---
id: config-digital-wallet-open-id-create-test-ca
title: "Create test CA"
description: "Makes the test root CA of the organisation for one trust domain, with a country. For development and testing only. The organisation has one test root for each trust domain (`mdoc-iaca`, `provider` and `access`, see TestCa), and a second create for the same domain gives `409`. The first test certificate of a domain also makes its root, so use this operation to choose the country before the first test certificate of the domain."
sidebar_label: "Create test CA"
hide_title: true
hide_table_of_contents: true
api: eJztW3tvG7kR/yrE/iUBq4cdJ9dT06CKpLS6y8Wu7VyAJkGX2h1JrHfJPZJrRTX83YsZcl/S2nGLa4siZwSxvEsOh/P8cYa6CxIwsRa5FUoGk+AnfgOG2S0wC8YyrZRlsylTa3qm9IZLYTgOZmulmZLArC6MZYnKuJAh2wm7ZZzFqpBW74fsjdIsgVtIVZ6BtIzLhEgLuWFKpvshuz4kvOXGEa44wKWAx9vWWqwXZYmKB4LHPApZlGt1KxLQEa0R8TgGY6KQGQB2DcbOeD+kV5wZiJVMWKyBWyDquDvDMyhpb8QtGBadjb+PHIdroY11LMWgrViLGOeqNePlHJ4axTISoLCGOA+ZUawwwOxWGKZy0G6LVrF4qxS9gFJYbAVrpd2jh5fDt27B4Sf5SV435vu3uPAE3w1YQ0ITFvlxEROGafilEBqSIVtenY+Wixk7+d345NngOZMAiakFUhLvzfpMSHo+V3FByrwSGwk6LJ+TrnrL6WzaJ0H7x8gDi4QxhZCbv5VMOF1U04RhtzwVCWnje7YHrs2QttCt14PtKDJgng7ZB2G3qrBM2LCmvgFrWqL2opKwQxGnwNctOdstt4yj5SPb4Lji7Ab2Xa4QMkgNsGjxPiKdTJnhMlmpL227jrmUypKFMO50O5sOP8kgDCrLWCbBJIiVXIvNXGyE5ekHnqZgz3OQy2RGBuuMOQgD1CEY+1ol+2Byd+DJaBgtdynF3WEtQ08MDSKYWF1AiExYkBYJ8zxPUS5CydHfDVK/C0y8hYzjJ7vPIZgEavV3iG0QBrnG3VgBhpiixRvjjNVCboIwkEWa8lUK5YJfYb/JbqVkjkZTQNg0dNwMyCILJh+D6qnji+woCANnQ0GILHwOA/jCsxwZaYy/RwmQoP493ptu02AdrR49jj07efFicMJ4mm/54JTFKgH0lyLPQbOYGxiyS68RMr7GBlkPqR05VLkMuVusIQFpBU9NP6y8w1HqdigSWyWIq0Vwf39fPSFVIuElygbVX2QZR9kE6O6tpQ+igwnCgJTUtIaWYio5u1UbmmotVC9Tvjc+3eCzG6l2spR655IV1Xv6QYs3uZLGbe50fNLtQzvyP5bxBOq8OJvW4cuAvhUxMA220BISJsiffiX/sc7ZO8ZZYUlVVTho8z79agYPyRz+Y8nZfYj6Q7a4Bb13g3E6RtHC8A2w6Ab2M9AWLcVbY3z51v3Vi7WwIuZpP2QrbkTMYiWN1VxIa3BHpPqc2y1LQW7slo1bczgzBYmK1hPkDWuB2Yq7TCMsxUCfazwyuBicPn+BM9zWm15X8e9NcC1Sl//lUQoln+hdY4Rgr4cn/Qmbhew8ZLN3LHrZFOcrQia4m96782v25vySXVyez9/Prpfn7/pOJFy6JKQZTy1oya24BSYxN/dcPJeWx7bvOe72buLesC2/Bc/LEZ6rRcR2W5BMUFImv3LG/hD3F37Fh7eBUadr5pSYe3Ce25FPurzCCR5WpCrmKb01FmGTt3AhjeVpSssM2dKWaXcFDL7kSltIQr83fMyZERuJBv9Acme9enC5sjBkVQ1E16/jQVfORwgonKsouwXN8kLnyoAZHjm8SLoSTtu330vxSwFNjXnGS1DRiuXj1Yv17+CUD57FJ8ngDJ6vB9/z71aDk/g0eQZn6+f8xQrz3cOp+umpuRZDrsEg6tptCeYeIFnjVGAKMKwXuSA3dwGjjvJIoD9kLZiPb76ackKmgWOCIG6M5bYwTmvGDRg2/MTRrCleLOehj/ohW0ynROMv+KGRdyjwH9MtaVzNBz98uGY/z2jyh2cz/NjIyY5A/cB7uPExsDBWZdGwcYgRkuUpjysrrz3HP3Aj2yLufbi8mM4cFi915CBjJYcnY6VHYFK95NNsh/y4MYt2d7H4Cd0j43bIrpW3r8qkW9uirQjj44HEeA664QbCoKwsUgsZTzAhM24QchNRXtit0sLu214ywJ/Xiz8t37HZ4vJ6+WY5m14v6Okn+XLFDbw4GzT4GPgE/+qTpEGLd/OOiSggn4eeJpwyabV8yscdC18ohmT49vLNjJ09Pzlr72L27g8L9webvn40uYTnjZHh7A+IvcJAKvuaTqFd3Dr9BJMgwf1bkcFXofCV5braTDPttjb3/nrW3sbp+PTF4GQ8OD25PhlPxvjvr5696do6ZPgrcLeoHeNf4e3Z8y7eYp2+1+nTtPz+8m25UPPYqeFWOZzookpvdvm237J3ymgCjTkvVqmImVZFXRcoo9auPB4VdosBJvbZEJfm0uxAIw0Ke5dvcZPzxaX3PtaLmnA1vxFfBrFOo37oYkbCVvvGQWxBwO+BMkUDMQlDe+auNIKrJgLlsypot7kS0jr+3IaM5XvD+C0XpD6HSA7TOzM7YeNts2BFAXHdVtjW2txMRiMnnaF/MYxVNmrm6lELoSyTVyOP7EdIeRDz0UuXp/BVrNOD2Pfv6P4wEv7a2m3q5OtaBm0jjyIfCLpPgpeVsl3UErqOuExItz4qz2cs+GJBGgJaMV+6NNj/vzKFRv5zx8qykPIRwVyFq9qZsk4LzaDbiHBVQDmyss/3YbDjGkGraZgc15rvOy0uclzXVCLm56N0hIXMPHbAnNUTP7hpHYdNqZyN4bGLFLsuUm+NoQPakoHWSnvVehwiDEuUhGMYjAWRp/nTjXBRvNxSx3Yd3Kp8g1Cn0sxs1Q6drSN0rQqR2gFasDOlSZ2A0T/THdpk9chPKs0JvQSx60DdgtYiQQZ8peoQh/mDhSv5foGkPcqR+X1rhhtA3gsex+JJdJAJk3Ebb/1mm3tKFPjDzkYD1DUTR75cjA69kT+YDDQUBjpoxdsG4scj05aglSNVo38JOza7ugw7coP2NIo8VTxx86U/FRGVCR2XsMiA9KvyguesCVkPFU1W1JK8s6uWgPBRc5NtaHtE8j4MMjBYrnjiyahhEN4kQ18+zkEbJdsRaf7V8suhKZY2gyFU7h2ohYQAg5O/C27uLFEiY8NUYY1IoI2PWaKc/REyFnbI5u6BP7DisUOrpIgpwxyFN3LSWj6f7w8H2LI2VcUrN2brjmfB5A7/OhuPncs/sWLWXIFiyszxQZ/nDY18Dr9SXatn17oV0sKGAnClpbPx+L6DfIc91Ip9zbEBkheW5VzzDGxZeTw0mrJQVlckOgtpE/IItWbV4SusDqShT6aI0ur+EBJsFrBK31ypxLmtVI0mSq/8OKl6Q1VnzNOraLnC00EBunUiT8oTuT9o9pG1VsfGF19IcM3FhXR9IJRs1Mdw4bPHQ1XzxtzHRjoe3Qy7U67SPsBKO0vBWjrVU6zxh6KrBfHsJdCulGHE62zx9KKrYlX5nwbHUZqqHSTU9HMdx7r7UwIu0km8hfjGsFhl0OwFln5Pr6mjiCVBLyaaWHUrx5HrQlYYiRBmq2vI4Iswlk7+h1548g174XvpUeo/IOkQzbNvWDTXD2Dt5BBrs170UMKqpuAwOhhQIbdRqo36XSb5/Tcu91Z04SmWNfdVE6J2boLRPl08Oq2KPIex/aX7/apTD8+/6QS9lNR2SanTB9odYzpk9K3HiCc0ZBpHEXcY60VvuEhdcqSLEY2QMmE/wp5lXPINOCzhO60leihLAt0m+91xP3cpTbFei1hQr8AqzTfgTnZ/vvoJt2gFcdk43riteLSklco8lscDjm8TYiTzXcFDCq294xq9rs4VHZu3XCc7hAwG4oKKJZlKihRqDDK/UPP2Erwt7b0qdMv1y2KOO7VSZGhv9JF9XUKmboEVsjCQ0Do5F9qw3k1mPKpjSudbLl0LhKAaApEDSWTIHC4wjNiUyCMOW3ORNi4Z7fh+0jyjl+j0EqzeD6ggEhHy8ecVA+XdIX8q5hsMYh400XaEYWsN4G6gdenCt0Cpg6d0p8Y0ycDxeSQIv91Dzdf7pZV5h9qO9BSyBFKwHYv4yn9juheysM2VrhAyVs1Iw9Bjq+oER/H5UhxeksCHk1buftwLHzeb4XBYHTsgT1V3E9Xfomgu5EfjULrdNGeJu/FUDqZuaZPIcs5eiuTVxK1ZX2hyoJr84QFUfrRq1zhPd8imvvJIt8DQ1A32cR2y9haORwBnquQ2sr0gTfRCSmDNi9TdQthjiWQFMS/8zb/qckl567I5unEPUGSeG2H9/bx/8ZLJ/3O2aQxpLf98/F3XCsH/OMwFRxUO7AH6oB5MPt4F01z8CPjx8z2Km2MZ92Pg7/uxD95VnFOc/TzrB2GAmfCnKhOiljKwW4W3BXNlSEvcboNJMLo9Hbn7gyPvTgNnZCOVgxTJ6Ab2gzqnlgVtrEcTujHEYTttziFTHvwEYVBgo6OqpCeQqQHPxVBsNJd2KFRwHx4SuKhqSA+R+RqFK8s3WCh4YLpxrw8Z+VwL/gpdwVlwKf66cu4ehAHdE3Oaw1I8z/Dt1J8LybWOK98XS7KarmZMq5YbtehEzC3DMiz1rKgW6wrAVJ2NHI8sYj0qrFM81lykJIOcxwgLYIjF7hbZCfMTX2KOQXEMbmD/KnKlOwwLl/Wd0UXtVU+4l4fSWasS4nLXz4aMC9SDKXK8WvPHWvaV+MSf6kdtpTX1fSDValJZ4qIyvUJ2sc2Av9F6eRNr+SSC/v0zVT2pWzSrL10w7C5xGQPrnZNjLV0O6Z54gYXkconKGS/6yJFVsUqNx35oASBxjvFZ4B8+C1vlmg0h26o0CeuC7L5KdY07IawwpF3LZcJ1Yga0X8GlZesUGxVkGV7SxK2/V9L74cN1P2TLxfWb+uKJWw0rYeWltGyu4lE2f9u8duK6cVQMSkUM0pA1lIaf83gL7HQ4PlLdbrcbcno9VHoz8nPN6O1ytnh3tRjgnPu6g1SrE4VV1gZLh8Ko49R+Oj49Gz4bnuBcDGsZlw1+3O3nEpccemLj6PXbtxh++xbDb99i+O9/i8GnUzxfjPIUE8q9Dxx3Hp58DG5PHWxdC2qftSCK+yKEpKZ5G6YgcQ9UPofBFhHP5GNwd4fXst7r9P4eH/9SgCZUhbe/tXDXfj5+rsAYIZsboLvkLlQMrpHj6rL4MYZGIOJm4IW73D46tgnKLs6vroMwWPmvZmQEWAPNd/hNC74LJsGn4FNAG6ZcQRgdn98FKZebgtqNgaOLqRvhRRux3BBi8R9wZ+Ur2bj+fgRe3Gbwf9xa55SXGKN/hP2rarh78+CECjC50ah27PL9E+lO704=
sidebar_class_name: "post api-method"
info_path: docs/openid4vc-api/igrant-io-api-documentation
custom_edit_url: null
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import ApiTabs from "@theme/ApiTabs";
import DiscriminatorTabs from "@theme/DiscriminatorTabs";
import MethodEndpoint from "@theme/ApiExplorer/MethodEndpoint";
import SecuritySchemes from "@theme/ApiExplorer/SecuritySchemes";
import MimeTabs from "@theme/MimeTabs";
import ParamsItem from "@theme/ParamsItem";
import ResponseSamples from "@theme/ResponseSamples";
import SchemaItem from "@theme/SchemaItem";
import SchemaTabs from "@theme/SchemaTabs";
import Markdown from "@theme/Markdown";
import OperationTabs from "@theme/OperationTabs";
import TabItem from "@theme/TabItem";

