---
id: config-digital-wallet-open-id-create-key-store
title: "Create key store"
description: "Adds a key store of a provider to the organisation: an external OpenBao or HashiCorp Vault (`vault`), a key ring in Google Cloud KMS (`gcp-kms`), one region of AWS KMS (`aws-kms`), an Azure key vault or managed HSM (`azure-key-vault`), a Thales Luna Cloud HSM partition (`dpod`), or a remote signing service with the Cloud Signature Consortium (CSC) API (`csc`), for example a qualified trust service provider. Give the provider in `provider`: an `id` of the providers of the list key store types operation, of the same type. The type `local` cannot be added: each organisation can already use the key store of the installation."
sidebar_label: "Create key store"
hide_title: true
hide_table_of_contents: true
api: eJztPGlv3Diyf4XQJxtQd9qZzGK3Nwiep52Z8ebyxk4CvMSAaIndzbVEKiRlpzfxf19U8RB1dNuezCzew/hD4pbEo1isu4r8mhRM54rXhkuRzJPDotCEkku2IdpIxYhcEkpqJa94wRQxkpg1I1KtqOCaQqc5oYKwL4YpQUvypmbiJyqJVORXqtd8IVVN3tOmNGQvu4K/2X7qJlBcrAgX5BcpVyUji1I2BXnx6pTsZau8nlxWGtpKwYhiKy4FwHL44dQ1odfaN6GCHP67UQxHxUlg/ooKumIF+fX0FTSHBpNLtplEUJytack0edkI6qaHxjVVhsPSyF5W1LJAKBShRLFKGkY0XwkAXTN1xXNGrrlZI1rsEKd8JagBcBZSaKkMbyqytzhd7JPDk2Oyl+U6hyGXUhH2hVZ1yQglnxta8iVnBTGq0SYM7lE/Jb/wK4bThN3ggmT+IcN9yHiRAZriZtq/KLk20c6aTc00kTVTuI+pb6ZpZT9Oydna/iJZKXNaZiSnQkhDLhihRcGKOWE0X3fIAZoQWipGiw1ptIW4Q07wggttaFlij+kn8UnATNe0LJkh+ZrllxqbLaWqqAmAMWO4WGlCReHf5YoVTBhOS53CC0EKyYCCcykEyxEiw7SZkmNDNL1iug+QKDfkGjrCe2hKaqo10wjWN3IGy/8GWxkPR759Et8mkwn+g2aOtsk38lIiUQeioA2AZXhu0VMxs5ZFSgBB+H3NaGnWfj2WemGBuFsO1rCFZ4oKzQ2pZCPMlNipPbPA5GOdPK/59p5ztrW33BZa9xiHfCO/MEMoMfKSCd+H1nXpl7hUsiKveK6klktDngujKDk+2r4qHNjPhxxHvpGTxgy2ilBkPqaIXlNVpGQVeCLwrBNRwMiureeHkhogqJRcU27IHgU0akP+NiOa5VIUep80wvCyNyDXhOaGXzFHYDAqruWKKb7c2J2mRDOtoTnAa9bUWEIEbtGGboAkOsNOyYcO0S0pdyTs+aBgJTMDeqUrysPegCTx+yHIm8PGrMnj6cxtTQffEaNg70/ikCi+WhsLbHeSALrFr4zBgleaZMCwPR7DNYBQeME2TvpWTLSiTLFlo1nhaOxzw7TJrIxxQ9sGwN8gXhTTGtAG6odfUcOIYOZaqsuUNKKEj31JQmhZymsd2rtBmLaz5EHBWNEH0gnZH1XacslzTkvCRFFLLozuy9EgpyJUEqoYuVbcsAmMNCWvJaFCXzNFFDONEghkNSWHYigl1/SKEU+FoOY6YhIlayv9D4mmoriQXwbjwD7Rooi19vSTSNIkiPbjIpknuRRLvjriK25o+QERDsr6uFgoRg17wTan0DVJE7c3P8lik8y/9gwErxIsqQpauV8d4dwjuFgQWfjcLFyxIpkb1bAU4DNMGJgxEiaP/qVh2q+JztesovALZk/mibz4F8tNkia1goUaznT7NbTSBiRfkvZXAVJ9DCommiqZf0xQJCVp4mRrkiZOasKvrkSEwWtZJGmS6zw5TxOn1JO5G+UGYcR9HIOsol9eMrEy62T+lycDQGN93wc4/U6VPyVv3SZYBgkTVWCBOEW/5kXBBLnYDNgtxb3mRlsbATtdMJLBU4bIDIiQNRMXVAIqgGRuQcPBbNbHw2swSkbW77jnYDYj+ZoqmhumNCp7D04j+OeGefkbM08XxEWjjayYImHTPEkPmeDUE7uDqLWWhpKsEZdCXoPiry6YQpSNWjjI71e0bBjZi01DaAVWr9XKltmstWuYoMJ4zWoth3dvX9omHaO6VhKYhRwf7aMo4uKKlrxw0zmJ/mQ2y6wyy54uOSuLZ3PytFbyomTVM9xPKdibZTL/OORBw01E8P3Ni9F1R2fBIbYj6/asKers9w6+QSfr1ubyZpJmuWJGEyZWXLCuudERQR8TpyuAvTsGW3J+k25fbysedqx4t7OzY6XBC7JrDcMgabMvHMza2HCmJcjarRqNZKgBLys9XSEUtOZ6mssq6yPD0UuSJmD345rS5JJt3gKr7kRIKyW3I6Tr0YHz9uGU0DwHm3YXOoLHd6dVe08xrL5n3R5HFlowxqGTVZSNcsYsBw9RKvzMxBVXUqBV04rcnGndx6Cd5RZcDfXILra5xcXdhbi+79tB4Ao4BKUYWI36vhZ9D/9BDN2i9J2KfadKwAhKsmPUoSVn7ud9GNFp4F1c2Fr0+Dju+3tbdQc20UFJff8jaig5UdI4Q1gKcsQqKooxAWXWSjar9S