---
id: config-digital-wallet-open-id-create-test-certificate
title: "Create test certificate"
description: "Gives a key a certificate of the built-in test CA of the organisation, in one call. For development and testing only: the test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it."
sidebar_label: "Create test certificate"
hide_title: true
hide_table_of_contents: true
api: eJztff1z27ay6L+C4f1Ffk+iLX8lUXMyV5GdHp+miWvZzTm3zZQQCVmoKVIhKNs6Hf/vb3YXAEESkmWnfe/e13Y6E5kE8bHYXew3fgsSoeJCLkqZZ8Eg+FbeCsU4uxErxlksilJOZcxLwfIpK2eCTZYyLXsyY6VQJRsNzfO8uOaZVBz66TKZsTwTLOZpGrJ3ecEScSvSfDEXWcl4luDXMrtmeZauBtiB6U8qluUlyzPGsxUri6UqRcJSqcoufnnH01SUCn/fikJOpSgUy5elkolg5Uwqtkh5Oc2LOUty7As7YbIMf85+zi5hEXmygoE4G6niQnxZwtgdmMW1yEQByx2NL1i+gN8yz3a67E6WM1oogoqnLLrlqUxkuTrhKxWF7NIsoshh/gQWGjrJ5xxAQs8WhVCiZJ0IWo/4Cb6MzFtYaQ3w1Fw5s2FSqaVQ2NxpOWDRPMnjnuQxj9g0L7ABPDJ9dFnE41goVb3+dHE+HNkxAKhRQQDpKXmdiaKneNZLMhUR+KNFkd/KRBRVF3k5E4XpImSfZiJroQSbcdhXBzbcgKWLjWlb2VQWqmRzfiMUk6UFu1QszpdZWawGsIc9d6WEPpFaTn4VcRnqdhaeejVdJlIlCGTUwjTIxB3sWir4tAZ3nCInlFRLkeB6iTK8OI/9R6dXUYgTrOCEYNNwH/zhM3gCMPRkiSb0BhDooS1QgMX6G7Gi/cdeYBMdHMSJ26a3PIUX9REHGvPzqUxFgxDEPY/LdEUUhH3zJKGe+bKc5YUsV7homYisRIInnNGrbLyz0xxdvGeJVGUhJ0vEwUUuM6C7uEivirQCSp6XOyEbZjX6wUXxVOWIujyjBReMp6UoMl7KW8EyPhfEN+I8K3lcul122dn44+7Z6Yj1X+71D3pHbJhl4p69hbFc/MiLiizro9ZBIDNgakRO1J6J+1JkCh4g+GN+hpNUBJ/IQabmglnn9HJ8xk4/sIP+K3bY3+/ts29PP/QOw8Ow39vfod1QopA8ZdlyPhEFAQLxVJXs+JAVPEvyOZtI4CwG6rgCqRhyRzYt8jnrs7nMlqVgEzHNC0JRhCYNYr7IxK0o9Hd8WorCTraJpKrMC8P/ZsBZO3ZkMw3LiXfgKNEoPKiBZJwvi1hEMDSy4h5sOxIrMuaqoW5SLIVm84BwMcduMwZsssL+6P5o7xXyxjkvqXV0fxRHbCZ44iAnsmV4MzPMn2NPvFwWgs34raigCYckscJ8WTrHCs/iWV4ANsGEkFvgFtHiXU5yjcwdGA2cy13CMNwbiw8wg4xYueHLNViOhqwQt7nhDnlKhzjNsDO6eL9jJoKwqAsPtEs4oBlkNARKbO9GtFykOU9EEnVZJOeLvChFQkTypVSLCE4/VojpUolkwBKRCsMp9SBwgiDCNMkvE0KzFQV0a5iwJPQ4yeMliidjPPa65jkRy9lwNNxBgOjHtH+AxTK7/sXwWRJ2iI0kukN9jmrUwlcF4gKcqB5WjWvRUpDnsHB5FM7tGkU2OkOLDISqSPPZ3lyqOS/jGaBtzuJZnrePQE69OKRJZ3ALh/Ipk6WyyLE0XRUCzyojDhopRdOsdAQXWBUcYTdipQCOdJQhMVcEFPMFn8hUllIoFsXKAM6ZyghpZsCiNI95Cnhyy5dpCT+u40XvZg7CSsTvlP3572Uhejdi1aOG1GOyyJMIkFbxLJnk93WBJeZZZo45D0mFP2dBN7BLO0uCQRDn2VRen8hrWfL0E7KqjwuRnSUjhNFlnasE3WDBCz4XpShUMPjpt4YofpXJL0vhHmwaA27EKugGEtoseDkLugGcQ8EguBGrsyToBnDmykIkwQB4VjdQ8UzMeTD4LShXC2gIZ2J2HTw8fKbGQpVv82QFLepzuKxOacMM6se7iyCdSpjeqZiHlZeNuBx6ZgjHp8hKmABfLFLoT+bZ7q8KZvGbswCeph+nCCy9lBypJ+gGpSxTeFBNIuh6VlNNv86hgEiBdgqjDYzGFzsh+0S8LCIgIMXOBR6GSKaOhMOSXBDRAkGy0spRi0JMZZpagEzlvUgaYDQqwZYKACAtdtBiFk7njb69bALe9PJbURQyEVEXu+EZE0WRF468p1dI3eIGCUWwgQOJ6yG6tcZwZMZLVeZzfWhaWcWuGiRMXgB11aREh0bY0Eo/HWDAiYhlIhS7g2VfA8BlVuZNTAQMWxQALmAigDY0wTYFdINsmaZ8AphDmNjGGJkQtmg4bq2moUS5zG6y/C6DTmgDosO9vYh1NOwHtgH9/Q2yVVCd8yl77eyeTNSbaAcWJrLlPBj8FNwVCx73UnHN06Cr/0LpAf9eyKRnJEx4jczI80SVvFyqHqxGn1MwBOdu0y+NvxfLSa/xyHfgmcd02Jm/vAN6H8aFQNbH0x6J3oFlVg3VFBojpgVd2M7P3UDc8/kC2YF3Zg/dQB+7Dkr4OMl4aR628cJoH21OGLJTHs8YL0n1ECiVwaYiASFeVO+ezEdqZB2yCJYcEQ8wAziissjiPNE9mBnLjP0zPNrbY3mRgKRjBUEjFhiSyufzPEMtR6sDugOtzEdizmU6TJKCVNuFlk7xMShx8BxGM0LOMC0/QGfYIGqTqR7/6XQ60hPvjPDkAc2LHfSPj3t9xtPFjPf2GYAB5rJcLETBYq5EyM4yVOwctfLbQohYIPM6fa/FOZ6RtNeSED3SmRYIHa2ts15a3LEcttELSJuk+AQuLo9PEXNLXoqPxTlQXxaLpwNrXKI4ByYb6oJ1xpcAt5LNc1Wy/v5LkKULHoNksgUM7MJ+XRZSJTKGgSJ2ZwxBdjmGEGrLgsk+dAOU5WT5jM1/r79knffrV+EZkcS9f3Pq5qmjfnSFxc7HHXP6XUtVikIkZBzw2mnMFPePjtdNMTilX2z4NmhMladXmXzGWeZOmKdsmcmSdT5eOSA7Pqzt+zif+w9jkMwNrTviqeFkK3Zt1Ne6CVAU3p0nNvMBZdinE75lUawz+rB+MVdaXVm3K0AP+rESxa2MgYvfimJlTmAtsoJZct1ONamjuXNnFlZfiW4ux9pItWbyqF1FolRyvMpKfh9pc0aXydJamhS+Aig0TUN9FqccJJOjsB8edlGJ0wBg0Y/Dy/Fp7+jo+PjFi5cvX73a60fE9GCB+BpUsA+XF/DP+fgE/nl/egb/nH68IM3+9J+jqM5PgV13WdSLLI+sFr1T34D2BJBNounqA1qunsEja4YvlP+0cMUWolAuFdcQjcwobDj+EPbZeSGzEsYY46B/4J4cNPbk8uzD+LTX3z84PDp+8fLVXm1HzodjAP7ZyQh35MNH+Ofy7IPeirOTZ2+FJmgQXJ5Jz+B/yiyRrgf649xdLYvsWVMY04dfN/5DJWJqoWc7SdM03iRwNi3QPmW8munRnqNrCpBLYRagQSI2fK346Yia8UzEN9SYzJ92RK04Zok23ClU+RZgFNHKalsWBLm+AhkvCr56dOtOPow1RDrJhzEAElXlGcABnldGVJARz42ISqsgs1fKJyJF4+5EsOh/RSEDlEQxMdNgx+MTUUTbAoc9+gpWbU2+e69+UTz7BTxnLE4lnArOWYnQRLpGC9HJ4Y/njn0SJ6wBbXyc9viUpZgrH1o3DoxMMAOPEBiiRdCftPIX6idhnM+Dzw/dYFnIJ4P86uJMsc4yk7D4C6HQinvm8AfUdiYqT0HZubo4M+ZhtOk4eLq/d+iSVJ2hkfayAGMwuxMTJUtNn4VIVyBvL3hRroxXpGEKeALAri7OGrACuKC68mTInLpaEKBkMY1f7u8jVlrrMrqpyY7ZgzX8J5lXoyfOu6ZxeVawmOWZePIKLkUq8Et9Dioz6zop4BryKTu7vOpdstOwv988jv734TF7yfr7B+zw6Ji9ePnU5ZWNibRWCOz2RqyuFL8WW5sJvzMf+JgtWKaX8LayW1nfj0Kr1ekIf3eZyll0I1anWSwXM1GAAGgszLzkjceFICNbmuZ3ImGdi3cjdnT4co8pgWoTO0CW1fIFa5V7NHRm1oFhQUAHcRMO8fjiPf7cabNTOgM8KDCX2RntRH8jHFSXeDnsQinnT6WsataTFfoRwALxSnOnyqqVkPF8bDxhgKN5diEWy0SSooYbPbwuhACIIt9yOFvre3gfg84Sc5eEJ3meCp49SgIkkpFdsnK2QjiC7tM1gyKMteykX4NaWrfDavMphH9A15WWrN+DBRe2OhN12QpaA5pXpvOfzKZ+Bjv+44ZML0rXzEe+FkRqpcgSkXz3VBI7bX7om5fp3T/874nIi2WxyFH8UOzj2QnysyQvSwqtmLuHURPbUXa3DK0f7oXoVgxB+t6PWKfpbPRZS3a6zS+PPV8W2lG8BO9yqV0hOyib98OD8Djsh0fhUfgiPAgPjyLWucxvRMbGaEJl78EsTVbOnSdS6MezkwY8mmJDY9X/nWlrylP1f5W4NiJxnco24zvAtOL753kqY+nF98fnVHNP6I6+GvX3wkNAg1eH/f5LjfsfRue9tCeWibwrFl3SVC/HrI+aar/38nfHREC8LzHaMYG81Nb86Af3Ix/IfhgxZVv41O4jqwT/EJ+P31atbWO78v3eMRzlT/UXepx3FoGACWjUJlyyw7cZ5Zf4EgHxHJ/XD/htF3GgvRusQ+/rfo2dtYiyDzwLrELnZyfMeI2AGTaaAC5pXdK2wiXrdi+P94FnYjuRirgs8kzGTAmeeu0QX+JRPl+kktfN5M/hTz84XTl73qlPrR+R++H0in1Z8hQ0oKSpjbQnOVZx8tXTG49HJ+sndhhp+/SikLfADjBkTgdhVFOtApDyAsFK0R3AlhMBNlHW+WE8OlkD7HM1eQIhQms/6rXIilt0QItCtfO8hLAMnCBZ3oxXTZmIyckKlkJxk4vlJEV0icu8oBjgzvnybe90ONwZtGnX2NdehgdI8xS9N+w6cwPSaCLxAYWU2DYYkZWmrJwVwoQfkCahz6So6U+NtCVAeoha2+Q+Tt+DoyFd67vwHAZ1F1PK7zZ5yrpkC7yiKN/TJUyCZ+wqA1xI+Z0OH6zB63z8tvcyPOjtHaEK07B+4sB3uWsr1drkOgLR/i4QhMY1s0L8hGUvMz6fyOtlvlTW/hJri//UBliioMXIeME6diGHO3VFlpPbP5+C3YEMcBBgKrPrpVQz7fNRIRuus2lkOUaKFnlaPa6vOc7+ZhwKF9qX1M3/VvkYuvHfCCxphQDPgYsfFrCzywwI7W4mYwrI8pANRuCpRZ4pOUmFDQTfAEkIKAUXDEcTEGq9B69eHu+QhAZniLiXqlTOJ6gIPx+Qs7JcqMHu7t3dnTV0KbGb8rvd/b39YzCOB02Rz0tdGzBw0y5sKTc22V2nzU92iAdqVmV5oQ6Ob/OWmrDZ6P+bKtBuLfvpmh62CBkKg4eHLRf6e0tW9WWOXFHowZUWq+ifdWEqTiyIjUAA5tN0EbtO2brb8hEnYNsTgNbtNYbYh4du++xsKcE29cShd7DLXeOSmvsxl5mcg4ml3w3m/J5+Hxwf7a2JkcPebRJLMxQUxEEOpi+jNFBgKr//0U2JacqwXmXOjiUJ05qx1xt63D5czmUMB8dHgLIVhiAAATPMxul9g7jD5XzOERt86nzQJR3x61BsazQyzEoo7wwrP4JRMGhw1nF9ETtd9moPN887+7XxVWsx2LgnWs6EOoq+2nt4cEO6KE+hvoLxSe8fny7ZjyNWtWM29Ks92XaA2AP+B2DCw4m2dn9vzx/YWmWcoajY9qBpduQmHSRO0kGVVxAGTwhh3UzZENy7wVM4pjDV7zAEuK05myjWtSlCbkKPjrymvIE8RYnTLvoEbAQUVg9hIBgiJrW/j2fqTqeDaOEAepvzkpzmkK4QsrNSJ3QYV7ZRPcDN4YQym7iZqSgEKFfVGyMfVsI/SPFKxIXwSMYU/Pyo7LMpqrrmzaxy0DDqvzQB4fGMZ9c6Ho5UdekkFXDFol/vbsIbmUR1eeRgus9f9ePDF5OXyaE4nvK9+Ch5IfovJ6/2D6cHe3BObOuwnvP79yK7LmfBoL/XYuEfnBAXBDD640EV4hnjCRwFqiw4SHPWPqb1QQrmTwDSFlOWi8RojE5sqz59ax1oH4W16du1g94PVIbaM0hfAflrxoCAPnT3m29b+OqQXx0Z5FdiAg1VXwQ56fKFyCY8hwWUa8wrjcmDocTbs3Z5YL/I4JYprF2nMIDcSRkM8KuewACDLHII9Y9VHHxuzXITLm3EFd+6MbyO0bhNgVnCHHAEPeBnDHmS1/IZEXV/z+/sPGKYlw5DdTlYyCKNo1Etb9QgboN1VFjTwZQntHfEab5M2Hffj4mhnJznJ8iUpKsJuYPuhE4mEg1Lf9aJgpk2FeUhEWliItGnlRUVQsKtZn6md8yiQrsBOAM8q7FykFEFmmeVvM4UjS5ROqujnIYWWGX1lDG22syijlGmMaji6TXE/83mz4iqsaYl24nLeesRdeP9o2MT6rrcwmisnR9rOLkDDF7PlEO2Td9GPAZ9vsG06SFMRaoTMUUa8FnqGtOZ5XcmYbDikO3ZYF4zTGiyYgn13vZKdINf724e55Hn1UEsM/aP8ccP7JOYsO/EinX+8em7nVpGoo5wZEpkicLz2hzkZKxWzvFNbZq2Q23UjhJPFPeNP4i3Pl+YGAUiuRPi6R1fKTumVHqghutdpCl0FLN4WdyKyg1fumdydDpq7ObpCL0rxe3j0zutj1AdEo2ZnPcgiHfNBPBlYw74DKZx//gk/sniPC8SmTn1FxpLx5RmjCaZcCWOD5dFana6Nuxr+7p336t6fQMz2WK3/vWHzGTVnMnNNuf2d7Vs702CGIqEzxDDeHq9Bc/xMDRjCEPeX4uAQZYWaUO0RZo1bO/+KPb4+xqBz63sWucU5yjKS6V1FtwVjCgpTQUGSPxgHZpOU72nM2hNNrXObQFvHlXQoO3UeSYJOzm9qKfC1Mg7qZM1sZ6WDOk9JVuZ1I2U6TWJ1fVMahvACgFMcwExJTWlT21Is36aD/MRsKAkdX/kDeNv4Nnfh70+K2fL+WQBFnVrqm1ECP1ukF5HrWrG+71qHm8IU8v/QKzdahmA9dss5ENe6joW/xHZfGtaRpWLRGninizzSh6r7JfIEnQUqgLsKH9Rbd5cX+z+0XF7ufEv4n4h/SlKjRME26EHfd1KkS6vLkd/zNbt7+2/6PX7vf3+ZX9vsAf//1dLgIezGmT2RCa+GINGeK3HJmBkmCeSRyJikZUFT6USiauDdU7OwL/YjOpKBlC+4d/7yfzfJy/78fX5/csfb+SLf0yWy+/n7/5VfDq//le+Klc3V/91IFZfZmX/11ffTb78VxiGuL4ZVw7HxATyZwtydgcyHcTm51ZVY4gm3lQlwt029O7XY0DI9fB0kfsTiP1Ns1b7sIC9VLiZYa34QrkVkW2pGrVrQoRV0Q36rlVZigqrOOUFatUInNpM00cKTIW6dES3BQwNhh8ux+eO0XGjdcNPdVqxMuCra1Z6nZBKW6pFO0lVe9Ablu+n4mfFJh4rckL8pgXvdXZQcgXq2g2b4fzpK4pzPUIF51+Rwl1P3d5IDdun4L/bIDxVA0Koq7aq20xKgyU0evOLsqoIhUXIHKW2gZaFIO+XP6HSmdQQAtDV3JinHw/Q8H7a5i86oqkVrOyKohDorAYIhyrercToIk3fxtQPn4IkLfQhIyFer9S1jOYn75suEVNOqoudN5yGbvWa+9LaBhSIg5ioQvI5yLJ63LrRAAwvrQprLXRxS96sse90rTGVaxncgM2YrsiuDAN2TZEAE8sOxsNIb3uXifmiXCFyQiW3eZLWPVaRiQ3rsgijccyXmlABDGoJiemKRcOMgTOZIk24DvapbyHM99rmPgF0tLmizQlDZqro1SHQdDa7/mvWcb3OO2GkK+jdY5EZ5A3oKqskcZFgiQAm7gESjrEOSztB3Qp8YYzZZL/QpYK8DgML4+exlTo+r5PyfJW2dGjRYXgQ7ncZRsmwPpgZh9GA1QPeQxa9bT3EHW3GuocsGkUD3+MTz2PsopG2wKg4j42uD1l0Gg22aPWuNcPucwdsnLzNHAhTPsrJgnAVbUQ4JysC4wfdyHb3tB4G3QA8+aOgG5wE3QDcse88NSQwBRtY0cgyq5HlVY9KzZebuVxzkTCOewp5v2xWpgTeE8FBgMFn4G5pdYniQbSQiS7kyFvNiEm14Iu4jV0AzRteuUnct8dIE1xUnmh9iZX2YldPAIWOJD87GY6rz1v9Yo2mZeXGAqCxTkOwK5YpJGkhuFiHGGAzZAqSe6CN4Bw7yHpVIKUTmAhNvlAb/3uMtNNBOBHrOK+2C2KsVYWB5VD5F6rjosu3VFVb6rZ9eFBXtbDJBnR/lxffJ75kuK9H+qmuM3Hyvr5LbRTHQpHLVJAN1rX5TTFCes3coy6bQC8AaLsrVNTUgB+9RJBGqI8RIgH04Y3MYU8WfN9MXRncczzbKoJV3Q8HTUsqI+n0JnWIpFRIAH/R3P/nNNdCmWebKJqnZtkucOgWY22mIF2iQPI2PGCdigii5oFOaOzJZmmlR3XZJIfypDpxZ8dLSZ0kj6lAQV5ch1LlThfzk/cQBonUZT1negFexfGvaPS/otH/ikb/Kxr9r2j0/ybR6GuPpnaMeq2OMHL6akJ0YuBBgHvsslxCFZAkkSVEa6GBqfIe4OqCbDrWUXkwKFoHfMiv2sSzKa9TC0jfC4UZ9VueTy2Jzn7f3MJ31qTVFuq6G41hutR8Q5rVxior2GEZ6VroyoDSRMV9WdnTQJCrxHzYSZvqOHVq+mOxUiwPUtm16hZ3kONDxyrUFPaxsqANiB3BQsK5hk1kijVHWMz0e/tYlw1BoxBCoH2sZf5iGWtkbyDbRS1wYYsPQOR70gdfnvyFET6f8FGDAW0h2AJb+b1wkOSiOgq69W1JTrT6A0QfULgQd1EIKW2epCO3n78o7i+K+4vi/BTns2N0ornKf4FQmoiQ53HdrIG5IXtHZeRdKwfiacfYaGvGFW150WVx0Iyz3kxDycy6uGhDd22quTCm5RmUsK6FB2/LdoSE6ybYYAZ+1GTm0++NouqRDTYwMQ8OPMEX59b73ejaOquCZJ/oufOZ957nxnuOF4/KdhpHFWZwIG495qnDk0M7mqCOyqlxM213alz6vvQJ2et9WZwY/JooBTdnv34vVl7QChQE+JFaKBI2GsJlTFKXT6sG0lVSoJY9EqQBqpM75BxRvhPFiayiloVQyxQsqzgIUSvc9gRMH+IpLmsTkIpN8iVsbO7H2drAM55Uh1TVCcTH0zVa8PkY47WinUHdiwGv4P4HWjFZYHX9DH3VFVdQqliBGHE3W9ENYzh6Dk7IjtVeAIzSVpgBVx1A+aqQkQ07JR3BRMeaidJ2Xl28t9mUza3jiNxN3b4QMURpJljznqrIfDScy8ZQkCEWizUAdYC3c57fYt7SN9hyeH5WT1yySVwEIB3vPXCW02lOEqypOjhNvzWhak4tfGjkhp3QflBzE/s3ldm1KGrBfx40N73RzSWsM9NpIWsoApvpsJVqtuWwNCuRcxtoR/odvH67glojsxxRSNqwVup3bus/4u63xRUNq228xm0TgJMouVumu66tTYX381QXrwUAP20AY5Zx1fJGOSHalse7RYuOoaqtmuM2bNUSN8fXkqLhgkEA+WY92LeNyyW7yV5vf9+Nb8T+325RRRxseUTMXit7MwmDOMUW3TbEBzPGlgaYR+McWAdOyVoytudI2NkYwmb7xRPviy4/4/MryEZmGLsRYlGJBGvLx6wpG1MFqKD/pXaToL3Xzu2RgsMMu6kiR5xsQJRKYxVHO/aOOWqk7wpxEwSqUMf6srwuBBx7u6P/O7HC09973DvwsWlKzmJrSV2Pr50iqVonJr+G458OzdOrGi4oX5FeWbZyP6v8L30KGoNdnmW6NmUzURCPPgEjtXnktrlbkV1x1JZ8XKnGW1HJvWjBgApRYjTc/WFUKb4a9NcFz0qR2DvhGqCyub6Y2eAfEE9pp/iUwXk8fhtVqUCmgCu3fqeqS6DFlL0mvGp7DZIMy3KI5KWLZXQjQA6eprW7OBuL1wJM1/gVtNgwETo0rcptQdmLRAoR34iErSgh2zhE7Qyxeqcz46Ab6GnVXaJVAziuqFP/GfEIB3WC7bGbKsLexw7XLaN9xPTrR0wiynpF4CcEjU15XGo1yV6TQOJzu+SxH9GtStS+G3cmUKprvjV7V7vwCkTemqBtMBOQrQ6HH7aiBED4bzQPbuM79EoSWatYWVsW/Ka9BOMrgE8NvpAvFcU3KigxYKMPfzvLSqEk+7bIlwtA8mr2p9Vsx0BnoyH79oCdjkZwu9TuD6OuYRDdBviguPFO2zageZyLsxY5tjjwUZ5vnH2N48CeZnRbQEX7xuXfscYVfT0i6dm+Q8eaATaeFZpQcHNRkbbxYCgtLE3918dT9qvLExxTQSKmMpPksAGURbdzVhp2V71E1KxnTaBVwipBuDOYiFmlGRSiXBZZI3V06B+ffNBgD4rNjZjIHRQsm6cmeLtmGEMmD081VInnmqsQbeIxMEzHZuLLSCIsUR6fup3rSQUNb42fRib/Y9BeA1CX0PfBiOlsyHNn8NRNdefQb7lBvQBZP1GqSos561+hZzSyLc2B7KZzYZanPl/8x8Ze/digShq/36zc4y6FO3m1iv+8+bXtnhg5ltF1FLZah63v4JYD6FassEqUp8x1nVvmT8Hy5Tm1E2F8eSDr8hvWWPC0mmOkehdD3H0B3NG1zrYL7DWN3SskwD9TOad01o1zm3DIPgJLVWhlmOZglLUXArqXMUa6XHWvEEuK6m/d6+qtrLspneMTzbe1liEIQoJOarXEaxSmy1RX+qnfC2lYnL3mMdEJKM3YoGSb6iiApzLDWEQNy9ADMjrUdN0hffM4CMuopHKfaaiZ3TSwVmRnb+wja7Qj04zvakxeL8zrrP/Ruze/qX3RuEWzvantNDVre+UQKN/KqqilCDWR5jE7v04mNVd4GuESrooejS+6nsw7bWw2yYFuVL691VLfYok+RWOh1zNzNYXmRhu2XkGe8KoGIPSGOYus6xKtLsE4RZ6T7dDRRQiNkl0Ts0eZMDVmerIxIW5Noh1uJqZxrHxi/Fdk0bETegA7IPGqx0WRJ8tYm3taIUYIYQOfz/CeT6ciLkXiuLJqItCTY7/rApRfBOhqTbnthJhKrDttG8PF44R/AB6dLwUE0gNVcyrLqGrburR5je+7nkj3KD8dboaQh7muA8faVRvVtLEy55bu+lnvpXAUVKuutXWjBa4svyNENR4CYunfeCLSs/xOM91GHzLD0ZrBARh92lhxddG3UVxsPIcOwSSdy4bSa3uMjhI2XkQMF4fugVPRkm2lGp/htMsmIuZGVN/eGbWdhL5N6bkGXTiaiC/6v85ljqf9eJ+/EL295HDSO4yPjnqv+OFBb3/6QvQnr5KXcX8vqFVYrKHkM6bXSEVIujr+Ayb6EQpNjs5YRQBa/2bfi5JDkH6jssl8keYrId7y5Fr0VPLrXbl9iTIs/IEXbEVeQHWZSJHZAVJKtUj5KoSeI/2i9Hzv2wX/lNkE5twArcZcr3H4r4yM/5kZGa2QCn8Kkz9VJ3SkjO0OSEpfsvY3ZGI+ia8Vv9V9NA7ryZdr3WPJ5C3UbkTc9SzGKoseUnHA87l