<h1 className={"openapi__heading"}>Create test CA</h1>

<MethodEndpoint method={"post"} path={"/v2/config/digital-wallet/openid/key-management/test-ca"}></MethodEndpoint>



Makes the test root CA of the organisation for one trust domain, with a country. For development and testing only. The organisation has one test root for each trust domain (`mdoc-iaca`, `provider` and `access`, see TestCa), and a second create for the same domain gives `409`. The first test certificate of a domain also makes its root, so use this operation to choose the country before the first test certificate of the domain.

The country of the root:

- `mdoc-iaca`: `country` is required. ISO/IEC 18013-5 needs the same country (C) in the Document Signer, in the root (IACA) and in the mdoc `issuing_country`, and the root is valid for 9 years.
- `provider` and `access`: `country` is optional. Without it, the root gets the country of the newest leaf certificate that a CA issued for a key of the organisation, else `EU`.

A sandbox organisation cannot make a test CA.


## Request

<MimeTabs className={"openapi-tabs__mime"}><TabItem label={"application/json"} value={"application/json-schema"}><details style={{}} className={"openapi-markdown__details mime"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-mime"}><h3 className={"openapi-markdown__details-summary-header-body"}>Body</h3><strong className={"openapi-schema__required"}>required</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}><div style={{"marginTop":"1rem","marginBottom":"1rem"}}>

The trust domain and the country of the root.

</div></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"domain"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`mdoc-iaca`, `provider`, `access`, `null`]"} schema={{"type":"string","nullable":true,"description":"The trust domain of the root. Without a value, `mdoc-iaca`.","enum":["mdoc-iaca","provider","access",null],"example":"mdoc-iaca"}}></SchemaItem><SchemaItem collapsible={false} name={"country"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The country (C) of the root, an ISO 3166-1 alpha-2 code in upper case. Required for `mdoc-iaca` (the `issuing_country` of the mdoc credentials), optional for `provider` and `access`.","example":"SE"}}></SchemaItem></ul></details></TabItem></MimeTabs><div><div><ApiTabs label={undefined} id={undefined}><TabItem label={"201"} value={"201"}><div>

The wallet made the test CA, and the service returned it.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>testCa</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

A test root CA of the organisation, for development and testing only. The organisation has one test root for each trust domain (`domain`). Every root has key usage `keyCertSign` and `cRLSign` (critical), basic constraints CA with path length 0 (critical), a subject key identifier, a validity of 9 years and a P-256 key. The `mdoc-iaca` root has the profile of an ISO/IEC 18013-5 IACA (Table B.1): C, O, CN `<organisation> Test CA (NOT FOR PRODUCTION)` and an issuer alternative name (the contact). The `provider` and `access` roots have C, O, the organisation identifier when it is known, and CN `<organisation> Test Provider CA (NOT FOR PRODUCTION)` or `<organisation> Test Access CA (NOT FOR PRODUCTION)`. The key of a root is in the local key store of the installation. It cannot be exported, it is not a signing key of the organisation (it is not in the list keys operation), and the organisation cannot use it for other purposes.

