diff --git a/src/Auth0.ManagementApi/Clients/IKeysClient.cs b/src/Auth0.ManagementApi/Clients/IKeysClient.cs
index 772c62d1d..961b718ab 100644
--- a/src/Auth0.ManagementApi/Clients/IKeysClient.cs
+++ b/src/Auth0.ManagementApi/Clients/IKeysClient.cs
@@ -4,6 +4,7 @@ namespace Auth0.ManagementApi.Clients
   using System.Threading;
   using System.Threading.Tasks;
   using Models.Keys;
+  using Paging;
 
   public interface IKeysClient
   {
@@ -36,5 +37,50 @@ public interface IKeysClient
     /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
     /// <returns>The revoked key's cert and kid.</returns>
     Task<RevokeSigningKeyResponse> RevokeSigningKeyAsync(string kid, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Retrieve details of all the encryption keys associated with your tenant.
+    /// </summary>
+    /// <param name="pagination"><see cref="PaginationInfo"/></param>
+    /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
+    /// <returns>Retrieve details of all the encryption keys associated with your tenant. <see cref="Auth0.ManagementApi.Models.EncryptionKey" />.</returns>
+    Task<IPagedList<EncryptionKey>> GetAllEncryptionKeysAsync(PaginationInfo pagination, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Create the new, pre-activated encryption key, without the key material.
+    /// </summary>
+    /// <param name="request"><see cref="EncryptionKeyCreateRequest"/></param>
+    /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
+    /// <returns>Newly created pre-activated encryption key <see cref="Auth0.ManagementApi.Models.EncryptionKey" />.</returns>
+    Task<EncryptionKey> CreateEncryptionKeyAsync(EncryptionKeyCreateRequest request, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Retrieve details of the encryption key with the given ID.
+    /// </summary>
+    /// <param name="request"><see cref="EncryptionKeyGetRequest"/></param>
+    /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
+    /// <returns>Retrieve details of the encryption key associated with the id. <see cref="Auth0.ManagementApi.Models.EncryptionKey" />.</returns>
+    Task<EncryptionKey> GetEncryptionKeyAsync(EncryptionKeyGetRequest request, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Delete the custom provided encryption key with the given ID and move back to using native encryption key.
+    /// </summary>
+    /// <param name="kid">Encryption key ID</param>
+    /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
+    Task DeleteEncryptionKeyAsync(string kid, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Import wrapped key material and activate encryption key.
+    /// </summary>
+    /// <param name="request"><see cref="EncryptionKeyImportRequest"/></param>
+    /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
+    Task<EncryptionKey> ImportEncryptionKeyAsync(EncryptionKeyImportRequest request, CancellationToken cancellationToken = default);
+    
+    /// <summary>
+    /// Create the public wrapping key to wrap your own encryption key material.
+    /// </summary>
+    /// <param name="request"><see cref="WrappingKeyCreateRequest"/></param>
+    /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
+    Task<WrappingKey> CreatePublicWrappingKeyAsync(WrappingKeyCreateRequest request, CancellationToken cancellationToken = default);
   }
 }
diff --git a/src/Auth0.ManagementApi/Clients/KeysClient.cs b/src/Auth0.ManagementApi/Clients/KeysClient.cs
index 965260a02..455c12160 100644
--- a/src/Auth0.ManagementApi/Clients/KeysClient.cs
+++ b/src/Auth0.ManagementApi/Clients/KeysClient.cs
@@ -5,6 +5,9 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Auth0.ManagementApi.Models.Keys;
+using Auth0.ManagementApi.Paging;
+using Newtonsoft.Json;
+using EncryptionKey = Auth0.ManagementApi.Models.Keys.EncryptionKey;
 
 namespace Auth0.ManagementApi.Clients
 {
@@ -13,6 +16,7 @@ namespace Auth0.ManagementApi.Clients
     /// </summary>
     public class KeysClient : BaseClient, IKeysClient
     {
+        readonly JsonConverter[] converters = new JsonConverter[] { new PagedListConverter<EncryptionKey>("keys") };
         /// <summary>
         /// Initializes a new instance of the <see cref="KeysClient"/> class.