0OilPGAVyvZRdqUxtJ3gCFg4Epy1bpcsHB1OJgXy+50obsHZ3II0ueRaPYfh/9uNsv6QUrd2MWjJrdiL0tdEH2/nl2erKPAY9eCOWeoRO7ARg/6S8n17mlpYiAGs3UcZGc35zfpElkjw4V+odgwo/ZrVa9h/hL3CI4T8H+Ba8CFbgPCcD2DVgw3WYjj4YL9r9H+25fWy/OF6vX0eXuhHHM96FR52nyWxTpPYH3GvP7gNmmxO4JjNdXdq9pDnoC21l5fnz4CohFfSestyiR+8Lco9MtZP/HEcKoIL/nIlBCWylqZaFZK8astWtdducNgHIn2WKtNtrISz4F1R+cKS/GrEAhNc0v6SpoBpSursmUHJYlWcpG4eBeLNmw4kY2ADTEI7rq8DY0dXQ0d5HLymnaOwS51jxfk0vG6rgjR0dEqo0L7saIkcshLoInaIMVYBwZJcvW2UpJ9vcsJdnXDAyS7CZLQwQg+EKV9HFXXdMct0A2tlHVWWaAlpwcvyZUE24g/AarF+i4NHUBiLTtYmxZQQy4LhlAKhuzm87G1No9yQz00B2I/fzmpqd5AaQoJuB84sjhBH3l/D9UVt59hjhIU1VUbZJ54rynlBzW9VtZwgC4kZFz7UVCG34IQ3lHvPV73XhJ1/H1ftE8WRtT6/mjR26EqQMQHIj5Xx/PZm5I3OJkLpqyTBNjHbFXYNonc/84tO3mXxMrPECi1bWyy4E/GLt6upGNeotPz5KboTK3fl7b9NQ9Q+ObNFmDc5lLVaNv2cViz/FMUSRjXAvpGHIB11IVd0NumCgI4z6S/fvdKLYe6h+FYFghrMtZSA5Ey4Jj2A04cNg9cc8Ou6u8flHpLlb7Xm4apKn38y7ZZgSnrRkQYdU6qxN0Xt1XB3N/mh5ivRs7T6rNZMSnnSesgeDh5JppcxC5uPNEXuuJM1ItMM6+f8muWAlkc/oqGaNDXOShXeMLBqh4akP8X0xfr0SYQEXk0Emv9QCdzpdNIyNiBHmt2RIhr33pcObG6qHK+auAkUnOwL8rJwe38CnCAoscoZnwsWXKw/bVM5wdeDS87LJueO2RAmbJC7YZYWDrFkPKwTGw09d2/DE0DSymGF2Djx5t3Wl66Au+bMvDlRtiav/HgacCIQrurlvzmXt+Frsv7tvCPT+z5Hlm1/B8MQEK3Lk/diSLz7Et6nzvzGbfOdSjQdbB+LjnjP7mfuu2jmDe2XYRug0ONXEfHKpHx+8hPPJe+8yqmeK0fN1AuNWKyRHybMz6DIZYYLDnneKAgcPe27fHzxyK7dtoaw77L0datqg9HPsAPWouAurRu3fO/QkXDv1gp3SwfywM05z8omRTp2RxukDX+GA6mz6ZzkaQbg2dCOccB2jRHQ/Yw7JzqluidrJLTyHf96TiogDtBEuv+XumtJUhVwe3ELJzzN2Xd/j0bESe3olEb26sgaVrKbS1lx7PDsYzV172AvisQA0PRQHFMK9SOHOOQewF3O/fnJ/yFmeUYevV3MQZGjBj17IsdIiRxJnyTvoCLWdnewp2xRRZ055VPBaD6+bLeHF7tuydS6HgqEs+komaugqRiTMOwSOwLwpq6AXVzLoH9t1aVxlGg/pm9SDBxEoNXse7d8dH3WxNZzagnO/J+4XyFj6ofRqkmPd80sLlGLope7fY1AeMoUrhGnxCzfJGcbMhlSyacnTo/Sl5PlpNAxElmMj7VcDvbd43BV9MgGOqXMkAEGyIPnH9HSmXaVRcEnCzLZMxjSpLuN4d5d9zVsj+dKTAxIK8O9w99YUiCNa9QrtWUU1d9QT2/z0Ku+5b0OWionHSGakQRfjvkXy2o92SfAb1SC+gvc3C/xezz900ZxZJjp4bBa/6PoAVJ1aVQT4jg4V4oeLZOeLwY+NZxnLLsCIDZefdijFiSeTsi98xq43Acn3nxPVLWGybtbbb3oJyIWXJqBjG8NdQKpPBtt9JGPvou8XtfgcGGAQS5oaaRt8uhU+x3ZgctoVWWVuQ14IElT96SjKmlFQZoUsD2fRBDRIqUFuIBDKCa6BuKycUAx5kRcxydkKA0LWEbzBDl5dcs5vYFbw/O31YM+VLOG2FUqvbuY6LvBAZkGsD5ZHNPRH4N21IaqTMas+TfxBfFzS/ZJCF8DyGzBM0c+qVRRqJ+9C5XTApwfkl2embn88+HL59Du0Hwjv0wzo4pJjnC+RQ0PphJfdRjLtWBIO6wSf4srBz0LjaC0iiDS0izrnYCkIgzNzXTjh53UNO9uvpK0RBCPNvwUZmvTWEs2AFWI6smAR00O3I6Oi1YT7SVSdPu1XApiOMfSC4YDkvmCZreQ1RVberEUZcXfJQMLZkCSIS2mctTaDwh+RkO58rzoOXISlmZ48Zz5NykiZrXdn/3Q6ivIjQFLsvHa4MY9yrWKerkKbkNZrO1AUM7pZp85r6tqqPO0tTtOU7DbRLy1ejhp+z+Vxx4VDj4V4J2Sn73BkPf6jceajceajceajceajceajc+b9bubNwHM6KsUhbd6k/g3cJflsUD8O61nFDIPW+UPA9HAHYoBqGVbeE3Cz34PfnVW02iC/TOzvl6xFYWeh5CM9kPrkG5qNPY8Jv3GT4YbFyYh2GF2yT/T2y0rNBxgk+hzBMFqVh2glCcgXb9k3WLA66tgAsIGS4RKNsG1Q2IJMNY+toGvcD5iMv2zlrLmBEjNAMAALiOOECdR8tCmQ1Wp6MHAMIzu9NZDZ+xbA6rekFL3mvPVWKboZ1AcMTMhCXK2R0Qi6Ya200ca9HZDgKvQTNxa7R6N6fk8zWhsC6eFVLhSsEJkMsa4V/Wtwv1pTjJ3B2M7InZOi3wzuKAZJmzdRu4xTAuisIIdK4ZSmKLZliImd3XBfEjE6c+HnBNjpMlJKMFRz/2jBnFkUnb3HDsAQPybMD5R8IW2dnfLBxvmXK+6w5SRNuWDUaZfG+lV0htMT5Ud66aSHBw1cC44VQedJfJhiOPWhQy2sYBWBB5gBQ4iKV8UlvmwhHhVE+67wY8dswQMX7snroyMd6TAc9hPCAEi6YDYv883SBYd8lLTHoATGQ4Df3RDbsFnjOPl4DatC70J3IFw52gyb2wtZghG2B4OQKy3t6QT/MTALfbcvs+CBJ92SSn/IHwJhf8OnWkNvuUNQbsPpGon7RWW8buwgzZV4/7sEerqTakOyz0XUG0iJqheoTVOPG1zp294/raLucZ2tfUwPFW234NSWZkGbSH9tCzNH+dxmizB2yyTqBYAtET97NwSvuy8C8pLzSXUJCxE7JKWO4cJC27VriSEboA0iP4QU7xsLVCVu4iHFJtVnAQSBWHJrfEJrnbegYhuoHQlMgondni4CRC7aUjppdUSQcix4JZQfA3jLtqi1oWd4SEPHJzbhjH2T72lJZP2zbjZgM05Ty8r4h7WDG9afC493FWPy6YlrT1Wgc/7bA7mZ0KhuHTglakJoubSEQerBxwtaaZd5VLZihvCS9pErYx5Gz6sXYNua/D21tI6tOCuLx7PFfJgezyePZ2cFsPvtxPpv9b9Ive5SXSYviGL7zm/PbIGpJZxu930bn1o+AkOJvwcjCKxPDR88h3gEpM4uUNLE1rL8T07vU73cA1NslDmJra4Wqj3u6TE8nHRLFYLf5bD2722n+SHsONVtfUA7lU7yxMXbPbe0no5CSdGb/k9kM60ruWssRYwbTQgtZMJ8iOor25jwdiMauAGt7j1kIYZOezGY3I8OPGXthX3+iBeGibkAaKFoxw1TiqmKG6dwLWWx6J7ad3Okfa4fwmj0mujd2IBQvUOkXYHfGFQyKZzSpuNYQMtjL4mj0UyCpZ/NQLQ8DBgOMa++0pB0pGA2X+pO16Y4jyrA2jMFZjd8eXO+aW1Y8D4/XhzqOccFO9nZeg/DUCbtn6AD09zQjhkH87Xq9GSiIZEi3B39iun0nIFAgFf83ypA+an74E6NmkDYKkfHSXgrSIfTeNREh84w8Z4m5GxQjT+H/Z87atvdrAFML269zjY+9JsmWwfhQ64AfXVoqCqHCtL2hRlrBoDYs6oOrempDiX1q+NufnBq6G+4uYrJ2ZlRMYUNFsK14g8dY+QfXce77zkP3+1qdYYdBkT+2bT/+qfUyVOBiWhXrUxSxBShDHP3ZBd3WUrQgn64oR/N5XBK18kSPhT3tGTchyRIOxYGlmnPjoyTtxU29jcHaA1u2gR7yYc3xOMNHdGsMhZKEj4m7d4fYi3dsFenx0ZP3i/0kBeeZvAqFPLAfoYi/lhh5qylUkCWPrh4/sknOR4UdcGKTFHgoixePIObZlgThIyJI27r4KwT6Yz/SdsQq6WgPLOhOxXfBKjmhNZ/ylaLCTLnEMoLuACdKFk3uyhZGh7lthFNDV770cqS7tp/7gJy3uD8Furfk6negjerbF2mC1fZ286KTHc628NnyXnH2yTHSWTelaQP/9voUR0lZZ5yM2GlCmq9WbMm/wKFQDKtZGAnGid3JUKMoLxEHcMBrPyVsupr2hp0T1xFL4QEdEOaG21mADkEGvG0vb3oeMh6/6Tzgf+2oWk6j5JJvPcg6+Q93O9hW2Vlsl+Ept/ZsoW2BBw5t5OQ+59/SHScPU5unDWd84KE94NNmzrrnGtr3J6yyZx25WEov+GmOgp9VlAN76KaGWPv/tCwRtpH/0r7q8lLMhj1iD528qLU3KcLWQlk5/AW5QuOSNCvJUEq+hwvxOMhfsoicyWOtGyogBP8GRd7xPsZ9xzueQJWmnyKIyZN9rFiTuSzxMjeuMa3MBPTRzjCxLKLhcDTXumEpHqRI47v6nNTs+LoNOqfaUFFQVegJrpfDzUpLvE0OGdZhGqH98MOCvF+QvX98ONtPyfHzs5/J6dHkHx/OyPuFne349A05+Ovs4IfJj6Q6kvmj6uhlJw2Ntz5hJqHkORMamdTLo5rmawb3+A227vr6ekrx81Sq1SPXVz96ebx4/vr0+QT63LRB2XY7AVmFzJuwe1BlHs7rPJ49fjL9YXqA9a1Sm4qKCB57P1yrbPsiMjJJHq6Pfbg+9uH62IfrYx+uj324Pvbh+tj/59fHOp8BAtKP6hJKNm6cPfLV+aMfk6vH9mTskuMpn45Pam+gFdwleCK/1L1wnul5mqzBy51/TL5+hQMp71R5cwOvPzdMoScNR+IUt3mxj+chq4Ou7CWa0AtrgkzObObKHYIeRkjA87Q9oAquNjvbxo74yZvTsyRNLtyluBVGQxJFr8GXoNfJPPmUfEpwzWiFYgQG3n9NSipWDeaVEzsu3mjQAAZjF9Ve6uB+RLl2KqLLHgbeql0M/B+Vgna7PAW7Ae9S8M3tl60dgodsW8POQzLtP6TVyg0=
sidebar_class_name: "post api-method"
info_path: docs/openid4vc-api/igrant-io-api-documentation
custom_edit_url: null
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import ApiTabs from "@theme/ApiTabs";
import DiscriminatorTabs from "@theme/DiscriminatorTabs";
import MethodEndpoint from "@theme/ApiExplorer/MethodEndpoint";
import SecuritySchemes from "@theme/ApiExplorer/SecuritySchemes";
import MimeTabs from "@theme/MimeTabs";
import ParamsItem from "@theme/ParamsItem";
import ResponseSamples from "@theme/ResponseSamples";
import SchemaItem from "@theme/SchemaItem";
import SchemaTabs from "@theme/SchemaTabs";
import Markdown from "@theme/Markdown";
import OperationTabs from "@theme/OperationTabs";
import TabItem from "@theme/TabItem";

