Skip to main content

Create key

POST 
/v2/config/digital-wallet/openid/key-management/keys

Creates a new ECDSA P-256 key in a secure vault. The wallet uses the key to sign OID4VCI credentials and OpenID4VP responses. The vault sets the key type, the curve and the algorithm, so there is no parameter for them.

Enable the vault before you create a key in it.

Request​

Header Parameters

    X-SandboxOrgId stringrequired

    Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet.

    The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org instead.

    X-SubwalletId is the deprecated name of this header. The service continues to accept it, but X-SandboxOrgId wins if you send both headers.

    The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400.

    Example: 6889e1a4c5b2f30001a3d710

Body

Vault that stores the new key. Send an empty object to use the iGrant.io vault.

    vaultType integer

    Possible values: [1, 2, 3, 4]

    Default value: 1

    ID of the vault that stores the key. 1 is the iGrant.io vault, 2 is the Hashicorp vault, 3 is the QTSP vault and 4 is the database backed vault. Use 1 or 4 for normal key creation. The service uses the iGrant.io vault when you do not send this field.

Responses​

Key created successfully.

Response Headers
    Schema
      keyId stringrequired

      Unique identifier of the new key.

      jwk objectrequired

      Public key of the new key pair in JSON Web Key (JWK) format.

      kty string

      Key type. The vault creates elliptic curve keys, so the value is EC.

      crv string

      Elliptic curve identifier. The vault uses the P-256 curve.

      x string

      X coordinate of the elliptic curve point, in base64url format.

      y string

      Y coordinate of the elliptic curve point, in base64url format.

      kid string

      Key identifier. The value is the same as keyId.

      alg string

      Signature algorithm for the key. The vault sets ES256.

      property name* any

      Public key of the new key pair in JSON Web Key (JWK) format.

    Loading...
    Last updated on