Test certificates

Create test CA

POST/v4/config/ows/key-management/test-ca

Makes the test root CA of the organisation for one trust domain, with the country that you choose. For development and testing only. The first test certificate of a domain also makes its root, so call this first only to choose the country. The organisation has at most one root for each domain (see Read test CA).

mdoc-iaca: country is required. ISO/IEC 18013-5 needs the same country (C) in the Document Signer, the IACA and the mdoc issuing_country.
provider and access: country is optional. Default the country of the newest CA-issued leaf of a key of the organisation, else EU.

The root is valid for 9 years, and its key stays in the local key store of the installation. A call with a sandbox API key makes the root of the main organisation.

Create test CA

Language of the request sample

ExampleExample request

curl -X POST 'https://demo-api.igrant.io/v4/config/ows/key-management/test-ca' \
  -H 'Authorization: ApiKey <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "domain": "mdoc-iaca",
  "country": "SE"
}'

{
  "testCa": {
    "id": "0b6f8e2a-3c1d-4e5f-9a7b-1c2d3e4f5a6b",
    "domain": "mdoc-iaca",
    "certificate": "-----BEGIN CERTIFICATE-----\n<base64-certificate-content>\n-----END CERTIFICATE-----\n",
    "subject": "CN=Example AB Test CA (NOT FOR PRODUCTION),O=Example AB,C=SE",
    "notBefore": "2026-10-21T10:00:00Z",
    "notAfter": "2035-10-21T10:00:00Z",
    "crlUrl": "https://demo-api.igrant.io/organisation/<organisationId>/service/test-ca/<testCaId>/crl",
    "certificateUrl": "https://demo-api.igrant.io/organisation/<organisationId>/service/test-ca/<testCaId>/certificate"
  },
  "warnings": [
    {
      "code": "test-certificate",
      "message": "Development and testing only. The built-in test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it. Do not use it in production."
    }
  ]
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:update

Body

application/json

The trust domain and the country of the root.

domainenum<string> | null
The trust domain of the root. Default mdoc-iaca.
Available options:mdoc-iaca,provider,access
Example:"mdoc-iaca"
countrystring | null
The country (C) of the root, an ISO 3166-1 alpha-2 code in upper case. Required for mdoc-iaca (it becomes the issuing_country of the mdoc credentials), optional for provider and access.
Example:"SE"

Response

application/json

The new test CA.

testCaobject
A test root CA of the organisation, for development and testing only. The organisation has at most one root for each trust domain. Each root has a P-256 key, a validity of 9 years, key usage keyCertSign and cRLSign and basic constraints CA with path length 0 (both critical), and a subject key identifier. The mdoc-iaca root has the IACA profile of ISO/IEC 18013-5 (Table B.1): C, O, CN <organisation> Test CA (NOT FOR PRODUCTION) and an issuer alternative name. The provider and access roots have C, O, the organisation identifier when known, and CN <organisation> Test Provider CA (NOT FOR PRODUCTION) or <organisation> Test Access CA (NOT FOR PRODUCTION). The key of a root stays in the local key store of the installation: it cannot be exported and it is not a signing key of the organisation.
warningsobject[]
The test-certificate warning.