5eVdL8QwcLWwLgYTu/6KyQLBo+OuQqr5uXZXVnQGqOSMSjfD3iQO0z92WXFA/HqqvfSYTu/DDvb0HT/eeLXMSUTkE2MHVuwte8LkoTc1bj8SBYkRDWZlymcKlY9HrqRRp8mbAXi+KfJKK+Zuoa9Ln4INrkQE/EVSBwEk2dbQOqczl9V0W3dbKNIPxTZfqrF2/QwFIrFNrPrBVpF9nb7A0sZ2G/uy1GTF5wzqvTXHlNzvG2GmrU5n10iV6DEv14Hrdcr++y3/NgPrD1/TvG9tDnrHXYJJ5E5oxW7UYdaEXoFkoHcs4wq7DqbiIbb5jHSm1CaDDSfEsmeT39TedaLycWI2gcX1cmRN3bEm6KiTbQJMo+n9iorjKtA/l3+iJaoLm4E8Mmsumi1DdySqspqKcqaYln0prP4FmJm/V7XQNSh7+yeFevyOd24v46iVCz05YJ4LShygUgMIyYK/RRvvGD9ZXf3KwbqiTRhEgxmYFlaaiJ34RshORitJq4tACbL+A4qhKJ/R6U3W6KlSvvX1Hf2rp5Yyul00x+EUUZHb2wOjPzrG9MoiWLrAOeLuF4deVRVlb+GvVSt+RnFhJFx5b2gBrC895xq91ap4OvzHZOrdcou8q8qH3i3bE2VmmltMpXFIIoeFlXvBrQcrs38fftwt0V0vTPLPI87lWD0Gb0s5YOIN0+eJmD7UDD8bo+ACHLpEZL5I7EL6UiJcYhDHPE9KONbzbVcQbvvxVviwapcwvHY8EcqD6Qjes6wJ5B1tmmFODV5tyWSjWuZkrc+9HXixmPCMfNarXdM9gDRIopcMAYaQtaZCUDWqCUzfzjuuYdOfehyxn0YUoi1VvOC3xziCVG1s0VG+uqR0YcGBsl7gcKCZXCH21pG8vSMi24c2+HTP8s5x5AKGX29z5ar26fFt721r71DXMvDWIuZ+i+lwDWZbuSGMolmn5PtyZUVaeJw7ggz9lwfK7DB8OaqTaccgRNQvn5YBtRpswtApLIsCg5dV+dGigO5BujcY+vFjGlHMyjQEha52cnbDXElRKHLOqcEL1G6lYr1+/aY3qa6f7BYNvkS9NjgClA4MfFeM3NIajtRhRVSc41Qa01d+z3FRdxz1dgfvLtRHXLgIhEFatS+vuxZAAU7DOrZXwpziZahdtOcMf7b3wjRD8P2ZzQctUhBHjxNTRjDtcSLhdBwxTAG5+jdccnWjs/6RJxdy2NNoJuliR/Ht7EMIuzUU5y5NgECxyjDZYcLirJdi93d8lu+GuJqceIdkuXCsik1244aM6UuFPtfsbSvkPux5fKclHCufdKNUr5rkWnyDAoUidBIREzPMeX8hQYrRbKOE2k2YH59ZruK6bx3oYl/waPE9rPlf0ujmRz9V2jIFACK/NplSGVXrQDaCOr95PY38cBEOt569xx52fURxc7YZtN05cM8mo1o8tPD4HV+sErVPk8qfYPJojQyu41gzKgssUYbDgMQgLIoTwhlq3A6Y/fA0nD4AD7nl5E5GzFpiFLq34Nk9Wp/9zL7WDrZrmRmLnNDMxxzjaQC0XUC33PytEsHspv60e1THIRb7GFtuPTAAlanVwgy8c5BL+ndsANb3b+pwDFvQjOt2xCFJldFbo48IrjDraAUbHnP/DczcGzvKL8x2YUZnHeaq0eAroKDL4RjF3a5SVv7t43VG3igdY2dM4dqa3VIhqJc8SXiSqF+sbi0s2RbMroqmGNM7208EIblvr/OPT5U6XnZ1evmP2DjYaDerx2BvtT/J4F1OFK6cIBa1hFGMqY5EpxANDhQsezwTbD/daWwdlUDi+DvPield/q3bfn41OP4xPe/DNQ+VCq7YTgGVw3VA3sEDa9v29fSip2YdvgfPOeebMZ+QvJd3kD45KGXyLMiRJ8luFGflvXZNUVCbmaUqC56YqynXp74+MFfk5+zlDa56uosPZSBWmkGtnox+gCsdAqPG04QIwyk3DME9Dayt74zJHuvmRn+BL66rdohSzCQhrxEEMoAZfHvckj3lkLfx4PYTuAzJDMdStev3p4nw4smPoHFHfnYi6imYjiam0iZW6C8jA1RkHPjtfBRtuwFK71ookzOoqusomqHn6APaw566U0CfS3DnU7aKGK8jxjTdKcenS0/6cXO7UCa8FrrdxHvuHml0hTrCCE4JNw33wh8/gCcDQkyWaaAn/QAH1iCWj4uAmOjiIE7dNqQ5SY0SbqmYq8DmEIO55XJrYMexb3wjh5oDc1C7BIZzRq2y8s9McXbzH+mBYkw5wEG/sYZ0oLtKrogqO0Ne8DLMa/dD1KaBk6asP6MpNxlO01WH1MeCzumo/HfFul91WpQYqYfcWdToHPyAQwJBlfdQ6CECcgNMHU9qxPdUiVDbKKOYUlaJrD7j5yc0F+4o0f3v6oXcYHob93v6OvaIDTj2d2ICAQDxVJTs+ZAXPknzOJljswEAdVyAV3XNLZuQ+m8sMVFgnmguhSYOYL6h8NX1nrQQ42SaSoo3JpOMDZ+2U6y/wca4tHTx6UwARayMe2ylkam/DQh0ca3JsuuiifYnPmlt7Gnf71C/xgUNywz09unqYVfPbNfqpqg7pmXlmkj9sWqhhysbcb/hyDZajISvEbW64A0QllpZrdUYX73dqZcy280J4dsO9kaO6aQOJhPJ9dOomaMgDY6miSiyOWwIQpkl+ZKqwVj7DhLVRqyHwd81zIpaz4Wi4Y+r9VPsHWCyz618MnyVhJ/JpKBq18FWBuIAx1m1W7VaA8hwWLo/CuXkvLW9EWIfsEko/5nn7COTUi0Oa2srTCoOm+EqDHMZo5N5XAuKgvSeFaFa62Ur6Sg3MYUIzc2UwdqIkF3wiUwkWHshzNoBzpoKpFBGUcADTdYTRGMu0hB/6LlH4qS8TxZ/120R1j3CjKFUL9ZnpdGgD+QPaJBX+nAXWOAU2zN1FCgkeD1ry/02bQH4KbvfJNDaVGI5UM4OAcoqGEEo4cUwh9ACigQYmMaVlD/ncDWZgbhn8FPz2G1zldFWkDw/w+MtSFGjSgVtWC0kZNWAzkQp+Jzrpe4Mi0LnQNrodtune2HUwMFaLbFXdZB3QmoKBTrXBO8m1JQMmR+9GNIWeLj9kvm0ZFMH+Ql8MsXr1xrauher84/gy6AagA8CS52i9Cwp+B1eC8rtgEPwc/Bzgztjwb3z+W5Dy7HqJcfUB9fugC6TWDTUEF/3DiZSsQ6Nps7GgwaV5P3kN2uB3YvXGNqc3az+wdiJqDXsDsWP/B+q6bCs=
sidebar_class_name: "post api-method"
info_path: docs/openid4vc-api/igrant-io-api-documentation
custom_edit_url: null
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import ApiTabs from "@theme/ApiTabs";
import DiscriminatorTabs from "@theme/DiscriminatorTabs";
import MethodEndpoint from "@theme/ApiExplorer/MethodEndpoint";
import SecuritySchemes from "@theme/ApiExplorer/SecuritySchemes";
import MimeTabs from "@theme/MimeTabs";
import ParamsItem from "@theme/ParamsItem";
import ResponseSamples from "@theme/ResponseSamples";
import SchemaItem from "@theme/SchemaItem";
import SchemaTabs from "@theme/SchemaTabs";
import Markdown from "@theme/Markdown";
import OperationTabs from "@theme/OperationTabs";
import TabItem from "@theme/TabItem";

