- [HTTP request](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#body.HTTP_TEMPLATE)
- [Path parameters](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#body.PATH_PARAMETERS)
- [Request body](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#body.request_body)
  - [JSON representation](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#body.request_body.SCHEMA_REPRESENTATION)
- [Response body](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#body.response_body)
  - [JSON representation](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#body.EnrollAppResponse.SCHEMA_REPRESENTATION)
- [Authorization scopes](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#body.aspect)
- [EnrollNewApp](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#EnrollNewApp)
  - [JSON representation](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#EnrollNewApp.SCHEMA_REPRESENTATION)
- [EnrollExistingApp](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#EnrollExistingApp)
  - [JSON representation](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#EnrollExistingApp.SCHEMA_REPRESENTATION)
- [Try it!](https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#try-it)

Enrolls an app in Play App Signing using a self-hosted Google Cloud KMS key.

Warning: Do not use this method for standard Play App Signing enrollment.

- Standard enrollment with Google-generated or Google-managed keys cannot be done via API.
- This advanced API is strictly for enterprise organizations with mandatory compliance, regulatory, or policy requirements to retain key custody in an external Google Cloud KMS instance.
- Prerequisites: Requires an active, properly configured Google Cloud KMS key with appropriate IAM permissions granted to Google Play before calling this method.

See Help Center: <https://support.google.com/googleplay/android-developer/answer/9842756>

### HTTP request

`POST https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{name}/appSigning:enrollApp`

The URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.

### Path parameters

| Parameters ||
|---|---|
| `name` | `string` Required. Either package name or app ID of the app enrolling in Play Signing. |

### Request body

The request body contains data with the following structure:

| JSON representation |
|---|
| ``` { "pemUploadCertificate": string, // Union field `enrollment` can be only one of the following: "enrollNewApp": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#EnrollNewApp`) }, "enrollExistingApp": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#EnrollExistingApp`) } // End of list of possible types for union field `enrollment`. } ``` |

| Fields ||
|---|---|
| `pemUploadCertificate` | `string (https://developers.google.com/discovery/v1/type-format format)` The certificate associated with the upload key, in PEM format. A base64-encoded string. |
| Union field `enrollment`. The type of self-hosted enrollment. Requires an active Google Cloud KMS key with appropriate IAM permissions granted to Google Play. `enrollment` can be only one of the following: ||
| `enrollNewApp` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#EnrollNewApp`)`` Changes the signing key of a new app to an external Cloud KMS key. The app must not have published to Open testing or Production tracks. |
| `enrollExistingApp` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/appsigning/enrollApp#EnrollExistingApp`)`` Enrolls an existing app into Play signing using an external Cloud KMS key. |

### Response body

Response to enroll an app into Play signing.

If successful, the response body contains data with the following structure:

| JSON representation |
|---|
| ``` { "signingCertificate": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CertificateHashes`) }, "uploadCertificate": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CertificateHashes`) } } ``` |

| Fields ||
|---|---|
| `signingCertificate` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CertificateHashes`)`` The signing certificate hashes for the app. Always set. |
| `uploadCertificate` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CertificateHashes`)`` The upload certificate hashes for the app. Set iff pemUploadCertificate was set in the request. |

### Authorization scopes

Requires the following OAuth scope:

- `https://www.googleapis.com/auth/androidpublisher`

## EnrollNewApp

Enroll a new app into Play signing.

| JSON representation |
|---|
| ``` { "cloudKmsKeyAndCert": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CloudKmsKeyAndCert`) } } ``` |

| Fields ||
|---|---|
| `cloudKmsKeyAndCert` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CloudKmsKeyAndCert`)`` Required. Self-hosted key. Once enrolled, this key will be used to sign your app. |

## EnrollExistingApp

Enroll an existing app into Play signing.

| JSON representation |
|---|
| ``` { "cloudKmsKey": { object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CloudKmsKey`) } } ``` |

| Fields ||
|---|---|
| `cloudKmsKey` | ``object (`https://developers.google.com/android-publisher/api-ref/rest/v3/CloudKmsKey`)`` Required. Self-hosted key. Once enrolled, this key will be used to sign your app. |