> ## Documentation Index > Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create a self-managed cluster run by the Qovery Operator > Creates a self-managed cluster on an existing AWS cloud credential of the organization. The organization's plan must include self-managed clusters, otherwise the call answers 403. The credential only needs ECR permissions for the cluster itself, including `ecr:DescribeRepositories` in `us-east-1`, which Qovery calls to check the credential whatever the cluster region; features that call other AWS services with the credential, such as managed databases or Terraform services using the cluster credentials, need more. The credential, including its ECR access in the cluster region, and the platform configuration are checked before anything is created. One transaction then writes the cluster, its Qovery DNS and build providers, its default ECR registry derived from the credential, its initial deployment status, its platform configuration and its Qovery Operator enrollment. Only the AWS provider is supported. Install the Operator next with the cluster's Operator bootstrap. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/organization/{organizationId}/selfManagedCluster openapi: 3.0.0 info: version: 1.0.4 title: Qovery API description: > - Qovery is the fastest way to deploy your full-stack apps on any Cloud provider. - ℹ️ The API is stable and still in development. contact: name: Qovery Product Team url: https://www.qovery.com email: support+api+documentation@qovery.com x-logo: url: https://console.qovery.com/assets/logos/logo-white.svg altText: Qovery servers: - url: https://api.qovery.com security: - bearerAuth: [] - ApiKeyAuth: [] tags: - name: Account - name: Account Info - name: IPs - name: Alert Receivers - name: Alert Rules - name: Admin - name: ArgoCD - name: Agentic Workflows - name: Application - name: Application Actions - name: Application Configuration - name: Application Database - name: Application Deployment Restriction - name: Application Deployment History - name: Application Environment Variable - name: Application Logs - name: Application Main Calls - name: Application Secret - name: Application Annotations Group - name: Applications - name: AutoscalingPolicy - name: Container - name: Container Actions - name: Container Configuration - name: Container Database - name: Container Deployment History - name: Container Environment Variable - name: Container Logs - name: Container Main Calls - name: Container Registry - name: Container Secret - name: Container Annotations Group - name: Containers - name: Deployment Stage Main Calls - name: Job - name: Job Actions - name: Job Configuration - name: Job Database - name: Job Deployment Restriction - name: Job Deployment History - name: Job Environment Variable - name: Job Logs - name: Job Main Calls - name: Job Registry - name: Job Secret - name: Job Annotations Group - name: Jobs - name: KedaTriggerAuthentication - name: Helm - name: Helm Actions - name: Helm Configuration - name: Helm Database - name: Helm Deployment Restriction - name: Helm Deployment History - name: Helm Logs - name: Helm Main Calls - name: Helm Repository - name: Helms - name: Backups - name: Billing - name: Blueprint Catalog - name: Cloud Provider - name: Cloud Provider Credentials - name: Clusters - name: Cluster Deployment History - name: Cluster Operator - name: Platform Configuration - name: Custom Domain - name: Container Custom Domain - name: LLM Providers - name: MCP Servers - name: Database - name: Database Actions - name: Database Application - name: Database Container - name: Database Deployment History - name: Database Main Calls - name: Database Annotations Group - name: Databases - name: Environment - name: Environment Actions - name: Environment Deployment History - name: Environment Deployment Rule - name: Environment Logs - name: Environment Main Calls - name: Environment Secret - name: Environment Variable - name: Environments - name: Git - name: Github App - name: Git repositories - name: Members - name: Organization - name: Organization Account Git Repositories - name: Organization Cluster Lock - name: Organization Main Calls - name: Organization Custom Role - name: Organization Event - name: Organization Api Token - name: Organization Policy Api Token - name: Organization Webhook - name: Organization Annotations Group - name: Organization Labels Group - name: Organization Enterprise Connection - name: Project - name: Project Deployment Rule - name: Project Environment Variable - name: Project Main Calls - name: Project Secret - name: Projects - name: Referral & Rewards - name: Secret Manager Access - name: Terraforms - name: Terraform Main Calls - name: Terraform Resources - name: Terraform Deployment History - name: Terraform Deployment Restriction - name: Container Registries - name: Helm Repositories - name: User Sign Up - name: Variable Main Calls - name: Helm Custom Domain - name: Lifecycle Template Main Calls - name: Blueprint Main Calls paths: /v1/organization/{organizationId}/selfManagedCluster: post: tags: - Clusters summary: Create a self-managed cluster run by the Qovery Operator description: >- Creates a self-managed cluster on an existing AWS cloud credential of the organization. The organization's plan must include self-managed clusters, otherwise the call answers 403. The credential only needs ECR permissions for the cluster itself, including `ecr:DescribeRepositories` in `us-east-1`, which Qovery calls to check the credential whatever the cluster region; features that call other AWS services with the credential, such as managed databases or Terraform services using the cluster credentials, need more. The credential, including its ECR access in the cluster region, and the platform configuration are checked before anything is created. One