<h1 className={"openapi__heading"}>Create test certificate</h1>

<MethodEndpoint method={"post"} path={"/v2/config/digital-wallet/openid/key-management/keys/{keyId}/test-certificate"}></MethodEndpoint>



Gives a key a certificate of the built-in test CA of the organisation, in one call. For development and testing only: the test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it.

The body is a CsrRequest (the generate CSR operation), with the optional `validityDays`. The test root of the trust domain of the preset (`testCaDomain` of the list certificate presets operation) issues the certificate: `mdoc-iaca` for the mdoc presets, `access` for the WRPAC presets and `request-signer-san-dns`, and `provider` for the other presets. When the organisation has no root of that domain, the wallet first makes it, with this country:

- `mdoc-iaca`: the `subject.country` of the request, else the country of the newest leaf certificate that a CA issued for a key of the organisation, else `EU`.
- `provider` and `access`: the country of the newest leaf certificate that a CA issued for a key of the organisation, else the `subject.country` of the request, else `EU`.

The wallet makes the CSR with the key, and the root issues the leaf with the values of the request: the profile of the preset exactly. The root adds the authority key identifier, the subject key identifier and the CRL distribution point (`crlUrl` of the root). An `mdoc-iaca` leaf also has an issuer alternative name (the contact of the root, ISO/IEC 18013-5 Annex B). A `provider` or `access` leaf also has the authority information access extension with caIssuers, the `certificateUrl` of the root (ETSI EN 319 412-2 GEN-4.4.1-2). The serial number has at least 64 random bits, and the leaf is valid from 1 minute before the issue. The leaf is never valid after the root.

The wallet stores the chain (the leaf and the test root) on the key: `certificateSource` is `test-ca` and `testCertificate` is `true`. The key can then sign with the `x509` format. The `x5c` header and the mdoc `x5chain` of a signature have the leaf only, without the trust anchor. A key that has a test certificate gets a new one, also from the root of another domain, and the test CA revokes the old test leaf (CRL). A key with a certificate chain from another CA (`certificateSource` `uploaded`, `imported` or `qtsp`) is refused: delete that chain first.

ISO/IEC 18013-5 needs the same country in the Document Signer, in the root (IACA) and in the mdoc `issuing_country`. For `mdoc-document-signer` and `mdoc-reader`, a `subject.country` that is not the country of the `mdoc-iaca` root gives the warning `profile-mismatch`. To choose the country of a root before the first test certificate of its domain, use the create test CA operation.

This operation is for keys in a key store with the capabilities `csr` and `certificateChain`: `local`, `vault`, `gcp-kms`, `aws-kms`, `azure-key-vault` and `dpod`. A sandbox organisation cannot issue a test certificate.


## Request

<details style={{"marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collapsed={false} open={true}><summary style={{}}><h3 className={"openapi-markdown__details-summary-header-params"}>Path Parameters</h3></summary><div><ul><ParamsItem className={"paramsItem"} param={{"description":"Unique identifier of the key","in":"path","name":"keyId","required":true,"schema":{"type":"string"}}}></ParamsItem></ul></div></details><MimeTabs className={"openapi-tabs__mime"}><TabItem label={"application/json"} value={"application/json-schema"}><details style={{}} className={"openapi-markdown__details mime"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-mime"}><h3 className={"openapi-markdown__details-summary-header-body"}>Body</h3><strong className={"openapi-schema__required"}>required</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}><div style={{"marginTop":"1rem","marginBottom":"1rem"}}>

The preset and the values of the certificate (CsrRequest), and the optional validity.

