--- name: hs-crypto-uko-create-vaults title: Creating vaults description: You can use Hyper Protect Crypto Services to create a group of key templates, keys, and keystores for a target group of users that require the same Cloud Identity and Access Management (IAM) access permissions in a vault. You can create vaults in Unified Key Orchestrator with the UI, or programmatically with the Unified Key Orchestrator. last-updated: 2026-06-16 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Creating vaults {: #create-vaults} You can use Hyper Protect Crypto Services to create a group of key templates, keys, and keystores for a target group of users that require the same Cloud Identity and Access Management (IAM) access permissions in a vault. You can create vaults in Unified Key Orchestrator with the UI, or programmatically with the Unified Key Orchestrator. {: shortdesc} As a _Vault Administrator_, you can bundle the key templates, keys, and keystores in your Hyper Protect Crypto Services instance into groups called _vault_. A vault is a collection of key templates, keys, internal keystores, and external keystores that require the same IAM access permissions. For example, if you have a group of team members who need a particular type of access to a specific group of key templates, keys, and keystores, you can create a vault and assign the appropriate IAM access policy to the target user group. The users that are assigned access to the vault can create and manage the resources that exist within the vault. Vaults are also useful in cases where it is important for one business unit to have access to a set of key templates, keys, and keystores that another business unit cannot have. An account administrator can create vaults for each business unit and [assign the appropriate level of access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaults&format=markdown) to the appropriate users. In the case where the account administrator wants to delegate platform management of a specific vault to someone else, they can assign a user a [Vault Administrator role](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-access&format=markdown#uko-service-access-roles). The sub-administrator is then able to manage the vault and grant access to the appropriate users. Before you create a vault for your Hyper Protect Crypto Services instance, keep in mind of the following considerations: - Vaults can hold key templates, KMS keys, and keystores. EP11 keys and keystores are not supported. There is no limit on how many keys can exist within a vault. Vaults don't apply to Enterprise PKCS #11 (EP11) keys and keystores. - A key template, a key, or a keystore can only belong to one vault at a time. You need to specify a vault to a key template, a managed key, or a keystore upon creation. - During master key rotation, you are not able to create a vault. However, you can create the vault again after the master key rotation process is complete. For more information about granting access, see [Granting access to vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaults&format=markdown). ## Creating vaults with the UI {: #create-vaults-ui} {: ui} To create a vault by using the UI, complete the following steps through the **Vaults** page. Optionally, you can create a vault when you [create a key template](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-template&format=markdown), [create a managed key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys&format=markdown), or [add a keystore](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-internal-keystores&format=markdown). 1. [Log in to the Hyper Protect Crypto Services instance](https://cloud.ibm.com/login){: external}. 1. Click **Vaults** from the navigation menu to view all the available vaults. 1. To create a vault, click **Create vault**. 1. Enter a name in **Vault name**. Optionally, you can add an extended description to your vault in the **Vault description** section. The vault name must be of 1 to 100 characters in length. The characters can be letters (case-sensitive), digits (0-9), or symbols (#@!$%\’_-). {: note} 1. Click **Create vault** to confirm. You have successfully created a vault. ## Creating vaults through the API {: #create-vaults-api} {: api} To create a vault through the API, follow these steps: 1. [Retrieve your service and authentication credentials to work with vaults in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api&format=markdown). 2. Create a vault by making a `POST` call to the following endpoint. ``` https://.uko..hs-crypto.appdomain.cloud/api/v4/vaults ``` {: codeblock} For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko#create-vault){: external}. ## What's next {: #create-vaults-next} - To find out instructions on editing a vault, check out [Editing vault details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-vaults&format=markdown). - To find out how to delete a vault, check out [Deleting vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaults&format=markdown). - To find out how to grant access to vaults, see [Granting access to vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaults&format=markdown).