</div><SchemaItem collapsible={false} name={"id"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Unique identifier of the test CA.","example":"0b6f8e2a-3c1d-4e5f-9a7b-1c2d3e4f5a6b"}}></SchemaItem><SchemaItem collapsible={false} name={"domain"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`mdoc-iaca`, `provider`, `access`]"} schema={{"type":"string","description":"The trust domain of the root, and the presets whose test certificates it issues (`testCaDomain` of the preset). `mdoc-iaca`, the IACA of the mdoc Document Signers, readers and status list signers. `provider`, the CA of the PID, wallet, EAA and QEAA providers, the status list signers of the SD-JWT VC and W3C VC credentials, the credential issuers and `custom`. `access`, in place of the Access CA of the access certificates (WRPAC) and of the request signers.","enum":["mdoc-iaca","provider","access"],"example":"mdoc-iaca"}}></SchemaItem><SchemaItem collapsible={false} name={"certificate"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The root certificate, in PEM format. To trust the test certificates of this root in a verifier of this platform, add it as a trust authority.","example":"-----BEGIN CERTIFICATE-----\n<base64-certificate-content>\n-----END CERTIFICATE-----\n"}}></SchemaItem><SchemaItem collapsible={false} name={"subject"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The subject of the root, in the text form of RFC 4514.","example":"CN=Example AB Test CA (NOT FOR PRODUCTION),O=Example AB,C=SE"}}></SchemaItem><SchemaItem collapsible={false} name={"notBefore"} required={true} schemaName={"date-time"} qualifierMessage={undefined} schema={{"type":"string","format":"date-time","nullable":true,"description":"Start of the validity of the root, in UTC.","example":"2026-10-21T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"notAfter"} required={true} schemaName={"date-time"} qualifierMessage={undefined} schema={{"type":"string","format":"date-time","nullable":true,"description":"End of the validity of the root, in UTC.","example":"2035-10-21T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"crlUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The URL of the certificate revocation list (CRL) of this root. It is a public route of the wallet, without authentication. The answer is the CRL in DER format (`application/pkix-crl`), signed by the root. Each test certificate of the root has this URL as its CRL distribution point. The route stays available when the installation switches the test CA off.","example":"https://wallet.example.com/organisation/<organisationId>/service/test-ca/<testCaId>/crl"}}></SchemaItem><SchemaItem collapsible={false} name={"certificateUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The URL of the root certificate. It is a public route of the wallet, without authentication. The answer is the certificate in DER format (`application/pkix-cert`). The test certificates of the `provider` and `access` roots have this URL in their authority information access extension (caIssuers). The route stays available when the installation switches the test CA off.","example":"https://wallet.example.com/organisation/<organisationId>/service/test-ca/<testCaId>/certificate"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>warnings</strong><span className={"openapi-schema__name"}> object[]</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The `test-certificate` warning.