         /// </summary>
@@ -65,5 +69,104 @@ public Task<RevokeSigningKeyResponse> RevokeSigningKeyAsync(string kid, Cancella
         {
             return Connection.SendAsync<RevokeSigningKeyResponse>(HttpMethod.Put, BuildUri($"keys/signing/{EncodePath(kid)}/revoke"), null, DefaultHeaders, cancellationToken: cancellationToken);
         }
+        
+        /// <inheritdoc cref="IKeysClient.GetAllEncryptionKeysAsync"/>
+        public Task<IPagedList<EncryptionKey>> GetAllEncryptionKeysAsync(
+            PaginationInfo pagination, CancellationToken cancellationToken = default)
+        {
+            var queryStrings = new Dictionary<string, string>();
+
+            if (pagination != null)
+            {
+                queryStrings["page"] = pagination.PageNo.ToString();
+                queryStrings["per_page"] = pagination.PerPage.ToString();
+                queryStrings["include_totals"] = pagination.IncludeTotals.ToString().ToLower();
+            }
+            
+            return Connection.GetAsync<IPagedList<EncryptionKey>>(
+                BuildUri("keys/encryption", queryStrings), DefaultHeaders, converters, cancellationToken);
+        }
+
+        /// <inheritdoc cref="IKeysClient.CreateEncryptionKeyAsync"/>
+        public Task<EncryptionKey> CreateEncryptionKeyAsync(
+            EncryptionKeyCreateRequest request, CancellationToken cancellationToken = default)
+        {
+            if (request == null)
+                throw new ArgumentNullException(nameof(request));
+
+            if (string.IsNullOrEmpty(request.Type))
+                throw new ArgumentNullException(nameof(request.Type));
+
+            return Connection.SendAsync<EncryptionKey>(
+                HttpMethod.Post,
+                BuildUri("keys/encryption"),
+                request, 
+                DefaultHeaders,
+                cancellationToken: cancellationToken);
+        }
+
+        /// <inheritdoc cref="IKeysClient.GetEncryptionKeyAsync"/>
+        public Task<EncryptionKey> GetEncryptionKeyAsync(
+            EncryptionKeyGetRequest request, CancellationToken cancellationToken = default)
+        {
+            if (request == null)
+                throw new ArgumentNullException(nameof(request));
+
+            if (string.IsNullOrEmpty(request.Kid))
+                throw new ArgumentNullException(nameof(request.Kid));
+            
+            return Connection.GetAsync<EncryptionKey>(
+                BuildUri($"keys/encryption/{EncodePath(request.Kid)}"), DefaultHeaders, null, cancellationToken);
+        }
+        
+        /// <inheritdoc cref="IKeysClient.DeleteEncryptionKeyAsync"/>
+        public Task DeleteEncryptionKeyAsync(string kid, CancellationToken cancellationToken = default)
+        {
+            if (kid == null)
+                throw new ArgumentNullException(nameof(kid));
+            
+            return Connection.SendAsync<object>(
+                HttpMethod.Delete,
+                BuildUri($"keys/encryption/{EncodePath(kid)}"),
+                null,
+                DefaultHeaders, 
+                cancellationToken: cancellationToken);
+        }
+
+        /// <inheritdoc cref="IKeysClient.ImportEncryptionKeyAsync"/>
+        public Task<EncryptionKey> ImportEncryptionKeyAsync(
+            EncryptionKeyImportRequest request, CancellationToken cancellationToken = default)
+        {
+            if (request == null)
+                throw new ArgumentNullException(nameof(request));
+
+            if (string.IsNullOrEmpty(request.Kid))
+                throw new ArgumentNullException(nameof(request.Kid));
+            
+            return Connection.SendAsync<EncryptionKey>(
+                HttpMethod.Post,
+                BuildUri($"keys/encryption/{EncodePath(request.Kid)}"),
+                request,
+                DefaultHeaders,
+                cancellationToken: cancellationToken);
+        }
+
+        /// <inheritdoc cref="IKeysClient.CreatePublicWrappingKeyAsync"/>
+        public Task<WrappingKey> CreatePublicWrappingKeyAsync(
+            WrappingKeyCreateRequest request, CancellationToken cancellationToken = default)
+        {
+            if (request == null)
+                throw new ArgumentNullException(nameof(request));
+
+            if (string.IsNullOrEmpty(request.Kid))
