtc.net/kong/apis/konnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api/revisions/06734a9c491f/schema)