---
title: "Create or replace a CMEK"
method: PUT
path: "/v1/cmeks/{cmekId}"
tags: ["CMEK"]
---

# Create or replace a CMEK

`PUT /v1/cmeks/{cmekId}`

Create or replace a customer managed encryption key.

## Request body

- object
  - `key_arn` string, required — The Amazon Resource Name (ARN) of the Key Management Service (KMS) key to use for encryption and decryption. We recommend using one multi-region key (MRK) per Konnect region to enhance security and compliance, while also supporting failover to other AWS regions.
  - `name` string, required — The name of the CMEK. We recommend you match the key's name used in KMS.
  - `description` string — An optional description of the CMEK.

## Response `200`

A CMEK

- CMEK
  - `id` string, required
  - `key_arn` string, required — The Amazon Resource Name (ARN) of the Key Management Service (KMS) key to use for encryption and decryption. We recommend using one multi-region key (MRK) per Konnect region to enhance security and compliance, while also supporting failover to other AWS regions.
  - `name` string, required — The name of the CMEK. We recommend you match the key's name used in KMS.
  - `description` string — An optional description of the CMEK.
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/kong/apis/konnect-api.md) · [All operations](https://skmtc.net/kong/apis/konnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api/revisions/06734a9c491f/schema)