+                throw new ArgumentNullException(nameof(request.Kid));
+            
+            return Connection.SendAsync<WrappingKey>(
+                HttpMethod.Post,
+                BuildUri($"keys/encryption/{EncodePath(request.Kid)}/wrapping-key"),
+                body: null,
+                headers: DefaultHeaders,
+                cancellationToken: cancellationToken);
+        }
     }
 }
diff --git a/src/Auth0.ManagementApi/Models/Keys/EncryptionKey.cs b/src/Auth0.ManagementApi/Models/Keys/EncryptionKey.cs
new file mode 100644
index 000000000..a7f18a9c4
--- /dev/null
+++ b/src/Auth0.ManagementApi/Models/Keys/EncryptionKey.cs
@@ -0,0 +1,53 @@
+using System;
+using System.Net.Security;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Converters;
+
+namespace Auth0.ManagementApi.Models.Keys
+{
+    /// <summary>
+    /// Represents and Encryption Key
+    /// </summary>
+    public class EncryptionKey
+    {
+        /// <summary>
+        /// Key ID
+        /// </summary>
+        [JsonProperty("kid")]
+        public string Kid { get; set; }
+
+        /// <inheritdoc cref="EncryptionKeyType"/>
+        [JsonProperty("type")]
+        [JsonConverter(typeof(StringEnumConverter))]
+        public EncryptionKeyType Type { get; set; }
+
+        /// <inheritdoc cref="EncryptionKeyState"/>
+        [JsonProperty("state")]
+        [JsonConverter(typeof(StringEnumConverter))]
+        public EncryptionKeyState State { get; set; }
+
+        /// <summary>
+        /// Key creation timestamp
+        /// </summary>
+        [JsonProperty("created_at")]
+        public DateTime CreatedAt { get; set; }
+
+        /// <summary>
+        /// Key update timestamp
+        /// </summary>
+        [JsonProperty("updated_at")]
+        public DateTime UpdatedAt { get; set; }
+
+        /// <summary>
+        /// ID of the parent wrapping key.
+        /// </summary>
+        [JsonProperty("parent_kid")]
+        public string ParentKid { get; set; }
+
+        /// <summary>
+        /// Public key in PEM format
+        /// </summary>
+        [JsonProperty("public_key")]
+        public string PublicKey { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyCreateRequest.cs b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyCreateRequest.cs
new file mode 100644
index 000000000..2757f3a02
--- /dev/null
+++ b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyCreateRequest.cs
@@ -0,0 +1,17 @@
+using Newtonsoft.Json;
+
+namespace Auth0.ManagementApi.Models.Keys
+{
+    /// <summary>
+    /// Contains information required for creating an encryption key.
+    /// </summary>
+    public class EncryptionKeyCreateRequest
+    {
+        /// <summary>
+        /// Type of the encryption key to be created.
+        /// Possible values: [customer-provided-root-key, tenant-encryption-key]
+        /// </summary>
+        [JsonProperty("type")]
+        public string Type { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyGetRequest.cs b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyGetRequest.cs
new file mode 100644
index 000000000..08f2ce350
--- /dev/null
+++ b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyGetRequest.cs
@@ -0,0 +1,13 @@
+namespace Auth0.ManagementApi.Models.Keys
+{
+    /// <summary>
+    /// Contains information required for getting an encryption key.
+    /// </summary>
+    public class EncryptionKeyGetRequest
+    {
+        /// <summary>
+        /// Encryption key ID.
+        /// </summary>
+        public string Kid { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyImportRequest.cs b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyImportRequest.cs
new file mode 100644
index 000000000..b09f53862
--- /dev/null
+++ b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyImportRequest.cs
@@ -0,0 +1,21 @@
+using Newtonsoft.Json;
+
+namespace Auth0.ManagementApi.Models.Keys
+{
+    /// <summary>
+    /// Contains information required for importing an encryption key.
+    /// </summary>
+    public class EncryptionKeyImportRequest
+    {
+        /// <summary>
+        /// Encryption key ID
+        /// </summary>
+        public string Kid { get; set; }
+        
+        /// <summary>
+        /// Base64 encoded ciphertext of key material wrapped by public wrapping key.
