📄️ List key store types
Lists the key store types and the key store providers. A key store holds signing keys of the organisation. Its type tells what it can do, and its provider is the product or the partner. The first type is `local`, the key store of the installation, with `canAdd` `false` (its `protection` is `hsm` when the installation keeps the new keys in its hardware security module). Then come the types that the installation lets an organisation add (from `vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`, `dpod` and `csc`).
📄️ List key stores
Lists the key stores of the organisation. The first key store is the local key store that takes new keys. The other key store of the installation comes next, but only when the organisation has keys in it. Then come the key stores that the organisation added, oldest first.
📄️ Create key store
Adds a key store of a provider to the organisation: an external OpenBao or HashiCorp Vault (`vault`), a key ring in Google Cloud KMS (`gcp-kms`), one region of AWS KMS (`aws-kms`), an Azure key vault or managed HSM (`azure-key-vault`), a Thales Luna Cloud HSM partition (`dpod`), or a remote signing service with the Cloud Signature Consortium (CSC) API (`csc`), for example a qualified trust service provider. Give the provider in `provider`: an `id` of the providers of the list key store types operation, of the same type. The type `local` cannot be added: each organisation can already use the key store of the installation.
📄️ Read key store
Reads one key store of the organisation. The answer never has a credential of the key store.
📄️ Update key store
Changes the name, the settings or the credentials of a key store that the organisation added. The operation changes only the members that the body gives. `settings`, when given, replaces all the settings. A credential field that the body does not give keeps the stored value.
📄️ Delete key store
Deletes a key store that the organisation added. The key store must have no keys of the organisation: delete them first with the delete key operation. The wallet deletes only its record of the key store. It never deletes a key in the key store of the provider (a vault, a cloud KMS, a DPoD partition or a QTSP).
📄️ Test key store
Does a connection test of a key store, then saves the result in `lastCheckedAt` and `lastCheckResult`, and sets `status` to `active` or `error`. The request has no body.
📄️ List provider keys
Lists the keys that the provider of a key store has, so that you can sign with one of them. Give its `providerKeyRef` to the create key operation.
📄️ List keys
Lists one page of the signing keys of the organisation, from all key stores or from one key store. The wallet uses these keys to sign OID4VCI credentials, status lists, signed issuer metadata and OpenID4VP requests. This operation returns public key material only. It never returns the private part of a key.
📄️ Create key
Adds a signing key to the organisation in one of two ways:
📄️ Import key
Imports a private key that you already have into a key store that can import keys (capability `import`: `local` with the OpenBao backend, and `vault`). A cloud KMS, a DPoD partition and the hardware security module of the installation never import a key: create the key there, or reference a key that you made there. The X.509 certificate chain of the key is optional. With a chain, the key gets the chain as its `x5c` value, so it can sign with the `x509` format at once.
📄️ Read key
Reads one signing key of the organisation by its key ID, with the key store that holds it. The key has the shape of a key in the list keys operation, without `usage`. This operation returns public key material only. A sandbox API key reads the keys of the main organisation.
📄️ Update key
Names a key or removes its name, and changes the PIN of a QTSP key. The operation changes only the members that the body gives. The name is free text that an administrator gives a key, for example what it signs. The key ID is made by the wallet and cannot change. This operation does not change which key is the default key (`isDefault`).
📄️ Delete key
Deletes a key of the organisation. The wallet deletes only its record of the key. It never deletes the key in a key store of the organisation (`vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`, `dpod`) or at a QTSP (`csc`).
📄️ Read key usage
Reports where a key is in use: the credential definitions and presentation definitions that sign with it, the status lists of those credential definitions, the issuances and verifications in flight, and whether the key can be deleted. The items come last changed first.
📄️ Generate CSR
Generates a Certificate Signing Request (CSR) for a key. Send the CSR to a Certificate Authority (CA), then upload the signed certificate chain with the upload certificate chain operation. For development and testing, the create test certificate operation gives the key a certificate of the built-in test CA in one call.
📄️ Upload certificate chain
Uploads a certificate chain and links it to a key. The wallet then adds the chain as the `x5c` value of the key, and the key can sign with the `x509` format. A chain that the key already has is replaced.
📄️ Delete certificate chain
Removes the certificate chain of a key. The key then has no `x5c`, `x5t` and `x5t#S256` values, and it cannot sign with the `x509` format until you upload a new chain with the upload certificate chain operation.
📄️ Create test certificate
Gives a key a certificate of the built-in test CA of the organisation, in one call. For development and testing only: the test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it.
📄️ Look up a key in the trust lists
Checks whether the trust sources of the organisation know a signing key: the trust list lookup service of the platform, the trust lists of the organisation, and the X.509 CAs of its trust authorities. Use it before you select a key for a credential definition or a presentation definition. The dashboard shows the same result in **Trust List Lookup**.
📄️ List certificate presets
Lists the certificate presets. A preset is a certificate profile of the ecosystem: the values that the profile fixes (key usage, extended key usage and their criticality, certificate policies, QC statements), the fields that a request must have, the longest validity, and the prefill from the data of the organisation. Give the `preset` in the generate CSR and the create test certificate operations.
📄️ Read test CA
Lists the test root CAs of the organisation: for each root, its trust domain, the root certificate (PEM), its subject and validity, the URL of its CRL and the URL of the root certificate. For development and testing only.
📄️ Create test CA
Makes the test root CA of the organisation for one trust domain, with a country. For development and testing only. The organisation has one test root for each trust domain (`mdoc-iaca`, `provider` and `access`, see TestCa), and a second create for the same domain gives `409`. The first test certificate of a domain also makes its root, so use this operation to choose the country before the first test certificate of the domain.