Google: Creates and uploads a client-side encryption S MIME public key certificate chain and private key metadata for the authenticated user For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body
Creates and uploads a client-side encryption S/MIME public key certificate chain and private key metadata for the authenticated user. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.: request body, field body. Complete fields and constraints for contract 2026-10-27.
API reference · Contract 2026-10-27
SDK schema: Creates and uploads a client-side encryption S MIME public key certificate chain and private key metadata for the authenticated user For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A client-side encryption S/MIME key pair, which is comprised of a public key, its certificate chain, and metadata for its paired private key. Gmail uses the key pair to complete the following tasks: - Sign outgoing client-side encrypted messages. - Save and reopen drafts of client-side encrypted messages. - Save and reopen sent messages. - Decrypt incoming or archived S/MIME messages. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured. |
disableTime | string | Optional | Output only. If a key pair is set to `DISABLED`, the time that the key pair’s state changed from `ENABLED` to `DISABLED`. This field is present only when the key pair is in state `DISABLED`. Format: google-datetime Read only: true |
enablementState | string | Optional | Output only. The current state of the key pair. One of: stateUnspecified, enabled, disabled Read only: true |
keyPairId | string | Optional | Output only. The immutable ID for the client-side encryption S/MIME key pair. Read only: true |
pem | string | Optional | Output only. The public key and its certificate chain, in [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) format. Read only: true |
pkcs7 | string | Optional | Input only. The public key and its certificate chain. The chain must be in [PKCS#7](https://en.wikipedia.org/wiki/PKCS_7) format and use PEM encoding and ASCII armor. |
privateKeyMetadata | array | Optional | Metadata for instances of this key pair’s private key. |
privateKeyMetadata[] | Model | Each item | Expand Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item |
subjectEmailAddresses | array | Optional | Output only. The email address identities that are specified on the leaf certificate. Read only: true |
subjectEmailAddresses[] | string | Each item |