+        /// </summary>
+        [JsonProperty("wrapped_key")]
+        public string WrappedKey { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyState.cs b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyState.cs
new file mode 100644
index 000000000..a46468a89
--- /dev/null
+++ b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyState.cs
@@ -0,0 +1,22 @@
+using System.Runtime.Serialization;
+
+namespace Auth0.ManagementApi.Models.Keys
+{
+    /// <summary>
+    /// Encryption Key State
+    /// </summary>
+    public enum EncryptionKeyState
+    {
+        [EnumMember(Value = "pre-activation")]
+        PreActivation,
+        
+        [EnumMember(Value = "active")]
+        Active,
+        
+        [EnumMember(Value = "deactivated")]
+        Deactivated,
+        
+        [EnumMember(Value = "destroyed")]
+        Destroyed,
+    }
+}
\ No newline at end of file
diff --git a/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyType.cs b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyType.cs
new file mode 100644
index 000000000..7fa78ee05
--- /dev/null
+++ b/src/Auth0.ManagementApi/Models/Keys/EncryptionKeyType.cs
@@ -0,0 +1,22 @@
+using System.Runtime.Serialization;
+
+namespace Auth0.ManagementApi.Models.Keys
+{
+    /// <summary>
+    /// Encryption Key Type
+    /// </summary>
+    public enum EncryptionKeyType
+    {
+        [EnumMember(Value = "customer-provided-root-key")]
+        CustomerProvidedRootKey,
+        
+        [EnumMember(Value = "environment-root-key")]
+        EnvironmentRootKey,
+        
+        [EnumMember(Value = "tenant-master-key")]
+        TenantMasterKey,
+        
+        [EnumMember(Value = "tenant-encryption-key")]
+        TenantEncryptionKey,
+    }
+}
\ No newline at end of file
diff --git a/src/Auth0.ManagementApi/Models/Keys/WrappingKey.cs b/src/Auth0.ManagementApi/Models/Keys/WrappingKey.cs
new file mode 100644
index 000000000..f4a6f3869
--- /dev/null
+++ b/src/Auth0.ManagementApi/Models/Keys/WrappingKey.cs
@@ -0,0 +1,22 @@
+using Newtonsoft.Json;
+
+namespace Auth0.ManagementApi.Models.Keys
+{
+    /// <summary>
+    /// Represents the WrappingKey
+    /// </summary>
+    public class WrappingKey
+    {
+        /// <summary>
+        /// Public wrapping key in PEM format
+        /// </summary>
+        [JsonProperty("public_key")]
+        public string PublicKey { get; set; }
+        
+        /// <summary>
+        /// Encryption Algorithm that shall be used to wrap your key material
+        /// </summary>
+        [JsonProperty("algorithm")]
+        public string Algorithm { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/src/Auth0.ManagementApi/Models/Keys/WrappingKeyCreateRequest.cs b/src/Auth0.ManagementApi/Models/Keys/WrappingKeyCreateRequest.cs
new file mode 100644
index 000000000..bd4ab049c
--- /dev/null
+++ b/src/Auth0.ManagementApi/Models/Keys/WrappingKeyCreateRequest.cs
@@ -0,0 +1,13 @@
+namespace Auth0.ManagementApi.Models.Keys
+{
+    /// <summary>
+    /// Contains information required for creating a wrapping key.
+    /// </summary>
+    public class WrappingKeyCreateRequest
+    {
+        /// <summary>
+        /// Encryption key ID
+        /// </summary>
+        public string Kid { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/tests/Auth0.AuthenticationApi.IntegrationTests/Testing/ManagementTestBaseUtils.cs b/tests/Auth0.AuthenticationApi.IntegrationTests/Testing/ManagementTestBaseUtils.cs
index ff2d26bf5..452f36797 100644
--- a/tests/Auth0.AuthenticationApi.IntegrationTests/Testing/ManagementTestBaseUtils.cs
+++ b/tests/Auth0.AuthenticationApi.IntegrationTests/Testing/ManagementTestBaseUtils.cs
@@ -22,7 +22,8 @@ public static async Task CleanupAsync(ManagementApiClient client, CleanUpType ty
                 new UsersCleanUpStrategy(client),
                 new RulesCleanUpStrategy(client),
                 new LogStreamsCleanUpStrategy(client),
-                new RolesCleanUpStrategy(client)
+                new RolesCleanUpStrategy(client),
+                new EncryptionKeysCleanupStrategy(client)
             };
 
             var cleanUpStrategy = strategies.Single(s => s.Type == type);
