Google: Creates and uploads a client-side encryption S MIME public key certificate chain and private key metadata for the authenticated user For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured

Google gmailUsersSettingsCseKeypairs.gmailUsersSettingsCseKeypairsCreate: arguments, response, policy and SDK examples.

← Gmail users settings cse keypairs operations · Get started

Operation google.gmail_users_settings_cse_keypairs_create

Provider route: POST /gmail/v1/users/{userId}/settings/cse/keypairs. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/google with npm, or alter-sdk-google with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GoogleIntegration } from "@alter-ai/google";

async function execute(input: Parameters<GoogleIntegration["gmailUsersSettingsCseKeypairs"]["gmailUsersSettingsCseKeypairsCreate"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GoogleIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.gmailUsersSettingsCseKeypairs.gmailUsersSettingsCseKeypairsCreate(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_google import GoogleIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GoogleIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.gmail_users_settings_cse_keypairs.gmail_users_settings_cse_keypairs_create(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
`$`	object	Root	Additional keys: not allowed
`path`	object	Required within parent	Additional keys: not allowed
`path.userId`	string	Required within parent	The requester’s primary email address. To indicate the authenticated user, you can use the special value `me`. Default: me
`query`	object	Optional	Additional keys: not allowed
`query.fields`	string	Optional	Selector specifying which fields to include in a partial response.
`query.prettyPrint`	boolean	Optional	Returns response with indentations and line breaks. Default: true
`query.quotaUser`	string	Optional	Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.
`query.chainValidation`	string	Optional	The type of certificate chain validation to perform at creation. The request will be rejected if the uploaded chain fails to satisfy the requested validation checks. When unspecified, this parameter defaults to `all`. Default: all One of: all, none
`body`	Model	Required within parent	Expand Creates and uploads a client-side encryption S MIME public key certificate chain and private key metadata for the authenticated user For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body

Referenced models: Creates and uploads a client-side encryption S MIME public key certificate chain and private key metadata for the authenticated user For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
`$`	Model	Root	Expand Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Referenced models: Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Schemas

1 more schema is linked from the tables above, on the schema pages.

Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Field	Type	Presence	Description and constraints
`$`	object	Root	A client-side encryption S/MIME key pair, which is comprised of a public key, its certificate chain, and metadata for its paired private key. Gmail uses the key pair to complete the following tasks: - Sign outgoing client-side encrypted messages. - Save and reopen drafts of client-side encrypted messages. - Save and reopen sent messages. - Decrypt incoming or archived S/MIME messages. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.
`disableTime`	string	Optional	Output only. If a key pair is set to `DISABLED`, the time that the key pair's state changed from `ENABLED` to `DISABLED`. This field is present only when the key pair is in state `DISABLED`. Format: google-datetime Read only: true
`enablementState`	string	Optional	Output only. The current state of the key pair. Known values: stateUnspecified, enabled, disabled Read only: true
`keyPairId`	string	Optional	Output only. The immutable ID for the client-side encryption S/MIME key pair. Read only: true
`pem`	string	Optional	Output only. The public key and its certificate chain, in [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) format. Read only: true
`pkcs7`	string	Optional	Input only. The public key and its certificate chain. The chain must be in [PKCS#7](https://en.wikipedia.org/wiki/PKCS_7) format and use PEM encoding and ASCII armor.
`privateKeyMetadata`	array	Optional	Metadata for instances of this key pair's private key.
`privateKeyMetadata[]`	Model	Each item	Expand Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item
`subjectEmailAddresses`	array	Optional	Output only. The email address identities that are specified on the leaf certificate. Read only: true
`subjectEmailAddresses[]`	string	Each item

Creates and uploads a client-side encryption S MIME public key certificate chain and private key metadata for the authenticated user For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body

Field	Type	Presence	Description and constraints
`$`	object	Root	A client-side encryption S/MIME key pair, which is comprised of a public key, its certificate chain, and metadata for its paired private key. Gmail uses the key pair to complete the following tasks: - Sign outgoing client-side encrypted messages. - Save and reopen drafts of client-side encrypted messages. - Save and reopen sent messages. - Decrypt incoming or archived S/MIME messages. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.
`disableTime`	string	Optional	Output only. If a key pair is set to `DISABLED`, the time that the key pair's state changed from `ENABLED` to `DISABLED`. This field is present only when the key pair is in state `DISABLED`. Format: google-datetime Read only: true
`enablementState`	string	Optional	Output only. The current state of the key pair. One of: stateUnspecified, enabled, disabled Read only: true
`keyPairId`	string	Optional	Output only. The immutable ID for the client-side encryption S/MIME key pair. Read only: true
`pem`	string	Optional	Output only. The public key and its certificate chain, in [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) format. Read only: true
`pkcs7`	string	Optional	Input only. The public key and its certificate chain. The chain must be in [PKCS#7](https://en.wikipedia.org/wiki/PKCS_7) format and use PEM encoding and ASCII armor.
`privateKeyMetadata`	array	Optional	Metadata for instances of this key pair's private key.
`privateKeyMetadata[]`	Model	Each item	Expand Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item
`subjectEmailAddresses`	array	Optional	Output only. The email address identities that are specified on the leaf certificate. Read only: true
`subjectEmailAddresses[]`	string	Each item

Field	Type	Presence	Description and constraints
`$`	object	Root	Metadata for hardware keys. If [hardware key encryption](https://support.google.com/a/answer/14153163) is set up for the Google Workspace organization, users can optionally store their private key on their smart card and use it to sign and decrypt email messages in Gmail by inserting their smart card into a reader attached to their Windows device.
`description`	string	Optional	Description about the hardware key.

Field	Type	Presence	Description and constraints
`$`	object	Root	Metadata for a cryptographic key managed by an external key access control list service. For details about managing key access, see [Google Workspace CSE API Reference](https://developers.google.com/workspace/cse/reference).
`kaclsData`	string	Optional	Opaque data generated and used by the key access control list service.
`kaclsUri`	string	Optional	The URI of the key access control list service that manages the key.

Policy, approvals and errors

SDK function policy ID: google.gmail_users_settings_cse_keypairs_create. Catalog operation: gmail.users.settings.cse.keypairs.create. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Required provider scopes: ["https://www.googleapis.com/auth/gmail.settings.basic", "https://www.googleapis.com/auth/gmail.settings.sharing"]

Official provider source

Report an issue with this page