transaction then writes the cluster, its Qovery DNS and build providers, its default ECR registry derived from the credential, its initial deployment status, its platform configuration and its Qovery Operator enrollment. Only the AWS provider is supported. Install the Operator next with the cluster's Operator bootstrap. operationId: createSelfManagedCluster parameters: - $ref: '#/components/parameters/organizationId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SelfManagedClusterRequest' responses: '201': description: Created self-managed cluster content: application/json: schema: $ref: '#/components/schemas/SelfManagedClusterResponse' '400': description: >- Invalid body, provider other than AWS, unknown region, invalid name, cloud credential of another provider, ECR refusing the credential, or invalid platform configuration '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': description: >- Organization, cloud credential or template release not found, including a cloud credential of another organization '409': description: A cluster with this name already exists in the organization '500': description: >- The selected platform template could not be resolved, or an internal creation step failed, such as writing the cluster's initial deployment status or the Qovery Operator enrollment '503': description: The platform template catalog is temporarily unavailable components: parameters: organizationId: name: organizationId in: path description: Organization ID required: true schema: type: string format: uuid schemas: SelfManagedClusterRequest: type: object required: - name - provider - region - credentials - platform properties: name: type: string production: type: boolean default: false provider: type: string enum: - AWS region: type: string example: eu-west-3 credentials: $ref: '#/components/schemas/SelfManagedClusterCredentials' platform: $ref: '#/components/schemas/PlatformSelection' clusterInputs: $ref: '#/components/schemas/PlatformComponentStringValuesMap' SelfManagedClusterResponse: type: object required: - id - organizationId - name - production - provider - region - createdAt - credentials - registry - platform - clusterInputs - layers properties: id: type: string format: uuid organizationId: type: string format: uuid name: type: string production: type: boolean provider: $ref: '#/components/schemas/CloudVendorEnum' region: type: string createdAt: type: string format: date-time credentials: $ref: '#/components/schemas/SelfManagedClusterCredentials' registry: $ref: '#/components/schemas/SelfManagedClusterRegistryResponse' platform: $ref: '#/components/schemas/PlatformSelection' clusterInputs: $ref: '#/components/schemas/PlatformComponentStringValuesMap' layers: type: array items: $ref: '#/components/schemas/ClusterPlatformBindingLayerResponse' SelfManagedClusterCredentials: type: object description: >- AWS cloud credential of the organization that the cluster runs on. This operation only takes and returns its id. required: - id properties: id: type: string format: uuid description: Id of an existing AWS cloud credential of the organization PlatformSelection: type: object description: >- Platform template release selected for a cluster, with its layer selections and component configuration. Sensitive managedConfig values are redacted in responses. required: - templateKey - templateVersion properties: templateKey: type: string templateVersion: type: string layerSelections: $ref: '#/components/schemas/PlatformLayerSelections' managedConfig: $ref: '#/components/schemas/PlatformComponentConfigurationMap' PlatformComponentStringValuesMap: type: object description: String values keyed first by component key and then by input key additionalProperties: type: object additionalProperties: type: string CloudVendorEnum: type: string enum: - AWS - SCW - GCP - DO - AZURE - OVH - CIVO - HETZNER - ORACLE - IBM - ON_PREMISE SelfManagedClusterRegistryResponse: type: object description: >- Default ECR registry of the cluster, derived from its cloud credential and region. required: - id - kind properties: id: type: string format: uuid kind: $ref: '#/components/schemas/ContainerRegistryKindEnum' ClusterPlatformBindingLayerResponse: type: object required: - key - status - reason - componentKeys properties: key: type: string status: $ref: '#/components/schemas/PlatformLayerResolutionStatus' reason: type: string componentKeys: type: array items: type: string PlatformLayerSelections: type: object additionalProperties: type: boolean PlatformComponentConfigurationMap: type: object description: Component configuration values keyed by component key additionalProperties: $ref: '#/components/schemas/PlatformConfigurationValues' ContainerRegistryKindEnum: type: string enum: - ECR - SCALEWAY_CR - DOCKER_HUB - GITHUB_CR - GITHUB_ENTERPRISE_CR - GITLAB_CR - PUBLIC_ECR - DOCR - GENERIC_CR - GCP_ARTIFACT_REGISTRY - AZURE_CR description: The type of your container registry PlatformLayerResolutionStatus: type: string enum: - ENABLED - DISABLED - SKIPPED PlatformConfigurationValues: type: object description: Configuration values keyed by their catalog field name additionalProperties: {} responses: '401': description: Access token is missing or invalid '403': description: Access forbidden securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- JWT tokens should be used with OIDC account (human to machine). JWT tokens used by the Qovery console to communicate with the API have a TTL. Curl Example ' curl https://console.qovery.com/organization -H "Authorization: Bearer $qovery_token" ' ApiKeyAuth: type: apiKey in: header name: Authorization description: >- Token API are generated by Qovery to manage machine to machine interaction and do not have a TTL. Curl Example ' curl https://console.qovery.com/organization -H "Authorization: Token $qovery_token" ' ````