</div><li><div style={{"fontSize":"var(--ifm-code-font-size)","opacity":"0.6","marginLeft":"-.5rem","paddingBottom":".5rem"}}>Array [</div></li><SchemaItem collapsible={false} name={"code"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`test-certificate`, `preset-override`, `profile-mismatch`, `purpose-reuse`]"} schema={{"type":"string","description":"The kind of warning. `test-certificate`, the answer issues or shows a certificate of the built-in test CA: the text is always the text of the example. `preset-override`, a value of the request is not the fixed value of the preset; the request value applies. `profile-mismatch`, the certificate does not agree with the preset of the key. `purpose-reuse`, the certificate chain of the key has a preset, and the new CSR, test certificate or chain upload has another preset: use one key for each purpose.","enum":["test-certificate","preset-override","profile-mismatch","purpose-reuse"],"example":"test-certificate"}}></SchemaItem><SchemaItem collapsible={false} name={"message"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The text of the warning, for a person.","example":"Development and testing only. The built-in test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it. Do not use it in production."}}></SchemaItem><li><div style={{"fontSize":"var(--ifm-code-font-size)","opacity":"0.6","marginLeft":"-.5rem"}}>]</div></li></div></details></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"testCa\": {\n    \"id\": \"0b6f8e2a-3c1d-4e5f-9a7b-1c2d3e4f5a6b\",\n    \"domain\": \"mdoc-iaca\",\n    \"certificate\": \"-----BEGIN CERTIFICATE-----\\n<base64-certificate-content>\\n-----END CERTIFICATE-----\\n\",\n    \"subject\": \"CN=Example AB Test CA (NOT FOR PRODUCTION),O=Example AB,C=SE\",\n    \"notBefore\": \"2026-10-21T10:00:00Z\",\n    \"notAfter\": \"2035-10-21T10:00:00Z\",\n    \"crlUrl\": \"https://wallet.example.com/organisation/<organisationId>/service/test-ca/<testCaId>/crl\",\n    \"certificateUrl\": \"https://wallet.example.com/organisation/<organisationId>/service/test-ca/<testCaId>/certificate\"\n  },\n  \"warnings\": [\n    {\n      \"code\": \"test-certificate\",\n      \"message\": \"Development and testing only. The built-in test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it. Do not use it in production.\"\n    }\n  ]\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"400"} value={"400"}><div>

`domain` is not a trust domain (`domain: one of mdoc-iaca, provider, access`), the domain is `mdoc-iaca` and the body has no `country` (`country: required for the domain mdoc-iaca (the issuing_country of the mdoc document signers)`), `country` is not a string (`country: invalid type`) or not an ISO 3166-1 alpha-2 code (`country: not an ISO 3166-1 alpha-2 country code (two upper-case letters, for example SE)`), or the organisation is a sandbox organisation (`Subwallets are not allowed to create a test CA.`). The body checks come before the test CA check, so an invalid body gives `400` also when the root of the domain exists.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"401"} value={"401"}><div>

Unauthorized

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"403"} value={"403"}><div>

The installation switched the test CA off (`The built-in test CA is switched off in this installation.`).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"409"} value={"409"}><div>

The organisation already has the root of this domain (`The organisation already has a test CA for the domain <domain>.`).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"500"} value={"500"}><div>

Internal server error

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"503"} value={"503"}><div>

The local key store of the installation does not answer (`Failed to make the test CA: Key management service is not available`).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"507"} value={"507"}><div>

Insufficient Storage: the HSM partition of the key store has no room for a new key. This is the partition of the installation HSM (the local key store in a hardware security module), or the DPoD partition of a key store of your organisation. The text is `The HSM partition has no room for a new key. Remove unused key pairs (kms signer orphans list) or give the partition more room.` A new try fails the same way: the answer has no `Retry-After`, so do not send the request again before room is free. For the installation HSM, the operator of the installation removes the unused key pairs or gives the partition more room. For a DPoD partition of your organisation, delete unused key pairs in the partition or give it more room. Some operations put the text after their own text: the test CA (`Failed to make the test CA: The HSM partition has no room ...`), the deploy of the organisation wallet (`Failed to deploy the OpenID digital wallet for organisation ID <id>: ...`) and the create of a sandbox organisation (`Failed to deploy sandbox organisation: ...`). A route that signs can also give this answer for an organisation that has no default key yet, because the wallet makes the default key the first time that it needs it.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem><TabItem label={"Example"} value={"Example"}><ResponseSamples responseExample={"{\n  \"errorCode\": 507,\n  \"errorDescription\": \"The HSM partition has no room for a new key. Remove unused key pairs (kms signer orphans list) or give the partition more room.\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem></ApiTabs></div></div>