- [HTTP request](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#body.HTTP_TEMPLATE)
- [Path parameters](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#body.PATH_PARAMETERS)
- [Query parameters](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#body.QUERY_PARAMETERS)
- [Request body](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#body.request_body)
- [Response body](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#body.response_body)
- [Authorization scopes](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#body.aspect)
- [ChainValidation](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#ChainValidation)
- [Try it!](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#try-it)

Creates and uploads a client-side encryption S/MIME public key certificate chain and private key metadata for the authenticated user.

For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope.

For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.

### HTTP request

`POST https://gmail.googleapis.com/gmail/v1/users/{userId}/settings/cse/keypairs`

The URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.

### Path parameters

| Parameters ||
|---|---|
| `userId` | `string` The requester's primary email address. To indicate the authenticated user, you can use the special value `me`. |

### Query parameters

| Parameters ||
|---|---|
| `chainValidation` | ``enum (`https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs/create#ChainValidation`)`` The type of certificate chain validation to perform at creation. The request will be rejected if the uploaded chain fails to satisfy the requested validation checks. When unspecified, this parameter defaults to `all`. |

### Request body

The request body contains an instance of `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs#CseKeyPair`.

### Response body

If successful, the response body contains a newly created instance of `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.keypairs#CseKeyPair`.

### Authorization scopes

Requires one of the following OAuth scopes:

- `https://www.googleapis.com/auth/gmail.settings.basic`
- `
  https://www.googleapis.com/auth/gmail.settings.sharing`

For more information, see the [Authorization guide](https://developers.google.com/workspace/guides/configure-oauth-consent).

## ChainValidation

The type of certificate chain validation to perform at key pair creation.

| Enums ||
|---|---|
| `all` | Enable all certificate chain validation and certificate revocation checks. Recommended for normal use. |
| `none` | Disable all certificate chain validation and certificate revocation checks. This may be useful when deliberately creating key pairs with invalid, out-of-use certificate chains to be used only for decryption of historical S/MIME messages. Key pairs created with invalid or revoked certificates cannot be used in a CseIdentity object. |