<h1 className={"openapi__heading"}>Create key store</h1>

<MethodEndpoint method={"post"} path={"/v2/config/digital-wallet/openid/key-management/key-stores"}></MethodEndpoint>



Adds a key store of a provider to the organisation: an external OpenBao or HashiCorp Vault (`vault`), a key ring in Google Cloud KMS (`gcp-kms`), one region of AWS KMS (`aws-kms`), an Azure key vault or managed HSM (`azure-key-vault`), a Thales Luna Cloud HSM partition (`dpod`), or a remote signing service with the Cloud Signature Consortium (CSC) API (`csc`), for example a qualified trust service provider. Give the provider in `provider`: an `id` of the providers of the list key store types operation, of the same type. The type `local` cannot be added: each organisation can already use the key store of the installation.

The wallet checks the format of the settings and of the credentials, then does a connection test. It saves the key store only when the test passes.

| Type | Connection test |
|---|---|
| `vault` | Log in with the authentication method, read the health of the vault and list the keys of the Transit mount. |
| `gcp-kms` | List the keys of the key ring. |
| `aws-kms` | List the keys of the region. |
| `azure-key-vault` | Get a token of the application from Microsoft Entra ID and list the keys of the vault. |
| `dpod` | Put the key store on a signer shard, give the partition to the HSM signer of the platform, wait (at most 90 seconds) until the partition is active, then sign and verify with a session key that does not stay in the partition. When the test fails, the wallet deletes the key store again. |
| `csc` | Get an OAuth 2.0 token and list the credentials. |

A right that the key store does not give to the wallet gives `The connection test failed: Key management service refused the request`. The wallet refuses an address in a private network, unless the installation allows private addresses. The cloud KMS types use only the official endpoints of the provider.

The credentials are write-only. No answer returns them. An organisation can have at most one key store of each provider. A sandbox organisation cannot add a key store.


## Request

<MimeTabs className={"openapi-tabs__mime"}><TabItem label={"application/json"} value={"application/json-schema"}><details style={{}} className={"openapi-markdown__details mime"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-mime"}><h3 className={"openapi-markdown__details-summary-header-body"}>Body</h3><strong className={"openapi-schema__required"}>required</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}><div style={{"marginTop":"1rem","marginBottom":"1rem"}}>

The type, the name, the settings and the credentials of the key store.

</div></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"type"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`, `dpod`, `csc`]"} schema={{"type":"string","description":"Type of the key store.","enum":["vault","gcp-kms","aws-kms","azure-key-vault","dpod","csc"],"example":"vault"}}></SchemaItem><SchemaItem collapsible={false} name={"provider"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 64 characters`"} schema={{"type":"string","maxLength":64,"description":"The provider of the key store, an `id` of the providers of the list key store types operation. Required. The provider must not be hidden by the installation, and its type must be `type`.","example":"openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 100 characters`"} schema={{"type":"string","maxLength":100,"description":"Name of the key store, at most 100 characters. It must be unique in the organisation.","example":"Customer vault"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><strong>settings</strong><span style={{"opacity":"0.6"}}> object</span><strong style={{"fontSize":"var(--ifm-code-font-size)","color":"var(--openapi-required)"}}> required</strong></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Settings of the type. The wallet refuses an unknown member and checks the format of each value (for example the AWS region, the Azure tenant ID and vault URL, the Google Cloud project ID). An invalid value gives `400` with `<field>: <problem>`.