</div></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"preset"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`wrpac-legal`, `wrpac-natural`, `pid-provider`, `wallet-provider`, `wallet-status-list-signer`, `eaa-provider`, `qeaa-provider`, `pub-eaa-provider`, `mdoc-document-signer`, `mdoc-reader`, `mdoc-status-list-signer`, `status-list-signer`, `credential-issuer`, `request-signer-san-dns`, `custom`, `null`]"} schema={{"type":"string","nullable":true,"description":"The id of a preset of the list certificate presets operation. An unknown id gives `400` (`preset: unknown preset; use one of <the preset ids>`).","enum":["wrpac-legal","wrpac-natural","pid-provider","wallet-provider","wallet-status-list-signer","eaa-provider","qeaa-provider","pub-eaa-provider","mdoc-document-signer","mdoc-reader","mdoc-status-list-signer","status-list-signer","credential-issuer","request-signer-san-dns","custom",null],"example":"mdoc-document-signer"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>subject</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The subject of the certificate. Each attribute has one value. An attribute that the request does not give takes the prefill of the preset. `null` is no value. The wallet encodes the subject in X.500 order, from the country to the common name. The subject has no `emailAddress`: put the email address in `subjectAltName.email`.

</div><SchemaItem collapsible={false} name={"country"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Country (C), an ISO 3166-1 alpha-2 code in upper case. In an identifier, Greece is `EL`. For an mdoc Document Signer, the country of the issuing authority (the mdoc `issuing_country`) and the country of the IACA root.","example":"SE"}}></SchemaItem><SchemaItem collapsible={false} name={"stateOrProvince"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"State or province (ST), at most 128 characters. For an mdoc Document Signer, the `issuing_jurisdiction` when the IACA root has one.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"locality"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Locality (L), at most 128 characters.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"organization"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Organisation (O), the registered name of the organisation, at most 256 characters.","example":"Example AB"}}></SchemaItem><SchemaItem collapsible={false} name={"organizationalUnit"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Organisational unit (OU), at most 64 characters. Some Certificate Authorities put the identifier that they gave the organisation here.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"commonName"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Common name (CN), at most 64 characters. Use the name of the organisation or of the service. Every preset requires it.","example":"Example AB Document Signer"}}></SchemaItem><SchemaItem collapsible={false} name={"organizationIdentifier"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Organisation identifier, at most 128 characters. For a preset with `etsiSyntax` `true`, it has the syntax of ETSI EN 319 412-1 clause 5.1.4, for example `VATSE-556677889901` (the type `VAT`, `NTR`, `PSD`, `LEI`, `EOR` or `EXC`, the country code, `-` and the identifier).","example":"VATSE-556677889901"}}></SchemaItem><SchemaItem collapsible={false} name={"serialNumber"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Serial number of a natural person, at most 64 characters of an ASN.1 PrintableString. For a preset with `etsiSyntax` `true`, it has the syntax of ETSI EN 319 412-1 clause 5.1.3, for example `TINSE-1234567890` (the type `PAS`, `IDC`, `PNO`, `TIN` or `EID`, the country code, `-` and the identifier).","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"givenName"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Given name of a natural person, at most 128 characters.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"surname"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Surname of a natural person, at most 128 characters.","example":null}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>subjectAltName</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The subject alternative names of the certificate, at most 50 values of each type. A type that the request does not give takes the prefill of the preset. The wallet checks the format of each value and refuses a repeated value.

</div><SchemaItem collapsible={false} name={"dns"} required={false} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","nullable":true,"description":"DNS names (dNSName). A host name, without an IP address. The first label can be `*`. Give an international name in the A-label form. The `x509_san_dns` client identifier prefix of OpenID4VP needs the host of the verifier here.","example":["wallet.example.com"],"items":{"type":"string","description":"One DNS name."}}}></SchemaItem><SchemaItem collapsible={false} name={"uri"} required={false} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","nullable":true,"description":"URIs (uniformResourceIdentifier). An absolute URI with a scheme, at most 2048 characters, for example the support website of a relying party access certificate.","example":[],"items":{"type":"string","description":"One URI."}}}></SchemaItem><SchemaItem collapsible={false} name={"email"} required={false} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","nullable":true,"description":"Email addresses (rfc822Name), in the form `local-part@domain`.","example":[],"items":{"type":"string","description":"One email address."}}}></SchemaItem><SchemaItem collapsible={false} name={"phone"} required={false} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","nullable":true,"description":"Telephone numbers in the international form of ITU-T E.123, for example `+46 8 123 456 78`.","example":[],"items":{"type":"string","description":"One telephone number."}}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>keyUsage</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The key usage extension. `null` is no key usage extension.

</div><SchemaItem collapsible={false} name={"values"} required={true} schemaName={"string[]"} qualifierMessage={"**Possible values:** [`digitalSignature`, `nonRepudiation`, `keyAgreement`], `>= 1`"} schema={{"type":"array","minItems":1,"description":"The key usages, each one time.","example":["digitalSignature"],"items":{"type":"string","description":"One key usage by its X.509 name.","enum":["digitalSignature","nonRepudiation","keyAgreement"]}}}></SchemaItem><SchemaItem collapsible={false} name={"critical"} required={false} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","nullable":true,"description":"`true`: the extension is critical. Without a value, the criticality of the preset applies (`true` when the preset fixes none).","example":true}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>extendedKeyUsage</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The extended key usage extension. `null` is no extended key usage extension.

</div><SchemaItem collapsible={false} name={"values"} required={true} schemaName={"string[]"} qualifierMessage={"**Possible values:** `>= 1`"} schema={{"type":"array","minItems":1,"description":"The key purposes as OIDs in dotted form, at most 20, each one time. For example `1.0.18013.5.1.2` (ISO/IEC 18013-5 mdoc Document Signer), `1.0.18013.5.1.6` (ISO/IEC 18013-5 reader authentication) or `1.3.6.1.5.5.7.3.45` (Token Status List signer).","example":["1.0.18013.5.1.2"],"items":{"type":"string","description":"One OID in dotted form."}}}></SchemaItem><SchemaItem collapsible={false} name={"critical"} required={false} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","nullable":true,"description":"`true`: the extension is critical. Without a value, the criticality of the preset applies (`false` when the preset fixes none).","example":true}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"certificatePolicies"} required={false} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","nullable":true,"description":"The certificate policies as OIDs in dotted form, at most 20, each one time. For example `0.4.0.194118.1.2` (NCP-l-eudiwrp, ETSI TS 119 411-8).","example":[],"items":{"type":"string","description":"One OID in dotted form."}}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>qcStatements</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The QC statements of ETSI EN 319 412-5 and the QcPSB statement of ETSI TS 119 412-6. `null` is no QC statement.

</div><SchemaItem collapsible={false} name={"qcType"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The QcType, one OID in dotted form (QcType has one value). For example `0.4.0.194126.1.1` (PID provider), `0.4.0.194126.1.2` (wallet provider) or `0.4.0.1862.1.6.2` (electronic seal).","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"qcCompliance"} required={false} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","nullable":true,"description":"`true`: the QcCompliance statement (`0.4.0.1862.1.1`), an EU qualified certificate.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"qcSscd"} required={false} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","nullable":true,"description":"`true`: the QcSSCD statement (`0.4.0.1862.1.4`), the private key is in a qualified signature or seal creation device (QSCD).","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>qcPsb</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The QcPSB statement (`0.4.0.194126.1.3`) of a PuB-EAA provider, with all three values. `null` is no QcPSB statement; with the preset `pub-eaa-provider`, `null` gives the warning `preset-override`.

</div><SchemaItem collapsible={false} name={"countryOfLegislation"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The country of the law, an ISO 3166-1 alpha-2 code, or `EU` for European Union law (ETSI TS 119 412-6 PSB-8.3-05). A PrintableString of two characters in the certificate.","example":"SE"}}></SchemaItem><SchemaItem collapsible={false} name={"authSourceIdentification"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The unambiguous identification of the authentic source (PSB-8.3-04), for example a list of relative distinguished names. At most 2048 characters, no control character.","example":"cn=Example Register,o=Example AB,c=SE"}}></SchemaItem><SchemaItem collapsible={false} name={"legislationIdentification"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The identification of the law under which the public sector body is responsible for the authentic source (PSB-8.3-02). Use a URI (RFC 3986) when one exists (PSB-8.3-03). At most 2048 characters, no control character.","example":"https://www.example.se/law/2026-123"}}></SchemaItem></div></details></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"validityDays"} required={false} schemaName={"integer"} qualifierMessage={"**Possible values:** `>= 1` and `<= 3650`"} schema={{"type":"integer","nullable":true,"minimum":1,"maximum":3650,"description":"The validity of the test certificate in days, at most the `maxValidityDays` of the preset. Without a value, the validity is the `testCertificateValidityDays` of the preset (the list certificate presets operation).","example":365}}></SchemaItem></ul></details></TabItem></MimeTabs><div><div><ApiTabs label={undefined} id={undefined}><TabItem label={"200"} value={"200"}><div>

The test CA issued the certificate, and the wallet stored the chain on the key.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>key</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

One signing key of the organisation, with the key store that holds it and the DIDs that come from it. The answer has public key material only. It never has the private part of the key, the reference of the key in the provider or a secret.

