Google: Turns off a client-side encryption key pair The authenticated user can no longer use the key pair to decrypt incoming CSE message texts or sign outgoing CSE mail To regain access, use the Enable Cse Key Pair to turn on the key pair After 30 days, you can permanently delete the key pair by using the Obliterate Cse Key Pair method For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body
Turns off a client-side encryption key pair. The authenticated user can no longer use the key pair to decrypt incoming CSE message texts or sign outgoing CSE mail. To regain access, use the EnableCseKeyPair to turn on the key pair. After 30 days, you can permanently delete the key pair by using the ObliterateCseKeyPair method. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.: request body, field body. Complete fields and constraints for contract 2026-10-27.
API reference · Contract 2026-10-27
SDK schema: Turns off a client-side encryption key pair The authenticated user can no longer use the key pair to decrypt incoming CSE message texts or sign outgoing CSE mail To regain access, use the Enable Cse Key Pair to turn on the key pair After 30 days, you can permanently delete the key pair by using the Obliterate Cse Key Pair method For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Requests to turn off a client-side encryption key pair. |