</div></div><div><span className={"badge badge--info"}>oneOf</span><SchemaTabs><TabItem label={"vault"} value={"0-item-properties"}><SchemaItem collapsible={false} name={"address"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base address of the vault, with `https://`. The wallet refuses `http://` and private network addresses, unless the installation allows private addresses (for example on premises).","example":"https://vault.example.com:8200"}}></SchemaItem><SchemaItem collapsible={false} name={"namespace"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Namespace in the vault. Leave it out or send `null` when the vault has no namespaces.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"transitMount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the Transit secrets engine. The default is `transit`.","example":"transit"}}></SchemaItem><SchemaItem collapsible={false} name={"caCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM bundle of the certificate authorities that the wallet trusts for the TLS certificate of the vault. Without it, the wallet uses the system certificate authorities.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"clientCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM client certificate for mutual TLS. Required for the authentication method `cert`. With another method, send it when the listener of the vault requires mutual TLS. The private key of the certificate goes in the credential `clientPrivateKey`.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to the vault.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`userpass`, `approle`, `cert`, `token`]"} schema={{"type":"string","description":"Authentication method. `userpass` needs `username` and the credential `password`. `approle` needs `roleId` and the credential `secretId`. `cert` needs `clientCertificate` and the credential `clientPrivateKey`, and can have `role`. `token` needs the credential `token`.","enum":["userpass","approle","cert","token"],"example":"userpass"}}></SchemaItem><SchemaItem collapsible={false} name={"mount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the authentication method. The default is the name of the method (`userpass`, `approle` or `cert`).","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"username"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"User name, for the method `userpass`.","example":"wallet"}}></SchemaItem><SchemaItem collapsible={false} name={"roleId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Role ID, for the method `approle`.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"role"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Name of the certificate role, for the method `cert`. Optional.","example":null}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"gcp-kms"} value={"1-item-properties"}><SchemaItem collapsible={false} name={"project"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Google Cloud project ID of the key ring. A domain-scoped project ID (`example.com:my-project`) is also accepted.","example":"my-project"}}></SchemaItem><SchemaItem collapsible={false} name={"location"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Cloud KMS location of the key ring, for example `europe-west1`.","example":"europe-west1"}}></SchemaItem><SchemaItem collapsible={false} name={"keyRing"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 63 characters`"} schema={{"type":"string","maxLength":63,"description":"The name of the key ring. Letters, digits, `_` and `-`, at most 63 characters.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"protectionLevel"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`HSM`, `SOFTWARE`]"} schema={{"type":"string","description":"The protection level of the keys that the wallet creates. `HSM` (default) keeps the keys in hardware security modules of Google Cloud (the key store `protection` is `hsm-backed`). `SOFTWARE` keeps them in software (the key store `protection` is `software`).","enum":["HSM","SOFTWARE"],"example":"HSM"}}></SchemaItem></TabItem><TabItem label={"aws-kms"} value={"2-item-properties"}><SchemaItem collapsible={false} name={"region"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The AWS region of the keys, for example `eu-central-1`. Free text with a format check, not a fixed list.","example":"eu-central-1"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to AWS KMS.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`accessKey`]"} schema={{"type":"string","description":"Authentication method. `accessKey` (the only method) needs the credentials `accessKeyId` and `secretAccessKey`.","enum":["accessKey"],"example":"accessKey"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"azure-key-vault"} value={"3-item-properties"}><SchemaItem collapsible={false} name={"vaultUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The URL of the key vault (`https://<name>.vault.azure.net`) or of the managed HSM (`https://<name>.managedhsm.azure.net`), without a path and without a trailing `/`.","example":"https://my-vault.vault.azure.net"}}></SchemaItem><SchemaItem collapsible={false} name={"tenantId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Microsoft Entra tenant ID, a GUID or a domain name (for example `contoso.onmicrosoft.com`).","example":"00000000-0000-0000-0000-000000000000"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The application (client) ID of the app registration, a GUID.","example":"11111111-1111-1111-1111-111111111111"}}></SchemaItem><SchemaItem collapsible={false} name={"keyType"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`EC-HSM`, `EC`]"} schema={{"type":"string","description":"The key type of the keys that the wallet creates. `EC-HSM` (default) keeps the keys in hardware security modules (the key store `protection` is `hsm-backed`). `EC` keeps them in software (the key store `protection` is `software`). A managed HSM has `EC-HSM` keys only.","enum":["EC-HSM","EC"],"example":"EC-HSM"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the application logs in to Microsoft Entra ID.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`clientSecret`, `clientCertificate`]"} schema={{"type":"string","description":"Authentication method. `clientSecret` needs the credential `clientSecret`. `clientCertificate` needs the credentials `clientCertificate` and `clientPrivateKey`.","enum":["clientSecret","clientCertificate"],"example":"clientSecret"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"dpod"} value={"4-item-properties"}><SchemaItem collapsible={false} name={"tokenLabel"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 32 characters`"} schema={{"type":"string","maxLength":32,"description":"The label of the partition, at most 32 bytes in UTF-8, without a control character, `;`, `{` or `}`. The wallet removes the spaces around it.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"serialNumber"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** Value must match regular expression `^[0-9]{1,16}$`"} schema={{"type":"string","nullable":true,"pattern":"^[0-9]{1,16}$","description":"The serial number of the partition, a string of 1 to 16 digits. Optional; an empty string is the same as `null`, and a number is refused. When given, the HSM signer checks that the partition has this serial number.","example":null}}></SchemaItem></TabItem><TabItem label={"csc"} value={"5-item-properties"}><SchemaItem collapsible={false} name={"cscUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base URL of the CSC API of the QTSP, with `https://`.","example":"https://qtsp.example.com/csc"}}></SchemaItem><SchemaItem collapsible={false} name={"apiVersion"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`v1`, `v2`]"} schema={{"type":"string","description":"Version of the CSC API. The default is `v1`.","enum":["v1","v2"],"example":"v1"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"OAuth 2.0 client ID that the QTSP gave the organisation.","example":"client"}}></SchemaItem><SchemaItem collapsible={false} name={"userId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"User ID that the QTSP registered for the organisation.","example":"user-1"}}></SchemaItem></TabItem></SchemaTabs></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><strong>credentials</strong><span style={{"opacity":"0.6"}}> object</span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Write-only credentials of the type. Give the credentials that the settings use (for `vault` and `azure-key-vault`, the credentials of the authentication method).

