> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trysoma.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create data key

> Create a new data encryption key (DEK) encrypted with the specified envelope encryption key



## OpenAPI

````yaml api-reference/openapi.json post /api/encryption/v1/envelope/{envelope_id}/dek
openapi: 3.1.0
info:
  title: soma
  version: v1
servers: []
security: []
tags:
  - name: task
    description: >-
      Task management endpoints for creating, listing, and managing tasks and
      their messages
  - name: secret
    description: Secret management endpoints for storing and retrieving encrypted secrets
  - name: encryption
    description: >-
      Encryption key management endpoints for envelope keys, data encryption
      keys, and aliases
  - name: bridge
    description: >-
      Bridge endpoints for managing providers, credentials, functions, and MCP
      protocol communication
  - name: _internal
    description: >-
      Internal endpoints for health checks, runtime configuration, and SDK code
      generation
  - name: a2a
    description: >-
      Agent-to-agent communication endpoints for agent cards, definitions, and
      JSON-RPC requests
  - name: v1
    description: API version v1 endpoints
paths:
  /api/encryption/v1/envelope/{envelope_id}/dek:
    post:
      tags:
        - encryption
        - v1
      summary: Create data key
      description: >-
        Create a new data encryption key (DEK) encrypted with the specified
        envelope encryption key
      operationId: create-data-encryption-key
      parameters:
        - name: envelope_id
          in: path
          description: Envelope encryption key ID
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateDataEncryptionKeyParamsRoute'
        required: true
      responses:
        '200':
          description: Create data encryption key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataEncryptionKey'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '502':
          description: Bad Gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    CreateDataEncryptionKeyParamsRoute:
      type: object
      properties:
        encrypted_dek:
          type:
            - string
            - 'null'
        id:
          type:
            - string
            - 'null'
    DataEncryptionKey:
      type: object
      required:
        - id
        - envelope_encryption_key_id
        - encrypted_data_encryption_key
        - created_at
        - updated_at
      properties:
        created_at:
          $ref: '#/components/schemas/WrappedChronoDateTime'
        encrypted_data_encryption_key:
          $ref: '#/components/schemas/EncryptedDataEncryptionKey'
        envelope_encryption_key_id:
          $ref: '#/components/schemas/EnvelopeEncryptionKey'
        id:
          type: string
        updated_at:
          $ref: '#/components/schemas/WrappedChronoDateTime'
    Error:
      type: object
      required:
        - message
      properties:
        data: {}
        message:
          type: string
    WrappedChronoDateTime:
      type: string
      format: date-time
    EncryptedDataEncryptionKey:
      type: string
    EnvelopeEncryptionKey:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/EnvelopeEncryptionKeyAwsKms'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - aws_kms
        - allOf:
            - $ref: '#/components/schemas/EnvelopeEncryptionKeyLocal'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - local
    EnvelopeEncryptionKeyAwsKms:
      type: object
      required:
        - arn
        - region
      properties:
        arn:
          type: string
        region:
          type: string
    EnvelopeEncryptionKeyLocal:
      type: object
      required:
        - file_name
      properties:
        file_name:
          type: string

````