---
title: "POST /api/v1/kms/keys"
method: POST
path: "/api/v1/kms/keys"
tags: ["KMS Keys"]
---

# POST /api/v1/kms/keys

`POST /api/v1/kms/keys`

Create KMS key

## Request body

- object
  - `projectId` string, required — The ID of the project to create the key in.
  - `name` string, required — The name of the key to be created. Must be slug-friendly.
  - `description` string — An optional description of the key.
  - `keyUsage` 'encrypt-decrypt' | 'sign-verify' | 'generate-verify-mac' — The type of key to be created, either encrypt-decrypt or sign-verify, based on your intended use for the key.
  - `algorithm` 'aes-256-gcm' | 'aes-128-gcm' | 'RSA_4096' | 'ECC_NIST_P256' | 'ECC_NIST_P384' | 'ECC_NIST_P521' | 'ML_DSA_44' | 'ML_DSA_65' | 'ML_DSA_87' | 'HMAC_SHA_1' | 'HMAC_SHA_224' | 'HMAC_SHA_256' | 'HMAC_SHA_384' | 'HMAC_SHA_512' — The cryptographic algorithm of the key (e.g. aes-256-gcm, RSA_4096, HMAC_SHA_256).
  - `isExportable` boolean — Whether the raw key material can be exported after creation. When set to false, the key can never be exported regardless of permissions. This cannot be changed after creation.
  - `hasDeleteProtection` boolean — Prevents deletion of the key when enabled.

## Response `200`

Default Response

- object
  - `key` object, required
    - `id` string, uuid, required
    - `description` string, nullable
    - `isDisabled` boolean, nullable
    - `orgId` string, uuid, required
    - `name` string, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `projectId` string, nullable
    - `keyUsage` string
    - `kmipMetadata` unknown
    - `isExportable` boolean
    - `hasDeleteProtection` boolean
    - `version` number
    - `algorithm` string, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

## Changes

- **2026-08-25** `4243b6be5d38` — 2 info
  - added the new optional request property `hasDeleteProtection`
  - added the optional property `key/hasDeleteProtection` to the response with the `200` status
- **2026-07-21** `5dbb77aad0f5` — 1 breaking, 1 warning, 3 info
  - removed the required property `key/encryptionAlgorithm` from the response with the `200` status
  - removed the request property `encryptionAlgorithm`
  - added the new optional request property `algorithm`
  - added the new `generate-verify-mac` enum value to the request property `keyUsage`
  - …1 more

[Change history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/kms/keys/post.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) · [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/c339fd54e42e/schema)