> ## Documentation Index > Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create a self-managed cluster run by the Qovery Operator > Creates a self-managed cluster on an existing AWS cloud credential of the organization. The organization's plan must include self-managed clusters, otherwise the call answers 403. The credential only needs ECR permissions for the cluster itself, including `ecr:DescribeRepositories` in `us-east-1`, which Qovery calls to check the credential whatever the cluster region; features that call other AWS services with the credential, such as managed databases or Terraform services using the cluster credentials, need more. Without `platform.templateKey` and `platform.templateVersion`, Qovery selects its self-managed platform template release and the response returns it: `"platform": {}` gives that release with its default configuration. Without `clusterInputs`, the cluster has no cluster inputs. The credential, including its ECR access in the cluster region, and the platform configuration are checked before anything is created. One transaction then writes the cluster, its Qovery DNS and build providers, its default ECR registry derived from the credential, its initial deployment status, its platform configuration and its Qovery Operator enrollment. Only the AWS provider is supported. Install the Operator next with the cluster's Operator bootstrap. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/organization/{organizationId}/selfManagedCluster openapi: 3.0.0 info: version: 1.0.4 title: Qovery API description: > - Qovery is the fastest way to deploy your full-stack apps on any Cloud provider. - ℹ️ The API is stable and still in development. contact: name: Qovery Product Team url: https://www.qovery.com email: support+api+documentation@qovery.com x-logo: url: https://console.qovery.com/assets/logos/logo-white.svg altText: Qovery servers: - url: https://api.qovery.com security: - bearerAuth: [] - ApiKeyAuth: [] tags: - name: Account - name: Account Info - name: IPs - name: Alert Receivers - name: Alert Rules - name: Admin - name: ArgoCD - name: Agentic Workflows - name: Application - name: Application Actions - name: Application Configuration - name: Application Database - name: Application Deployment Restriction - name: Application Deployment History - name: Application Environment Variable - name: Application Logs - name: Application Main Calls - name: Application Secret - name: Application Annotations Group - name: Applications - name: AutoscalingPolicy - name: Container - name: Container Actions - name: Container Configuration - name: Container Database - name: Container Deployment History - name: Container Environment Variable - name: Container Logs - name: Container Main Calls - name: Container Registry - name: Container Secret - name: Container Annotations Group - name: Containers - name: Deployment Stage Main Calls - name: Job - name: Job Actions - name: Job Configuration - name: Job Database - name: Job Deployment Restriction - name: Job Deployment History - name: Job Environment Variable - name: Job Logs - name: Job Main Calls - name: Job Registry - name: Job Secret - name: Job Annotations Group - name: Jobs - name: KedaTriggerAuthentication - name: Helm - name: Helm Actions - name: Helm Configuration - name: Helm Database - name: Helm Deployment Restriction - name: Helm Deployment History - name: Helm Logs - name: Helm Main Calls - name: Helm Repository - name: Helms - name: Backups - name: Billing - name: Blueprint Catalog - name: Cloud Provider - name: Cloud Provider Credentials - name: Clusters - name: Cluster Deployment History - name: Cluster Operator - name: Platform Configuration - name: Custom Domain - name: Container Custom Domain - name: LLM Providers - name: MCP Servers - name: Database - name: Database Actions - name: Database Application - name: Database Container - name: Database Deployment History - name: Database Main Calls - name: Database Annotations Group - name: Databases - name: Environment - name: Environment Actions - name: Environment Deployment History - name: Environment Deployment Rule - name: Environment Logs - name: Environment Main Calls - name: Environment Secret - name: Environment Variable - name: Environments - name: Git - name: Github App - name: Git repositories - name: Members - name: Organization - name: Organization Account Git Repositories - name: Organization Cluster Lock - name: Organization Main Calls - name: Organization Custom Role - name: Organization Event - name: Organization Api Token - name: Organization Policy Api Token - name: Organization Webhook - name: Organization Annotations Group - name: Organization Labels Group - name: Organization Enterprise Connection - name: Project - name: Project Deployment Rule - name: Project Environment Variable - name: Project Main Calls - name: Project Secret - name: Projects - name: Referral & Rewards - name: Secret Manager Access - name: Terraforms - name: Terraform Main Calls - name: Terraform Resources - name: Terraform Deployment History - name: Terraform Deployment Restriction - name: Container Registries - name: Helm Repositories - name: User Sign Up - name: Variable Main Calls - name: Helm Custom Domain - name: Lifecycle Template Main Calls - name: Blueprint Main Calls paths: /v1/organization/{organizationId}/selfManagedCluster: post: tags: - Clusters summary: Create a self-managed cluster run by the Qovery Operator description: >- Creates a self-managed cluster on an existing AWS cloud credential of the organization. The organization's plan must include self-managed clusters, otherwise the call answers 403. The credential only needs ECR permissions for the cluster itself, including `ecr:DescribeRepositories` in `us-east-1`, which Qovery calls to check the credential whatever the cluster region; features that call other AWS services with the credential, such as managed databases or Terraform services using the cluster credentials, need more. Without `platform.templateKey` and `platform.templateVersion`, Qovery selects its self-managed platform template release and the response returns it: `"platform": {}` gives that release with its default configuration. Without `clusterInputs`, the cluster has no cluster inputs. The credential, including its ECR access in the cluster region, and the platform configuration are checked before anything is created. One transaction then writes the cluster, its Qovery DNS and build providers, its default ECR registry derived from the credential, its initial deployment status, its platform configuration and its Qovery Operator enrollment. Only the AWS provider is supported. Install the Operator next with the cluster's Operator bootstrap. operationId: createSelfManagedCluster parameters: - $ref: '#/components/parameters/organizationId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SelfManagedClusterRequest' responses: '201': description: Created self-managed cluster content: application/json: schema: $ref: '#/components/schemas/SelfManagedClusterResponse' '400': description: >- Invalid body, including only one of `platform.templateKey` and `platform.templateVersion`, provider other than AWS, unknown region, invalid name, cloud credential of another provider, ECR refusing the credential, or invalid platform configuration '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': description: >- Organization, cloud credential or template release not found, including a cloud credential of another organization '409': description: A cluster with this name already exists in the organization '500': description: >- The selected platform template could not be resolved, or an internal creation step failed, such as writing the cluster's initial deployment status or the Qovery Operator enrollment '503': description: >- The platform template catalog is temporarily unavailable, or, for a request without `platform.templateKey` and `platform.templateVersion`, the self-managed platform template release is missing from it or not published components: parameters: organizationId: name: organizationId in: path description: Organization ID required: true schema: type: string format: uuid schemas: SelfManagedClusterRequest: type: object required: - name - provider - region - credentials - platform properties: name: type: string production: type: boolean default: false provider: type: string enum: - AWS region: type: string example: eu-west-3 credentials: $ref: '#/components/schemas/SelfManagedClusterCredentials' platform: $ref: '#/components/schemas/SelfManagedClusterPlatformSelection' clusterInputs: $ref: '#/components/schemas/PlatformComponentStringValuesMap' SelfManagedClusterResponse: type: object required: - id - organizationId - name - production - provider - region - createdAt - credentials - registry - platform - clusterInputs - layers properties: id: type: string format: uuid organizationId: type: string format: uuid name: type: string production: type: boolean provider: $ref: '#/components/schemas/CloudVendorEnum' region: type: string createdAt: type: string format: date-time credentials: $ref: '#/components/schemas/SelfManagedClusterCredentials' registry: $ref: '#/components/schemas/SelfManagedClusterRegistryResponse' platform: $ref: '#/components/schemas/PlatformSelection' clusterInputs: $ref: '#/components/schemas/PlatformComponentStringValuesMap' layers: type: array items: $ref: '#/components/schemas/ClusterPlatformBindingLayerResponse' SelfManagedClusterCredentials: type: object description: >- AWS cloud credential of the organization that the cluster runs on. This operation only takes and returns its id. required: - id properties: id: type: string format: uuid description: Id of an existing AWS cloud credential of the organization SelfManagedClusterPlatformSelection: type: object description: >- Platform template release and configuration of a new self-managed cluster. Set templateKey and templateVersion together to select a release, or omit both and Qovery selects its self-managed platform template release; only one of them answers 400. layerSelections and managedConfig are validated against the selected release, and `{}` gives that release with its default configuration. Send them without templateKey and templateVersion only if you already know the components of the self-managed platform template; a client that renders the fields of a release must send that release's coordinates, and selections of mandatory layers are rejected. The response returns the selected release, and the cluster keeps it even if Qovery later selects another one. properties: templateKey: type: string description: >- Key of the platform template release, set together with templateVersion. templateVersion: type: string description: >- Version of the platform template release, set together with templateKey. layerSelections: $ref: '#/components/schemas/PlatformLayerSelections' managedConfig: $ref: '#/components/schemas/PlatformComponentConfigurationMap' PlatformComponentStringValuesMap: type: object description: String values keyed first by component key and then by input key additionalProperties: type: object additionalProperties: type: string CloudVendorEnum: type: string enum: - AWS - SCW - GCP - DO - AZURE - OVH - CIVO - HETZNER - ORACLE - IBM - ON_PREMISE SelfManagedClusterRegistryResponse: type: object description: >- Default ECR registry of the cluster, derived from its cloud credential and region. required: - id - kind properties: id: type: string format: uuid kind: $ref: '#/components/schemas/ContainerRegistryKindEnum' PlatformSelection: type: object description: >- Platform template release selected for a cluster, with its layer selections and component configuration. Sensitive managedConfig values are redacted in responses. required: - templateKey - templateVersion properties: templateKey: type: string templateVersion: type: string layerSelections: $ref: '#/components/schemas/PlatformLayerSelections' managedConfig: $ref: '#/components/schemas/PlatformComponentConfigurationMap' ClusterPlatformBindingLayerResponse: type: object required: - key - status - reason - componentKeys properties: key: type: string status: $ref: '#/components/schemas/PlatformLayerResolutionStatus' reason: type: string componentKeys: type: array items: type: string PlatformLayerSelections: type: object additionalProperties: type: boolean PlatformComponentConfigurationMap: type: object description: Component configuration values keyed by component key additionalProperties: $ref: '#/components/schemas/PlatformConfigurationValues' ContainerRegistryKindEnum: type: string enum: - ECR - SCALEWAY_CR - DOCKER_HUB - GITHUB_CR - GITHUB_ENTERPRISE_CR - GITLAB_CR - PUBLIC_ECR - DOCR - GENERIC_CR - GCP_ARTIFACT_REGISTRY - AZURE_CR description: The type of your container registry PlatformLayerResolutionStatus: type: string enum: - ENABLED - DISABLED - SKIPPED PlatformConfigurationValues: type: object description: Configuration values keyed by their catalog field name additionalProperties: {} responses: '401': description: Access token is missing or invalid '403': description: Access forbidden securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- JWT tokens should be used with OIDC account (human to machine). JWT tokens used by the Qovery console to communicate with the API have a TTL. Curl Example ' curl https://console.qovery.com/organization -H "Authorization: Bearer $qovery_token" ' ApiKeyAuth: type: apiKey in: header name: Authorization description: >- Token API are generated by Qovery to manage machine to machine interaction and do not have a TTL. Curl Example ' curl https://console.qovery.com/organization -H "Authorization: Token $qovery_token" ' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.