---
title: "Enable CMEK on a vault"
method: POST
path: "/v1/vaults/{vault_id}/cmek"
tags: ["CMEK"]
---

# Enable CMEK on a vault

`POST /v1/vaults/{vault_id}/cmek`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/vaults/{vault_id}/cmek`
- Auth: HTTP bearer

Enable client-side encryption on a vault. Requires Business or Enterprise plan.
Only the key's SHA-256 fingerprint is stored — the key never touches the server.

Refused with 400 on the signing-key vaults (`__agent-keys`,
`__treasury-keys`): the server signs with the keys they hold, and a key it
cannot open without the customer would break every signature.

## Path parameters

- `vault_id` string, uuid, required

## Request body

- EnableCmekRequest
  - `fingerprint` string, required: SHA-256 hex fingerprint of the CMEK key (64 chars)

## Response `200`

CMEK enabled

- VaultResponse
  - `id` string, uuid, required
  - `name` string, required
  - `description` string
  - `created_by` string
  - `created_by_type` string
  - `created_at` string, date-time, required
  - `cmek_enabled` boolean: Whether client-managed encryption is enabled
  - `cmek_fingerprint` string: SHA-256 fingerprint of the CMEK key (64 hex chars)
  - `mpc_custody` string: MPC custody mode (e.g. "2-of-2", "2-of-3"), absent when MPC is not enabled
  - `mpc_threshold` integer: Number of shares required to reconstruct the key
  - `mpc_providers` string[]: List of MPC share providers (e.g. ["server", "client"])

## Other responses

- `400`: Invalid request
- `403`: Insufficient permissions

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)