</div></div><div><span className={"badge badge--info"}>oneOf</span><SchemaTabs><TabItem label={"vault"} value={"0-item-properties"}><SchemaItem collapsible={false} name={"password"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Password, for the method `userpass`.","example":"<yourPassword>"}}></SchemaItem><SchemaItem collapsible={false} name={"secretId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Secret ID, for the method `approle`.","example":"<yourSecretId>"}}></SchemaItem><SchemaItem collapsible={false} name={"token"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Vault token, for the method `token`.","example":"<yourToken>"}}></SchemaItem><SchemaItem collapsible={false} name={"clientPrivateKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"PEM private key of `clientCertificate`, without a password. Required for the method `cert`, and when you give `clientCertificate` with another method.","example":"<yourClientPrivateKeyPem>"}}></SchemaItem></TabItem><TabItem label={"gcp-kms"} value={"1-item-properties"}><SchemaItem collapsible={false} name={"serviceAccountKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The JSON key file of a Google Cloud service account, as one string (the text of the file, not an object). Required. The wallet checks that the text is JSON, that `type` is `service_account`, that it has `client_email` and a PEM `private_key`, and that the service account is of `googleapis.com`. The wallet never sends a request to an address of the key file.","example":"<the text of the service account key file>"}}></SchemaItem></TabItem><TabItem label={"aws-kms"} value={"2-item-properties"}><SchemaItem collapsible={false} name={"accessKeyId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The access key ID. Required.","example":"<yourAccessKeyId>"}}></SchemaItem><SchemaItem collapsible={false} name={"secretAccessKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The secret access key. Required.","example":"<yourSecretAccessKey>"}}></SchemaItem></TabItem><TabItem label={"azure-key-vault"} value={"3-item-properties"}><SchemaItem collapsible={false} name={"clientSecret"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The client secret of the application, for the method `clientSecret`.","example":"<yourClientSecret>"}}></SchemaItem><SchemaItem collapsible={false} name={"clientCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The PEM certificate of the application, for the method `clientCertificate`.","example":"<yourClientCertificatePem>"}}></SchemaItem><SchemaItem collapsible={false} name={"clientPrivateKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The PEM private key of `clientCertificate`, without a password, for the method `clientCertificate`. It must be the private key of the certificate.","example":"<yourClientPrivateKeyPem>"}}></SchemaItem></TabItem><TabItem label={"dpod"} value={"4-item-properties"}><SchemaItem collapsible={false} name={"authTokenConfigUri"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 2048 characters`"} schema={{"type":"string","maxLength":2048,"description":"The value `AuthTokenConfigURI` of `Chrystoki.conf`, an https URL.","example":"<AuthTokenConfigURI>"}}></SchemaItem><SchemaItem collapsible={false} name={"authTokenClientId"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 512 characters`"} schema={{"type":"string","maxLength":512,"description":"The value `AuthTokenClientId` of `Chrystoki.conf`.","example":"<AuthTokenClientId>"}}></SchemaItem><SchemaItem collapsible={false} name={"authTokenClientSecret"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 2048 characters`"} schema={{"type":"string","maxLength":2048,"description":"The value `AuthTokenClientSecret` of `Chrystoki.conf`.","example":"<AuthTokenClientSecret>"}}></SchemaItem><SchemaItem collapsible={false} name={"pin"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 256 characters`"} schema={{"type":"string","maxLength":256,"description":"The PIN of the Crypto Officer of the partition. The HSM signer logs in one time with each new PIN. After a wrong PIN it does not log in again until you give a new PIN, because the partition locks after too many wrong PINs.","example":"<yourCryptoOfficerPin>"}}></SchemaItem></TabItem><TabItem label={"csc"} value={"5-item-properties"}><SchemaItem collapsible={false} name={"clientSecret"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"OAuth 2.0 client secret that the QTSP gave the organisation. Required.","example":"<yourClientSecret>"}}></SchemaItem><SchemaItem collapsible={false} name={"userPin"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"PIN of the user at the QTSP. Optional. The wallet uses it for a referenced key that has no PIN of its own (`providerSecret`), and for document signing.","example":"<yourUserPin>"}}></SchemaItem></TabItem></SchemaTabs></div></details></SchemaItem></ul></details></TabItem></MimeTabs><div><div><ApiTabs label={undefined} id={undefined}><TabItem label={"201"} value={"201"}><div>

The service tested and saved the key store, and returned it.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"id"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Unique identifier of the key store. `local-openbao`, `local-database` or `local-hsm` for a key store of the installation, else a UUID.","example":"local-openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"type"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`local`, `vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`, `dpod`, `csc`]"} schema={{"type":"string","description":"Type of the key store. `local` is a key store of the installation (OpenBao Transit, the wallet database, or the hardware security module of the installation). Each organisation can use it, and the API cannot add, change or delete it. `vault` is an external OpenBao or HashiCorp Vault of the organisation. `gcp-kms` is a key ring in Google Cloud KMS. `aws-kms` is one region of an AWS account (AWS KMS). `azure-key-vault` is an Azure key vault or managed HSM. `dpod` is a partition of a Thales Luna Cloud HSM service (DPoD). `csc` is a remote signing service with the Cloud Signature Consortium (CSC) API, for example a qualified trust service provider (QTSP).","enum":["local","vault","gcp-kms","aws-kms","azure-key-vault","dpod","csc"],"example":"local"}}></SchemaItem><SchemaItem collapsible={false} name={"provider"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The provider of the key store, an `id` of the providers of the list key store types operation (for example `openbao`, `hashicorp-vault`, `google-cloud-kms` or `intesi`). `null` for a `local` key store. It cannot change. An organisation has at most one key store of each provider.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 100 characters`"} schema={{"type":"string","maxLength":100,"description":"Name of the key store. It is unique in the organisation.","example":"Local vault"}}></SchemaItem><SchemaItem collapsible={false} name={"local"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` for a key store of the installation (type `local`).","example":true}}></SchemaItem><SchemaItem collapsible={false} name={"status"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`active`, `disabled`, `error`]"} schema={{"type":"string","description":"Status of the key store. `active` when the key store works. `error` after a connection test that failed. `disabled` is reserved.","enum":["active","disabled","error"],"example":"active"}}></SchemaItem><SchemaItem collapsible={false} name={"protection"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`software`, `hsm`, `hsm-backed`, `dedicated-hsm`, `provider`]"} schema={{"type":"string","nullable":true,"description":"Where the private keys of this key store are. `software`: in the software of a key management service (`local` with the backend `openbao` or `database`, `vault`, `gcp-kms` with the protection level `SOFTWARE`, `azure-key-vault` with the key type `EC`). `hsm`: in the hardware security module of the installation (`local` with the backend `hsm`). `hsm-backed`: in a cloud KMS that keeps the keys in hardware security modules of the cloud provider (`gcp-kms` with `HSM`, `aws-kms`, `azure-key-vault` with `EC-HSM`). `dedicated-hsm`: in a hardware security module partition of the organisation (`dpod`). `provider`: at the provider, which decides how it protects the keys (`csc`). An organisation key store has the `protection` of its provider, unless its settings decide.","enum":["software","hsm","hsm-backed","dedicated-hsm","provider"],"example":"software"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><strong>settings</strong><span style={{"opacity":"0.6"}}> object</span><strong style={{"fontSize":"var(--ifm-code-font-size)","color":"var(--openapi-required)"}}> required</strong></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Settings of the key store type. Never a secret.