</div><SchemaItem collapsible={false} name={"keyId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Unique identifier of the key. The wallet makes it, and it cannot change. The value is the same as `jwk.kid`.","example":"3f2a91c47b8d4e6fa0c5d7e18b924f30"}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 100 characters`"} schema={{"type":"string","nullable":true,"maxLength":100,"description":"Name of the key, given by an administrator when the key is created or with the update key operation. `null` when the key has no name.","example":"PID issuance 2026"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>keyStore</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The key store that holds the key.

</div><SchemaItem collapsible={false} name={"id"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Unique identifier of the key store.","example":"local-openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"type"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`local`, `vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`, `dpod`, `csc`]"} schema={{"type":"string","description":"Type of the key store.","enum":["local","vault","gcp-kms","aws-kms","azure-key-vault","dpod","csc"],"example":"local"}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Name of the key store.","example":"Local vault"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"origin"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`created`, `imported`, `referenced`]"} schema={{"type":"string","nullable":true,"description":"How the key came to the organisation. `created`, the wallet created the key in the key store (also in a cloud KMS or a DPoD partition of the organisation). `imported`, the import key operation imported the key, with or without a certificate chain. `referenced`, the key was already in the key store of the provider, and the wallet signs with it there.","enum":["created","imported","referenced"],"example":"created"}}></SchemaItem><SchemaItem collapsible={false} name={"algorithm"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Signature algorithm of the key.","example":"ES256"}}></SchemaItem><SchemaItem collapsible={false} name={"status"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Status of the key. The wallet signs with a key that has the status `active`.","example":"active"}}></SchemaItem><SchemaItem collapsible={false} name={"isDefault"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the wallet signs with this key by default.","example":true}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>jwk</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Public key in JSON Web Key (JWK) format. The service sends only public members. It never sends the private key member `d`.

</div><SchemaItem collapsible={false} name={"kty"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Key type. The service always sends this member. The keys are elliptic curve keys, so the value is `EC`.","example":"EC"}}></SchemaItem><SchemaItem collapsible={false} name={"crv"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Elliptic curve identifier. The keys are P-256 keys, so the value is `P-256`.","example":"P-256"}}></SchemaItem><SchemaItem collapsible={false} name={"x"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"X coordinate of the elliptic curve point, in base64url format.","example":"<base64url-x-coordinate>"}}></SchemaItem><SchemaItem collapsible={false} name={"y"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Y coordinate of the elliptic curve point, in base64url format.","example":"<base64url-y-coordinate>"}}></SchemaItem><SchemaItem collapsible={false} name={"kid"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Key identifier. The value is the same as `keyId`.","example":"3f2a91c47b8d4e6fa0c5d7e18b924f30"}}></SchemaItem><SchemaItem collapsible={false} name={"alg"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Signature algorithm for the key, for example `ES256` for a P-256 key.","example":"ES256"}}></SchemaItem><SchemaItem collapsible={false} name={"x5c"} required={false} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","description":"Certificate chain of the key as it is stored, in leaf to root order (for a test certificate, the leaf and the test root). Each item is a base64 encoded DER certificate. The service adds this member only when the key has a certificate chain. The `x5c` header of a signature and the mdoc `x5chain` have the leaf and the intermediate certificates, without the trust anchor.","items":{"type":"string","description":"One base64 encoded DER certificate."}}}></SchemaItem><SchemaItem collapsible={false} name={"x5t"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"SHA-1 thumbprint of the leaf certificate. The service adds this member only when the key has a certificate chain.","example":"<base64url-sha1-thumbprint>"}}></SchemaItem><SchemaItem collapsible={false} name={"x5t#S256"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"SHA-256 thumbprint of the leaf certificate. Note the `#` in the member name. The upload certificate chain operation gives the same value as `x5t_s256`.","example":"<base64url-sha256-thumbprint>"}}></SchemaItem><SchemaItem collapsible={false} name={"x5c_expiry"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Expiry time of the leaf certificate, in UTC. The service adds this member only when the key has a certificate chain.","example":"2027-11-21T10:00:00Z"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"dids"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","description":"DIDs that come from this key.","items":{"type":"string","description":"One decentralised identifier (DID)."},"example":["did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqZ..."]}}></SchemaItem><SchemaItem collapsible={false} name={"hasCertificateChain"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the key has an X.509 certificate chain. Then the key can sign with the `x509` format.","example":false}}></SchemaItem><SchemaItem collapsible={false} name={"certificateSource"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`uploaded`, `imported`, `test-ca`, `qtsp`, `null`]"} schema={{"type":"string","nullable":true,"description":"Where the certificate chain of the key comes from. `uploaded`, the upload certificate chain operation. `imported`, the import key operation with a certificate. `test-ca`, the built-in test CA (the create test certificate operation), for development and testing only. `qtsp`, the certificate of the QTSP credential. `null` when the key has no certificate chain.","enum":["uploaded","imported","test-ca","qtsp",null],"example":null}}></SchemaItem><SchemaItem collapsible={false} name={"testCertificate"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` only when `certificateSource` is `test-ca`. The built-in test CA issued the certificate, which is for development and testing only. Wallets and verifiers outside this platform do not trust it.","example":false}}></SchemaItem><SchemaItem collapsible={false} name={"certificatePreset"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The preset of the certificate chain of the key (the list certificate presets operation). For a test certificate, the preset of its request. For an uploaded chain, the preset of the newest CSR of the key. `null` when there is none.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>certificateAssessment</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

What the leaf certificate of the key allows: its key usage type, the credential categories that it fits, the mDL Document Signer profile, its QcPSB statement, and the texts of the save check for each category. The wallet reads the certificate chain of the key. A key without a certificate chain, or with a leaf that the wallet cannot read, gives `keyUsageType` `null`, empty lists, `mdlDocumentSigner` `false`, `qcPsb` `null` and texts such as `An EAA needs a seal certificate of a legal person. This key has no certificate. Request a certificate with the preset EAA provider (eaa-provider).` The texts do not count the trusted-list exemption of the key: an exempt key is never refused.

