- [Resource: CseIdentity](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#CseIdentity)
  - [JSON representation](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#CseIdentity.SCHEMA_REPRESENTATION)
- [SignAndEncryptKeyPairs](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#SignAndEncryptKeyPairs)
  - [JSON representation](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#SignAndEncryptKeyPairs.SCHEMA_REPRESENTATION)
- [Methods](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#METHODS_SUMMARY)

## Resource: CseIdentity

The client-side encryption (CSE) configuration for the email address of an authenticated user. Gmail uses CSE configurations to save drafts of client-side encrypted email messages, and to sign and send encrypted email messages.

For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope.

For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.

| JSON representation |
|---|
| ``` { "emailAddress": string, "primaryKeyPairId": string, "signAndEncryptKeyPairs": { object (`https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#SignAndEncryptKeyPairs`) } } ``` |

| Fields ||
|---|---|
| `emailAddress` | `string` The email address for the sending identity. The email address must be the primary email address of the authenticated user. |
| Union field `key_pair_configuration`. `key_pair_configuration` can be only one of the following: ||
| `primaryKeyPairId` | `string` If a key pair is associated, the ID of the key pair, `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs#CseKeyPair`. |
| `signAndEncryptKeyPairs` | ``object (`https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#SignAndEncryptKeyPairs`)`` The configuration of a CSE identity that uses different key pairs for signing and encryption. |

## SignAndEncryptKeyPairs

The configuration of a CSE identity that uses different key pairs for signing and encryption.

| JSON representation |
|---|
| ``` { "signingKeyPairId": string, "encryptionKeyPairId": string } ``` |

| Fields ||
|---|---|
| `signingKeyPairId` | `string` The ID of the `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs#CseKeyPair` that signs outgoing mail. |
| `encryptionKeyPairId` | `string` The ID of the `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs#CseKeyPair` that encrypts signed outgoing mail. |

| ## Methods ||
|---|---|
| ### `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/create` | Creates and configures a client-side encryption identity that's authorized to send mail from the user account. |
| ### `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/delete` | Deletes a client-side encryption identity. |
| ### `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/get` | Retrieves a client-side encryption identity configuration. |
| ### `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/list` | Lists the client-side encrypted identities for an authenticated user. |
| ### `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/patch` | Associates a different key pair with an existing client-side encryption identity. |