---
title: "KMS Config Create"
method: POST
path: "/1/kms/configs"
tags: ["KMS Configuration"]
---

# KMS Config Create

`POST /1/kms/configs`

## Request

- Base URL: `http://localhost:3000/api`
- URL: `http://localhost:3000/api/1/kms/configs`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/docs/1/kms/configs/post.ts> (a function with typed inputs; its response is checked against the schema)

Create a new KMS configuration. This configuration will not be assigned to any tenants.

## Headers

- `icl-requestor-id` string, required

## Request body

- object
  - `config` union, required: KMS configuration
    - AwsKmsConfig: AWS configuration
      - `credentials` AwsCredentialsV1, required: AWS credentials
        - `accessKeyId` string, required: AWS Accesss Key ID
        - `secretAccessKey` string, required: AWS Secret Access Key
      - `keyPath` object, required: AWS keypath
        - `keyID` string, required: AWS Key ID
        - `region` string, required: AWS Region
      - `type` 'AWS', required: KMS type: AWS
      - `version` integer, required: Config version
    - AzureKmsConfig: Azure configuration
      - `credentials` AzureCredentialsV1, required: Azure credentials
        - `clientId` string, required: Azure Client ID
        - `clientSecret` string, required: Azure Client Secret
        - `tenantGuid` string, required: Azure Tenant GUID
      - `keyPath` object, required: Azure keypath
        - `keyName` string, required: Azure Key Name
        - `vaultBaseUrl` string, required: Azure Vault Base URL
      - `type` 'AZURE', required: KMS type: Azure
      - `version` integer, required: Config version
    - GcpKmsConfig: GCP configuration
      - `credentials` GcpCredentialsV1, required: GCP credentials
        - `client_email` string, required: GCP client email
        - `private_key` string, required: GCP private key
      - `keyPath` object, required: GCP keypath
        - `cryptoKeyId` string, required: GCP crypto key ID
        - `keyRingId` string, required: GCP key ring ID
        - `locationId` string, required: GCP location ID
        - `projectId` string, required: GCP project ID
      - `type` 'GCP', required: KMS type: GCP
      - `version` integer, required: Config version
    - ThalesKmsConfig: Thales configuration
      - `credentials` ThalesCredentialsV1, required: Thales credentials
        - `authDomain` string, required: Thales auth domain. May default to root
        - `connection` string, required: Thales connection. May default to local_account
        - `username` string, required: Thales username
        - `password` string, required: Thales password
      - `keyPath` object, required: Thales key path. Cannot be changed later
        - `keyId` string, required: Thales key ID
        - `serviceUrl` string, required: Thales service URL
      - `type` 'THALES', required: KMS type: THALES
      - `version` integer, required: Config version
  - `leasingAllowed` boolean: Optional value indicating whether KMS config leasing should be enabled for the new configuration. If undefined, defaults to false.

## Response `200`

Result of creating a KMS configuration

- object
  - `id` integer, required: KMS configuration ID
  - `encryptedConfig` string, required: Base 64 string
  - `kmsType` 'AZURE' | 'AWS' | 'GCP', required: KMS type: AWS, Azure, or GCP
  - `version` integer, required: Config version
  - `createdBy` CreatedBy, required: Metadata about creating user/service
    - `id` string, required: Creator ID
    - `name` string, required: Creator name
    - `type` 'Tsp' | 'Admin' | 'Va', required: Creator type
  - `leasingAllowed` boolean, required: Is key leasing enabled?
  - `assignmentCount` integer, required: Number of consumers of this configuration
  - `secretCount` integer, required: Number of active secrets associated with this configuration
  - `created` string, required: RFC3339 timestamp
  - `updated` string, required: RFC3339 timestamp

## Other responses

- `401`: Unauthorized

---

[API](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge.md) - [All operations](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/llms.txt) - [OpenAPI document](https://skmtc.dev/ironcorelabs/apis/vendor-api-bridge/revisions/5c0e553ffa21?raw)