Skip to main content
POST
Create a configuration

Authorizations

X-Qanapi-Authorization
string
header
required

A machine credential, qk_ followed by its secret. Only a hash of the secret is stored, so a key is displayed exactly once, when it is created or rotated. A key reaches only the configurations it is linked to.

It may also be sent as Authorization: Bearer qk_..., which is recognised by the prefix.

Body

application/json
name
string
required

Trimmed, and may not be empty once trimmed. Unique.

Minimum string length: 1
proxy_slug
string

Optional, and unique. One is generated at random when omitted, which is the recommended case. A supplied value is lowercased, with anything other than a letter or digit becoming a hyphen.

Response

The new configuration.

id
string<uuid>
required
name
string
required
proxy_slug
string
required

Appears in the URL of every encryption call, and is how policy statements name this configuration.

algorithm
string
required

Fixed at creation and not changeable.

Allowed value: "aes-256-gcm"
mek_provider
string
required

Where the master key lives. local_aek keeps it in the database sealed under the application key; other providers hand custody to an HSM or a cloud KMS.

Example:

"local_aek"

mek_reference
string | null
required

An HSM handle or key ARN, for providers that use one.

created_at
string<date-time>
required
updated_at
string<date-time>
required