</div></div><div><span className={"badge badge--info"}>oneOf</span><SchemaTabs><TabItem label={"local"} value={"0-item-properties"}><SchemaItem collapsible={false} name={"backend"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`openbao`, `database`, `hsm`]"} schema={{"type":"string","description":"Where the installation keeps the keys. `openbao` for OpenBao Transit (`local-openbao`), `database` for the wallet database (`local-database`, legacy, no new keys), `hsm` for the hardware security module of the installation (`local-hsm`). With `hsm`, the new local keys of the organisations go to the HSM; the keys in `local-openbao` stay there and keep working.","enum":["openbao","database","hsm"],"example":"openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"protection"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`software`, `hsm`]"} schema={{"type":"string","description":"How the key store protects the keys. `software` for the backends `openbao` and `database`, `hsm` for the backend `hsm`.","enum":["software","hsm"],"example":"software"}}></SchemaItem></TabItem><TabItem label={"vault"} value={"1-item-properties"}><SchemaItem collapsible={false} name={"address"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base address of the vault, with `https://`. The wallet refuses `http://` and private network addresses, unless the installation allows private addresses (for example on premises).","example":"https://vault.example.com:8200"}}></SchemaItem><SchemaItem collapsible={false} name={"namespace"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Namespace in the vault. Leave it out or send `null` when the vault has no namespaces.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"transitMount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the Transit secrets engine. The default is `transit`.","example":"transit"}}></SchemaItem><SchemaItem collapsible={false} name={"caCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM bundle of the certificate authorities that the wallet trusts for the TLS certificate of the vault. Without it, the wallet uses the system certificate authorities.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"clientCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM client certificate for mutual TLS. Required for the authentication method `cert`. With another method, send it when the listener of the vault requires mutual TLS. The private key of the certificate goes in the credential `clientPrivateKey`.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to the vault.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`userpass`, `approle`, `cert`, `token`]"} schema={{"type":"string","description":"Authentication method. `userpass` needs `username` and the credential `password`. `approle` needs `roleId` and the credential `secretId`. `cert` needs `clientCertificate` and the credential `clientPrivateKey`, and can have `role`. `token` needs the credential `token`.","enum":["userpass","approle","cert","token"],"example":"userpass"}}></SchemaItem><SchemaItem collapsible={false} name={"mount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the authentication method. The default is the name of the method (`userpass`, `approle` or `cert`).","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"username"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"User name, for the method `userpass`.","example":"wallet"}}></SchemaItem><SchemaItem collapsible={false} name={"roleId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Role ID, for the method `approle`.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"role"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Name of the certificate role, for the method `cert`. Optional.","example":null}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"gcp-kms"} value={"2-item-properties"}><SchemaItem collapsible={false} name={"project"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Google Cloud project ID of the key ring. A domain-scoped project ID (`example.com:my-project`) is also accepted.","example":"my-project"}}></SchemaItem><SchemaItem collapsible={false} name={"location"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Cloud KMS location of the key ring, for example `europe-west1`.","example":"europe-west1"}}></SchemaItem><SchemaItem collapsible={false} name={"keyRing"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 63 characters`"} schema={{"type":"string","maxLength":63,"description":"The name of the key ring. Letters, digits, `_` and `-`, at most 63 characters.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"protectionLevel"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`HSM`, `SOFTWARE`]"} schema={{"type":"string","description":"The protection level of the keys that the wallet creates. `HSM` (default) keeps the keys in hardware security modules of Google Cloud (the key store `protection` is `hsm-backed`). `SOFTWARE` keeps them in software (the key store `protection` is `software`).","enum":["HSM","SOFTWARE"],"example":"HSM"}}></SchemaItem></TabItem><TabItem label={"aws-kms"} value={"3-item-properties"}><SchemaItem collapsible={false} name={"region"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The AWS region of the keys, for example `eu-central-1`. Free text with a format check, not a fixed list.","example":"eu-central-1"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to AWS KMS.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`accessKey`]"} schema={{"type":"string","description":"Authentication method. `accessKey` (the only method) needs the credentials `accessKeyId` and `secretAccessKey`.","enum":["accessKey"],"example":"accessKey"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"azure-key-vault"} value={"4-item-properties"}><SchemaItem collapsible={false} name={"vaultUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The URL of the key vault (`https://<name>.vault.azure.net`) or of the managed HSM (`https://<name>.managedhsm.azure.net`), without a path and without a trailing `/`.","example":"https://my-vault.vault.azure.net"}}></SchemaItem><SchemaItem collapsible={false} name={"tenantId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Microsoft Entra tenant ID, a GUID or a domain name (for example `contoso.onmicrosoft.com`).","example":"00000000-0000-0000-0000-000000000000"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The application (client) ID of the app registration, a GUID.","example":"11111111-1111-1111-1111-111111111111"}}></SchemaItem><SchemaItem collapsible={false} name={"keyType"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`EC-HSM`, `EC`]"} schema={{"type":"string","description":"The key type of the keys that the wallet creates. `EC-HSM` (default) keeps the keys in hardware security modules (the key store `protection` is `hsm-backed`). `EC` keeps them in software (the key store `protection` is `software`). A managed HSM has `EC-HSM` keys only.","enum":["EC-HSM","EC"],"example":"EC-HSM"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the application logs in to Microsoft Entra ID.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`clientSecret`, `clientCertificate`]"} schema={{"type":"string","description":"Authentication method. `clientSecret` needs the credential `clientSecret`. `clientCertificate` needs the credentials `clientCertificate` and `clientPrivateKey`.","enum":["clientSecret","clientCertificate"],"example":"clientSecret"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"dpod"} value={"5-item-properties"}><SchemaItem collapsible={false} name={"tokenLabel"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 32 characters`"} schema={{"type":"string","maxLength":32,"description":"The label of the partition, at most 32 bytes in UTF-8, without a control character, `;`, `{` or `}`. The wallet removes the spaces around it.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"serialNumber"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** Value must match regular expression `^[0-9]{1,16}$`"} schema={{"type":"string","nullable":true,"pattern":"^[0-9]{1,16}$","description":"The serial number of the partition, a string of 1 to 16 digits. Optional; an empty string is the same as `null`, and a number is refused. When given, the HSM signer checks that the partition has this serial number.","example":null}}></SchemaItem></TabItem><TabItem label={"csc"} value={"6-item-properties"}><SchemaItem collapsible={false} name={"cscUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base URL of the CSC API of the QTSP, with `https://`.","example":"https://qtsp.example.com/csc"}}></SchemaItem><SchemaItem collapsible={false} name={"apiVersion"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`v1`, `v2`]"} schema={{"type":"string","description":"Version of the CSC API. The default is `v1`.","enum":["v1","v2"],"example":"v1"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"OAuth 2.0 client ID that the QTSP gave the organisation.","example":"client"}}></SchemaItem><SchemaItem collapsible={false} name={"userId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"User ID that the QTSP registered for the organisation.","example":"user-1"}}></SchemaItem></TabItem></SchemaTabs></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>credentialsConfigured</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

