---
title: "Create KMS Key"
method: POST
path: "/kms-key"
tags: ["kms-key"]
---

# Create KMS Key

`POST /kms-key`

## Request

- Base URL: `https://api-ch-gva-2.exoscale.com/v2`
- URL: `https://api-ch-gva-2.exoscale.com/v2/kms-key`
- Auth: none declared
- TypeScript: <https://skmtc.dev/exoscale/apis/exoscale-api/docs/kms-key/post.ts> (a function with typed inputs; its response is checked against the schema)

Create a customer-managed unique KMS Key in your organization. A KMS Key is a logical representation of a cryptographic key material. It also includes metadata such as a UUID, a name and its state.

## Request body

- CreateKmsKeyRequest
  - `name` string, required: A human-readable display name uniquely identifying the KMS key within the tenant space.
  - `description` string: An optional detailed description providing additional context about the key's intended use case.
  - `usage` 'encrypt-decrypt'
  - `multi-zone` boolean: True if this is a multi-zone key.

## Response `200`

Created new KMS key

- CreateKmsKeyResponse
  - `description` string: An optional detailed description providing additional context about the key's intended use case.
  - `revision` RevisionStamp, required
    - `at` string, date-time, required: The timestamp recording exactly when this specific revision iteration occurred.
    - `seq` integer, required: Monotonically increasing sequencing value utilized for optimistic concurrency control locks.
  - `name` string, required: The display name assigned to the KMS key.
  - `multi-zone` boolean, required: True if this is a multi-zone key.
  - `source` 'exoscale-kms', required
  - `usage` string, required: The cryptographic operation constraints allowed on this key.
  - `status` 'enabled' | 'disabled' | 'pending-deletion', required
  - `status-since` string, date-time, required: The timestamp indicating exactly when the current key status was last transitioned.
  - `id` string, uuid, required: The globally unique identifier (UUID) assigned to the newly created KMS key.
  - `origin-zone` string, required: The creation zone of the KMS key.
  - `created-at` string, date-time, required: The UTC timestamp showing when the KMS key was originally provisioned.

## Other responses

- `400`: ### Errors Name Conflict: The request was rejected because a key with the same name already exists in the target zone. Bad Request: The request was rejected because of an invalid request body or path parameter.

## Changes

- **2026-11-06** `63da6f74c845`: 2 breaking, 2 warning, 6 info
  - the response property `description` became optional for the status `200`
  - removed the required property `policy` from the response with the `200` status
  - removed the optional property `errors` from the response with the `400` status
  - removed the optional property `instance` from the response with the `400` status
  - …6 more
- **2026-03-16** `e05707a7b346`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/exoscale/apis/exoscale-api/changes/kms-key/post.md)

---

[API](https://skmtc.dev/exoscale/apis/exoscale-api.md) - [All operations](https://skmtc.dev/exoscale/apis/exoscale-api/llms.txt) - [OpenAPI document](https://skmtc.dev/exoscale/apis/exoscale-api/revisions/63da6f74c845?raw)