diff --git a/tests/Auth0.IntegrationTests.Shared/CleanUp/CleanUpType.cs b/tests/Auth0.IntegrationTests.Shared/CleanUp/CleanUpType.cs
index 5085301fc..a2b0ec835 100644
--- a/tests/Auth0.IntegrationTests.Shared/CleanUp/CleanUpType.cs
+++ b/tests/Auth0.IntegrationTests.Shared/CleanUp/CleanUpType.cs
@@ -12,6 +12,7 @@ public enum CleanUpType
         Users,
         Roles,
         Rules,
-        LogStreams
+        LogStreams,
+        EncryptionKeys
     }
 }
\ No newline at end of file
diff --git a/tests/Auth0.IntegrationTests.Shared/CleanUp/EncryptionKeysCleanUpStrategy.cs b/tests/Auth0.IntegrationTests.Shared/CleanUp/EncryptionKeysCleanUpStrategy.cs
new file mode 100644
index 000000000..a30733648
--- /dev/null
+++ b/tests/Auth0.IntegrationTests.Shared/CleanUp/EncryptionKeysCleanUpStrategy.cs
@@ -0,0 +1,23 @@
+using System;
+using System.Threading.Tasks;
+using Auth0.ManagementApi;
+using Auth0.ManagementApi.Models.Actions;
+using Auth0.ManagementApi.Paging;
+using static System.Collections.Specialized.BitVector32;
+
+namespace Auth0.IntegrationTests.Shared.CleanUp
+{
+    public class EncryptionKeysCleanupStrategy : CleanUpStrategy
+    {
+        public EncryptionKeysCleanupStrategy(ManagementApiClient apiClient) : base(CleanUpType.EncryptionKeys, apiClient)
+        {
+                
+        }
+
+        public override async Task Run(string id)
+        {
+            System.Diagnostics.Debug.WriteLine("Running EncryptionKeysCleanupStrategy");
+            await ApiClient.Keys.DeleteEncryptionKeyAsync(id);
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/Auth0.ManagementApi.IntegrationTests/Auth0.ManagementApi.IntegrationTests.csproj b/tests/Auth0.ManagementApi.IntegrationTests/Auth0.ManagementApi.IntegrationTests.csproj
index eddfbb574..a3ab8b7eb 100644
--- a/tests/Auth0.ManagementApi.IntegrationTests/Auth0.ManagementApi.IntegrationTests.csproj
+++ b/tests/Auth0.ManagementApi.IntegrationTests/Auth0.ManagementApi.IntegrationTests.csproj
@@ -23,6 +23,9 @@
     <None Update="Data\GetActionsResponseWithIntegrationData.json">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </None>
+    <None Update="Data\ImportEncryptionKeyResponse.json">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </None>
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/Auth0.ManagementApi.IntegrationTests/Data/ImportEncryptionKeyResponse.json b/tests/Auth0.ManagementApi.IntegrationTests/Data/ImportEncryptionKeyResponse.json
new file mode 100644
index 000000000..dd4020298
--- /dev/null
+++ b/tests/Auth0.ManagementApi.IntegrationTests/Data/ImportEncryptionKeyResponse.json
@@ -0,0 +1,9 @@
+{
+  "kid": "093e36a8-88a1-4c34-8202-e454553ee2dc",
+  "type": "customer-provided-root-key",
+  "state": "destroyed",
+  "created_at": "2024-11-04T15:33:27.535Z",
+  "updated_at": "2024-11-04T15:33:32.274Z",
+  "parent_kid": "a20128c5-9bf5-4209-8c43-b6dfcee60e9b",
+  "public_key": "Random-PUBLIC-KEY"
+}
\ No newline at end of file
diff --git a/tests/Auth0.ManagementApi.IntegrationTests/KeysTests.cs b/tests/Auth0.ManagementApi.IntegrationTests/KeysTests.cs
index 29d0803dd..8a5ecd291 100644
--- a/tests/Auth0.ManagementApi.IntegrationTests/KeysTests.cs
+++ b/tests/Auth0.ManagementApi.IntegrationTests/KeysTests.cs
@@ -1,11 +1,30 @@
+using System.Collections.Generic;
+using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
+using Auth0.IntegrationTests.Shared.CleanUp;
+using Auth0.ManagementApi.Clients;
+using Auth0.ManagementApi.IntegrationTests.Testing;
+using Auth0.ManagementApi.Models.Keys;
+using Auth0.ManagementApi.Paging;
 using FluentAssertions;
+using Newtonsoft.Json;
 using Xunit;
 
 namespace Auth0.ManagementApi.IntegrationTests
 {
-    public class KeysTestsFixture : TestBaseFixture {}
+    public class KeysTestsFixture : TestBaseFixture
+    {
+        public override async Task DisposeAsync()
+        {
+            foreach (KeyValuePair<CleanUpType, IList<string>> entry in identifiers)
+            {
+                await ManagementTestBaseUtils.CleanupAsync(ApiClient, entry.Key, entry.Value);
+            }
+
+            ApiClient.Dispose();
+        }
