Creating a Key

Function

This API is used to create a symmetric or asymmetric CMK.

A symmetric key is a 256-bit AES key or a 128-bit SM4 key. It can be used to encrypt a small amount of data or DEKs.

An asymmetric key is a RSA key or an ECC key pair (including SM2 key pair). It can be used for data encryption and decryption, digital signature, and signature verification.

Constraints

The alias of the default CMK automatically created by the service ends with /default. To avoid a conflict with the default CMK's alias, do not create a CMK whose alias also ends with /default. If you have created an enterprise project, the default CMKs can only be stored in the enterprise project. Enterprise resources cannot be moved around. Default CMKs can be used for cloud encryption in non-default enterprise projects to meet compliance requirements. If you need to manage enterprise resources, create a key and use it.

Calling Method

For details, see Calling APIs.

URI

POST /v1.0/{project_id}/kms/create-key

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID. For details, see Obtaining a Project ID. Constraints N/A Range The value returned by the IAM API is used, which contains 32 characters. Default Value N/A

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. It can be obtained by calling the IAM API. The value of X-Subject-Token in the response header is the user token. Constraints N/A Range Obtain the value by calling the IAM API for obtaining the user token. Default Value N/A

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
key_alias	Yes	String	Definition Non-default CMK alias Constraints The value must match the regular expression ^[a-zA-Z0-9:/_-]{1,255}$ and be different from the alias of the KMS default CMK. Range 1 to 255 characters Default Value N/A
key_spec	No	String	Definition Key generation algorithm Constraints N/A Range AES_256 SM4 RSA_2048 RSA_3072 RSA_4096 EC_P256 EC_P384 ED25519 SECP256K1 SM2 HMAC_256 HMAC_384 HMAC_512 HMAC_SM3 Default Value AES_256
key_usage	No	String	Definition Key usage Constraints N/A Range ENCRYPT_DECRYPT: encryption and decryption SIGN_VERIFY: signature and verification Default Value For symmetric keys, the default value is ENCRYPT_DECRYPT. For asymmetric keys, the default value is SIGN_VERIFY.
key_description	No	String	Key description. It can contain 0 to 255 characters.
origin	No	String	Definition Key source. The default value is kms. Constraints N/A Range kms: The key material is generated by KMS. external: The key material is imported. Default Value N/A
enterprise_project_id	No	String	Definition Enterprise multi-project ID Constraints If enterprise multi-project is not enabled, you do not need to set this parameter. If enterprise multi-project is enabled, you can set this field when creating resources. If this field is not specified, the default enterprise multi-project whose ID is 0 is created by default. If you do not have the permission to create resources under the default enterprise multi-project (ID: 0), an error will be reported. Range N/A Default Value N/A
sequence	No	String	Definition A 36-byte serial number of a request message, for example, 919c82d4-8046-4722-9094-35c3c6524cff. Constraints N/A Range N/A Default Value N/A
keystore_id	No	String	Definition Keystore ID. The default KMS keystore is used by default. Constraints N/A Range N/A Default Value N/A
vm_id	No	String	Definition ID of the VM created using the key Constraints This parameter is valid only in the level-4 cryptography test scenario. Range N/A Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
key_info	KeKInfo object	Key details

**Table 5** KeKInfo
Parameter	Type	Description
key_id	String	Definition Key ID ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$. Range N/A
domain_id	String	Definition User domain ID Range N/A

Example Requests

Create a key whose alias is test.

{
  "key_alias" : "test"
}

Example Responses

Status code: 200

Request succeeded.

{
  "key_info" : {
    "key_id" : "bb6a3d22-dc93-47ac-b5bd-88df7ad35f1e",
    "domain_id" : "b168fe00ff56492495a7d22974df2d0b"
  }
}

Status Codes

Status Code	Description
200	Request succeeded.

Error Codes

See Error Codes.

Parent Topic: Key Lifecycle Management

Previous topic: Key Lifecycle Management

Next topic: Enabling a Key