Create key
Adds a signing key to the organisation. There are two ways:
List keys
Lists one page of the signing keys of the organisation, from all key stores or from one. Use it to choose the key (its `keyId`) that a credential definition, a presentation definition or a configuration signs with. The wallet signs credentials, status lists, signed issuer metadata and OpenID4VP requests with these keys.
Read key
Returns one signing key of the organisation: its key store, public JWK, certificate chain values and certificate assessment. The same shape as an item of [List keys](/docs/openid4vc-api/config-digital-wallet-open-id-list-keys), without `usage`. Public values only. A retired key gives `404`, and so does the wallet key of the organisation (the automatic key of the deployment, the holder identity of the organisation wallet) while it has no certificate chain. A sandbox organisation reads the keys of its main organisation.
Update key
Changes the name of a key, and the PIN of a key of a remote signing key store (`csc`). Only the members in the body change. The key ID, the key material and the key store never change here. The answer is the key as [Read key](/docs/openid4vc-api/config-digital-wallet-open-id-read-key) returns it. A call with a sandbox API key changes the key of the main organisation.
Delete key
Retires a key of the organisation. Send the body `{'confirm': 'DELETE'}`. A key is never deleted: its delete makes it a retired key.
Import key
Imports a private key that you already have, optionally with its X.509 certificate chain, into a key store with the capability `import`: the local key store with the OpenBao backend, or a `vault` key store (where the wallet uses the wrapping key of the vault). A cloud KMS, a DPoD partition and the HSM of the installation never import a key: create the key there or reference it with [Create key](/docs/openid4vc-api/config-digital-wallet-open-id-create-key).
Read key usage
Shows where a key is in use, whether [Delete key](/docs/openid4vc-api/config-digital-wallet-open-id-delete-key) can retire it (`canDelete`), and what signs with its certificate chain, so whether [Delete certificate chain](/docs/openid4vc-api/config-digital-wallet-open-id-delete-certificate-chain) can remove the chain (`certificateChainUses`, `canDeleteCertificateChain`). Check it before you retire a key or change its certificate chain.