---
title: "Create or replace a CMEK"
method: PUT
path: "/v1/cmeks/{cmekId}"
tags: ["CMEK"]
---

# Create or replace a CMEK

`PUT /v1/cmeks/{cmekId}`

Create or replace a customer managed encryption key.

## Request body

- object
  - `key_arn` string, required — The Amazon Resource Name (ARN) of the Key Management Service (KMS) key to use for encryption and decryption. We recommend using one multi-region key (MRK) per Konnect region to enhance security and compliance, while also supporting failover to other AWS regions.
  - `name` string, required — The name of the CMEK. We recommend you match the key's name used in KMS.
  - `description` string — An optional description of the CMEK.

## Response `200`

A CMEK

- CMEK
  - `id` string, required
  - `key_arn` string, required — The Amazon Resource Name (ARN) of the Key Management Service (KMS) key to use for encryption and decryption. We recommend using one multi-region key (MRK) per Konnect region to enhance security and compliance, while also supporting failover to other AWS regions.
  - `name` string, required — The name of the CMEK. We recommend you match the key's name used in KMS.
  - `description` string — An optional description of the CMEK.
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

## Changes

- **2025-10-29** `19e869275e28` — 1 warning
  - added the new `type` enum value to the `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
- **2025-08-22** `96118a9cd7f4` — 9 breaking
  - the response property `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterChoiceItem]/source` became nullable for the status `400`
  - the response property `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterDependentItem]/source` became nullable for the status `400`
  - the response property `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterMaximumLength]/source` became nullable for the status `400`
  - the response property `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterMinimumLength]/source` became nullable for the status `400`
  - …5 more
- **2025-08-12** `9ca62eba4eca` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/kong/apis/konnect-api/changes/v1/cmeks/:cmekId/put.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kong/konnect-api/revisions/72502a676a92/schema)