- [HTTP request](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/create#body.HTTP_TEMPLATE)
- [Path parameters](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/create#body.PATH_PARAMETERS)
- [Request body](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/create#body.request_body)
- [Response body](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/create#body.response_body)
- [Authorization scopes](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/create#body.aspect)
- [Try it!](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities/create#try-it)

Creates and configures a client-side encryption identity that's authorized to send mail from the user account. Google publishes the S/MIME certificate to a shared domain-wide directory so that people within a Google Workspace organization can encrypt and send mail to the identity.

For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope.

For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.

### HTTP request

`POST https://gmail.googleapis.com/gmail/v1/users/{userId}/settings/cse/identities`

The URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.

### Path parameters

| Parameters ||
|---|---|
| `userId` | `string` The requester's primary email address. To indicate the authenticated user, you can use the special value `me`. |

### Request body

The request body contains an instance of `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#CseIdentity`.

### Response body

If successful, the response body contains a newly created instance of `https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings.cse.identities#CseIdentity`.

### Authorization scopes

Requires one of the following OAuth scopes:

- `https://www.googleapis.com/auth/gmail.settings.basic`
- `
  https://www.googleapis.com/auth/gmail.settings.sharing`

For more information, see the [Authorization guide](https://developers.google.com/workspace/guides/configure-oauth-consent).