+    }
 
     public class KeysTests : IClassFixture<KeysTestsFixture>
     {
@@ -77,5 +96,64 @@ public async Task Test_keys_can_be_revoked_by_kid()
             // Assert
             revoked.Kid.Should().Be(previousKeyId);
         }
+
+        [Fact]
+        public async Task Test_encryption_keys_crud_sequence()
+        {
+            var encryptionKeysCreateRequest = new EncryptionKeyCreateRequest()
+            {
+                Type = "customer-provided-root-key"
+            };
+            // Create a new Encryption Key for testing purpose
+            var encryptionKey = await fixture.ApiClient.Keys.CreateEncryptionKeyAsync(encryptionKeysCreateRequest);
+            fixture.TrackIdentifier(CleanUpType.EncryptionKeys, encryptionKey.Kid);
+            
+            encryptionKey.Type.Should().Be(EncryptionKeyType.CustomerProvidedRootKey);
+            encryptionKey.State.Should().NotBeNull();
+            
+            // Get all the existing encryption keys
+            var allEncryptionKeys = 
+                await fixture.ApiClient.Keys.GetAllEncryptionKeysAsync(new PaginationInfo());
+            allEncryptionKeys.Count.Should().BeGreaterThan(0);
+            
+            // Get the newly created encryption key by its kid
+            var encryptionKeyById = await fixture.ApiClient.Keys.GetEncryptionKeyAsync(new EncryptionKeyGetRequest()
+            {
+                Kid = encryptionKey.Kid     
+            });
+            encryptionKeyById.Should().BeEquivalentTo(encryptionKey);
+
+            // Create Public key wrapping
+            var wrapping = await fixture.ApiClient.Keys.CreatePublicWrappingKeyAsync(new WrappingKeyCreateRequest()
+            {
+                Kid = encryptionKey.Kid
+            });
+
+            wrapping.Should().NotBeNull();
+            wrapping.Algorithm.Should().NotBeNull();
+            wrapping.PublicKey.Should().NotBeNull();
+
+            // Delete the encryption key
+            await fixture.ApiClient.Keys.DeleteEncryptionKeyAsync(encryptionKey.Kid);
+            fixture.UnTrackIdentifier(CleanUpType.EncryptionKeys, encryptionKey.Kid);
+            var allEncryptionKeysAfterCleanup = 
+                await fixture.ApiClient.Keys.GetAllEncryptionKeysAsync(new PaginationInfo());
+            allEncryptionKeysAfterCleanup.Should().NotContain(encryptionKey);
+        }
+        
+        [Fact]
+        public async void Test_import_encrypted_keys()
+        {
+            var sampleImportEncryptionKeyResponse = 
+                await File.ReadAllTextAsync("./Data/ImportEncryptionKeyResponse.json");
+            var httpClientManagementConnection = new HttpClientManagementConnection();
+            var importedKeys = 
+                httpClientManagementConnection.DeserializeContent<EncryptionKey>(sampleImportEncryptionKeyResponse, null);
+            importedKeys.PublicKey.Should().Be("Random-PUBLIC-KEY");
+            importedKeys.Kid.Should().Be("093e36a8-88a1-4c34-8202-e454553ee2dc");
+            importedKeys.State.Should().Be(EncryptionKeyState.Destroyed);
+            importedKeys.Type.Should().Be(EncryptionKeyType.CustomerProvidedRootKey);
+            importedKeys.ParentKid.Should().Be("a20128c5-9bf5-4209-8c43-b6dfcee60e9b");
+        }
     }
 }
diff --git a/tests/Auth0.ManagementApi.IntegrationTests/Testing/ManagementTestBaseUtils.cs b/tests/Auth0.ManagementApi.IntegrationTests/Testing/ManagementTestBaseUtils.cs
index 16935c504..4e18d514f 100644
--- a/tests/Auth0.ManagementApi.IntegrationTests/Testing/ManagementTestBaseUtils.cs
+++ b/tests/Auth0.ManagementApi.IntegrationTests/Testing/ManagementTestBaseUtils.cs
@@ -21,7 +21,8 @@ public static async Task CleanupAsync(ManagementApiClient client, CleanUpType ty
                 new UsersCleanUpStrategy(client),
                 new RulesCleanUpStrategy(client),
                 new LogStreamsCleanUpStrategy(client),
-                new RolesCleanUpStrategy(client)
+                new RolesCleanUpStrategy(client),
+                new EncryptionKeysCleanupStrategy(client)
             };
 
             var cleanUpStrategy = strategies.Single(s => s.Type == type);