Create encryption configuration

Creates an inactive configuration after validating KMS access. GCP cross-project creation defers that check and returns a generated service-account email: grant it KMS access before activation. Requires customer-managed keys to be enabled.

Required permission

Account > Admin > Encryption > Create

Request body

{object}

name
string required
min length
3
max length
100
pattern
^[a-zA-Z0-9]+((-|\s)[a-zA-Z0-9]+)*$
description
string
max length
200
pattern
^[a-zA-Z0-9.,?\s\\/'"()[\];`%^&*\-_:!]+$
envelope
(multiple options: anyOf) required

{object}

provider
required
one of
gcp
projectId
string required
pattern
^[a-z][a-z0-9-]{4,28}[a-z0-9]$
location
string required
max length
63
pattern
^[a-z0-9-]+$
keyRing
string required
max length
63
pattern
^[A-Za-z0-9_-]+$
cryptoKey
string required
max length
63
pattern
^[A-Za-z0-9_-]+$
credentials
{object}

keyfileJson
string

options
{object}

maxUses
integer
min
1
maxAgeMs
integer
min
1
cacheTtlSeconds
integer
min
1

{object}

provider
required
one of
aws
region
string required
keyId
string required
credentials
{object} required

accessKey
string
secretKey
string
roleArn
string
externalId
string

options
{object}

maxUses
integer
min
1
maxAgeMs
integer
min
1
cacheTtlSeconds
integer
min
1

{object}

provider
required
one of
azure
keyId
string required
max length
2048
pattern
^[^?#@\s\\%]+$
credentials
{object} required

tenantId
string required
clientId
string required
secret
string required

options
{object}

maxUses
integer
min
1
maxAgeMs
integer
min
1
cacheTtlSeconds
integer
min
1

{object}

provider
required
one of
vault-transit
address
string required
max length
2048
pattern
^[^?#@\s\\%]+$
mountPath
string
max length
256
pattern
^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$
namespace
string
max length
256
pattern
^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$
keyName
string required
max length
256
pattern
^(?!\.+$)[A-Za-z0-9_.-]+$
credentials
{object} required

token
string required
max length
4096

options
{object}

maxUses
integer
min
1
maxAgeMs
integer
min
1
cacheTtlSeconds
integer
min
1

Response body

{object}
Response object.

data
{object} required
Result data.

id
string required
The name-derived ID of the encryption configuration.
name
string required
description
string
createdAt
string required
active
boolean required
firstActivatedAt
string
Time of first activation; absent for unused configurations.
envelope
(multiple options: anyOf)

{object}

provider
string required
one of
aws
region
string required
keyId
string required
externalId
string
External ID used for cross-account role assumption.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
gcp
projectId
string required
location
string required
keyRing
string required
cryptoKey
string required
serviceAccountEmail
string
Northflank-generated identity to grant access to the KMS key.
keyfileServiceAccountEmail
string
Service-account email from the supplied key file.
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
azure
keyId
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

{object}

provider
string required
one of
vault-transit
address
string required
mountPath
string
namespace
string
keyName
string required
options
{object}
Data-key rotation and cache overrides, subject to platform-configured bounds.

maxUses
integer
Maximum encryption uses per data key.
min
1
maxAgeMs
integer
Maximum data-key lifetime in milliseconds.
min
1
cacheTtlSeconds
integer
Decrypted data-key cache TTL in seconds.
min
1

vault
{object}
Legacy Vault configuration.

version
string required

API

CLI

JS Client

POST /v1/encryption/configurations

POST /v1/teams/{teamId}/encryption/configurations

Example request

Request body

curl --header "Content-Type: application/json" \
  --header "Authorization: Bearer NORTHFLANK_API_TOKEN" \
  --request POST \
  --data '{"name":"string","envelope":{"provider":"gcp","projectId":"string","location":"string","keyRing":"string","cryptoKey":"string"}}' \
  https://api.northflank.com/v1/encryption/configurations

Example response

200 OK

Created configuration without credentials.

JSON

{
  "data": {
    "id": "production-kms"
  }
}

Example response

400 Bad Request

Invalid configuration or failed KMS check.

Example response

409 Conflict

An encryption configuration with this name already exists.