For each credential field of the key store type, `true` when the wallet has a value. The answer never has the value. Empty for the type `local`. The fields: `vault` `password`, `secretId`, `token`, `clientPrivateKey`; `gcp-kms` `serviceAccountKey`; `aws-kms` `accessKeyId`, `secretAccessKey`; `azure-key-vault` `clientSecret`, `clientCertificate`, `clientPrivateKey`; `dpod` `authTokenConfigUri`, `authTokenClientId`, `authTokenClientSecret`, `pin`; `csc` `clientSecret`, `userPin`.

</div><SchemaItem name={"property name*"} required={false} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean"}} collapsible={false} discriminator={false}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"capabilities"} required={true} schemaName={"string[]"} qualifierMessage={"**Possible values:** [`create`, `import`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete`]"} schema={{"type":"array","description":"What the key store can do. The type sets them. `local` (the key store that takes new keys): `create`, `import`, `sign`, `csr`, `certificateChain`, `test` (no `import` with the backend `hsm`). `local` (the other key store of the installation): `sign`, `csr`, `certificateChain`, `test`. `vault`: `create`, `import`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete`. `gcp-kms`, `aws-kms`, `azure-key-vault` and `dpod`: `create`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete` (no `import`). `csc`: `reference`, `sign`, `listProviderKeys`, `test`, `edit`, `delete`.","items":{"type":"string","enum":["create","import","reference","sign","csr","certificateChain","listProviderKeys","test","edit","delete"]},"example":["create","import","sign","csr","certificateChain","test"]}}></SchemaItem><SchemaItem collapsible={false} name={"qscd"} required={true} schemaName={""} qualifierMessage={undefined} schema={{"description":"Shows if the key store keeps the keys in a qualified signature creation device (QSCD). `false`, or `provider` for the type `csc`, where the QTSP decides.","example":false}}></SchemaItem><SchemaItem collapsible={false} name={"keyCount"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","description":"Number of keys of the organisation in the key store.","example":3}}></SchemaItem><SchemaItem collapsible={false} name={"qualifiedStatus"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`qualified`, `not-qualified`, `unknown`]"} schema={{"type":"string","nullable":true,"description":"Only for a key store of a provider with `qualified` `true` (category `qtsp`): `qualified` when every key of the key store is qualified and there is at least one key, `not-qualified` when a key is not, else `unknown`. `null` for every other key store: no other key store claims a qualified status. See `trust` of the key.","enum":["qualified","not-qualified","unknown"],"example":null}}></SchemaItem><SchemaItem collapsible={false} name={"lastCheckedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the last connection test, in UTC. `null` before the first test.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>lastCheckResult</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Result of a connection test of a key store.

</div><SchemaItem collapsible={false} name={"ok"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the connection test passed.","example":true}}></SchemaItem><SchemaItem collapsible={false} name={"message"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Why the connection test failed, as a safe text. It never has a secret or the detail of the provider. `null` when the test passed.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"checkedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the connection test, in UTC.","example":"2026-10-20T10:05:00Z"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"createdAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Creation time of the key store, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"updatedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the last change of the key store, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"id\": \"local-openbao\",\n  \"type\": \"local\",\n  \"provider\": null,\n  \"name\": \"Local vault\",\n  \"local\": true,\n  \"status\": \"active\",\n  \"protection\": \"software\",\n  \"settings\": {},\n  \"credentialsConfigured\": {},\n  \"capabilities\": [\n    \"create\",\n    \"import\",\n    \"sign\",\n    \"csr\",\n    \"certificateChain\",\n    \"test\"\n  ],\n  \"qscd\": false,\n  \"keyCount\": 3,\n  \"qualifiedStatus\": null,\n  \"lastCheckedAt\": null,\n  \"lastCheckResult\": {\n    \"ok\": true,\n    \"message\": null,\n    \"checkedAt\": \"2026-10-20T10:05:00Z\"\n  },\n  \"createdAt\": \"2026-10-20T10:00:00Z\",\n  \"updatedAt\": \"2026-10-20T10:00:00Z\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"400"} value={"400"}><div>

The body, the settings or the credentials are not valid (`<field>: <problem>`), a credential that the settings need is missing (`credentials.<name>: required`), the type is `local`, the provider is missing, unknown, hidden by the installation or of another type, the organisation is a sandbox organisation, or the connection test failed (`The connection test failed: <message>`). `errorDescription` tells why, as a safe text.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"401"} value={"401"}><div>

Unauthorized

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"403"} value={"403"}><div>

The installation does not let an organisation add a key store of this type (`The key store type <type> is not allowed in this installation.`), or, for `dpod`, the installation has no HSM signer (`This installation has no HSM signer for DPoD partitions.`).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"409"} value={"409"}><div>

The organisation already has a key store with this name, or a key store of this provider (`The organisation already has a key store of this provider: <provider name>`).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"500"} value={"500"}><div>

Internal server error

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"503"} value={"503"}><div>

The provider of the key store is not available, or, for `dpod`, the HSM signers of the installation have no free capacity for a partition.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem></ApiTabs></div></div>