</div><SchemaItem collapsible={false} name={"keyUsageType"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`A`, `B`, `C`, `D`, `E`, `F`, `null`]"} schema={{"type":"string","nullable":true,"description":"The key usage type of the leaf certificate (ETSI EN 319 412-2 clause 4.3.2, table 1). `A`: nonRepudiation. `B`: nonRepudiation and digitalSignature. `C`: digitalSignature. `D`: digitalSignature and keyEncipherment or keyAgreement. `E`: keyEncipherment or keyAgreement. `F`: nonRepudiation, digitalSignature and keyEncipherment or keyAgreement. `null` when the certificate has another key usage (for example with keyCertSign) or no key usage.","enum":["A","B","C","D","E","F",null],"example":"B"}}></SchemaItem><SchemaItem collapsible={false} name={"fitsCredentialCategories"} required={true} schemaName={"CredentialCategoryId[]"} qualifierMessage={"**Possible values:** [`none`, `pid`, `eaa`, `qeaa`, `pub-eaa`]"} schema={{"type":"array","description":"The credential categories that the certificate fits (the list credential categories operation), without `none`. A PID certificate fits only `pid`, and a PID certificate with another key usage type fits no category.","example":["eaa"],"items":{"type":"string","title":"CredentialCategoryId","description":"The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. `none` (no certificate rule), `pid` (person identification data), `eaa` (non-qualified attestation), `qeaa` (qualified attestation) or `pub-eaa` (attestation issued by or for a public sector body).","enum":["none","pid","eaa","qeaa","pub-eaa"],"example":"eaa"}}}></SchemaItem><SchemaItem collapsible={false} name={"fitsCredentialCategoriesForMdl"} required={true} schemaName={"CredentialCategoryId[]"} qualifierMessage={"**Possible values:** [`none`, `pid`, `eaa`, `qeaa`, `pub-eaa`]"} schema={{"type":"array","description":"The credential categories that the certificate fits for an mDL configuration, without `none`. The rules are the same as for `fitsCredentialCategories`, but `eaa`, `qeaa` and `pub-eaa` also accept key usage Type C. A key signs an mDL configuration only when `mdlDocumentSigner` is `true` and the category of the configuration is in this list.","example":["eaa"],"items":{"type":"string","title":"CredentialCategoryId","description":"The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. `none` (no certificate rule), `pid` (person identification data), `eaa` (non-qualified attestation), `qeaa` (qualified attestation) or `pub-eaa` (attestation issued by or for a public sector body).","enum":["none","pid","eaa","qeaa","pub-eaa"],"example":"eaa"}}}></SchemaItem><SchemaItem collapsible={false} name={"mdlDocumentSigner"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the certificate has the Document Signer profile of ISO/IEC 18013-5 Table B.3 (key usage `digitalSignature` and extended key usage `1.0.18013.5.1.2`, both critical). A key signs an mDL (doctype `org.iso.18013.5.1.mDL`) only with this profile.","example":false}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>qcPsb</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The QcPSB statement (`0.4.0.194126.1.3`) of a PuB-EAA provider, with all three values. `null` when the certificate has no QcPSB statement. A key with this statement signs only the attestations under its law (`legislationIdentification`, `countryOfLegislation`) and from its authentic source (`authSourceIdentification`), ETSI TS 119 412-6 clause 8.3.

</div><SchemaItem collapsible={false} name={"countryOfLegislation"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The country of the law, an ISO 3166-1 alpha-2 code, or `EU` for European Union law (ETSI TS 119 412-6 PSB-8.3-05). A PrintableString of two characters in the certificate.","example":"SE"}}></SchemaItem><SchemaItem collapsible={false} name={"authSourceIdentification"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The unambiguous identification of the authentic source (PSB-8.3-04), for example a list of relative distinguished names. At most 2048 characters, no control character.","example":"cn=Example Register,o=Example AB,c=SE"}}></SchemaItem><SchemaItem collapsible={false} name={"legislationIdentification"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The identification of the law under which the public sector body is responsible for the authentic source (PSB-8.3-02). Use a URI (RFC 3986) when one exists (PSB-8.3-03). At most 2048 characters, no control character.","example":"https://www.example.se/law/2026-123"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>categoryMessages</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

For each credential category, the texts of the save check for a configuration that is not an mDL. `none` is always an empty list.

</div><SchemaItem collapsible={false} name={"none"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"pid"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"eaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"qeaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"pub-eaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>mdlConfigurationMessages</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

For each credential category, the texts of the save check for an mDL configuration (`mso_mdoc` with doctype `org.iso.18013.5.1.mDL`) of that category. First the category rule (with key usage Type C also allowed for `eaa`, `qeaa` and `pub-eaa`), then the ISO/IEC 18013-5 Document Signer rule. `none` has only the Document Signer rule.

</div><SchemaItem collapsible={false} name={"none"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"pid"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"eaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"qeaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"pub-eaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem></div></details></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>trustedListExemption</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The trusted-list exemption of a key: the certificate of the key is in a trusted list, or chains to a listed CA. While the exemption applies, a rule of the signing key check that the key does not fit gives the check result `exempt` and no refusal. The exemption is bound to the leaf certificate that the key had when the exemption was set (`leafSha256`): with another leaf, `applies` is `false` and `reason` says why and what to do (`null` while it applies). `listUri` is the source of the exemption: the URL of the trusted list, or a text, for example a recorded decision. Only the platform operator sets or removes it; the API cannot change it. The other members: `listUri` (the trusted list), `service` (the service of the list), `certificateSha256` (the SHA-256 fingerprint of the certificate of the list), `match` (how the certificate of the key matched the list), `setAt` (the time, in UTC) and `setBy` (who set it). Each of them can be `null`.

</div><SchemaItem collapsible={false} name={"listUri"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"example":"https://example.com/tl/eaa-providers.xml"}}></SchemaItem><SchemaItem collapsible={false} name={"service"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"example":"Example EAA provider"}}></SchemaItem><SchemaItem collapsible={false} name={"certificateSha256"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem><SchemaItem collapsible={false} name={"leafSha256"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem><SchemaItem collapsible={false} name={"match"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem><SchemaItem collapsible={false} name={"setAt"} required={false} schemaName={"date-time"} qualifierMessage={undefined} schema={{"type":"string","format":"date-time","nullable":true,"example":"2026-10-22T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"setBy"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem><SchemaItem collapsible={false} name={"applies"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","example":true}}></SchemaItem><SchemaItem collapsible={false} name={"reason"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"qscd"} required={true} schemaName={""} qualifierMessage={undefined} schema={{"description":"Shows if the key store keeps the key in a qualified signature creation device (QSCD). `false`, or `provider` for a key of a qualified trust service provider (key store type `csc`): the provider decides. The value comes from the key store.","example":false}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>trust</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The qualified status of a key of a key store of a qualified trust service provider: its leaf certificate against the EU trusted lists. The wallet checks it when the key is referenced and when the connection of the key store is tested.

</div><SchemaItem collapsible={false} name={"status"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`qualified`, `not-qualified`, `unknown`]"} schema={{"type":"string","description":"`qualified`: the certificate chains to a qualified certificate authority (service type CA/QC with the status granted) on the EU trusted list, and it is a qualified certificate for electronic signatures or electronic seals whose private key is in a qualified signature or seal creation device (QSCD). `not-qualified`: the trusted lists say no. `unknown`: the installation has no EU trusted list source, a list cannot be read, or the key was not checked yet.","enum":["qualified","not-qualified","unknown"],"example":"qualified"}}></SchemaItem><SchemaItem collapsible={false} name={"checkedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the check, in UTC. `null` when the key was not checked yet.","example":"2026-10-21T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"detail"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The facts that gave the result, for example the certificate authority and the trusted list, and whether the trusted list or the certificate says that the key is in a QSCD.","example":"Qualified certificate for electronic seals; the private key is in a QSCD (the QcSSCD statement of the certificate; the trusted list has no QSCD qualifier for it). Issuer: CN=Intesi Group EU Qualified Electronic Seal CA G3 ECC (CA/QC, granted, trusted list of IT)."}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>usage</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The number of credential definitions and presentation definitions that sign with the key. Only the list keys operation returns this member. A credential definition counts once, also when several of its configurations or its status lists use the key. The read key usage operation gives the details.

</div><SchemaItem collapsible={false} name={"credentialDefinitions"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","description":"Number of credential definitions that sign with the key.","example":2}}></SchemaItem><SchemaItem collapsible={false} name={"presentationDefinitions"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","description":"Number of presentation definitions that sign with the key.","example":1}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"createdAt"} required={true} schemaName={"date-time"} qualifierMessage={undefined} schema={{"type":"string","format":"date-time","nullable":true,"description":"Creation time of the key, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"updatedAt"} required={true} schemaName={"date-time"} qualifierMessage={undefined} schema={{"type":"string","format":"date-time","nullable":true,"description":"Time of the last change of the key, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>warnings</strong><span className={"openapi-schema__name"}> object[]</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The warnings. The first one is always `test-certificate`. Others can follow (`preset-override`, `purpose-reuse`, `profile-mismatch`).

</div><li><div style={{"fontSize":"var(--ifm-code-font-size)","opacity":"0.6","marginLeft":"-.5rem","paddingBottom":".5rem"}}>Array [</div></li><SchemaItem collapsible={false} name={"code"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`test-certificate`, `preset-override`, `profile-mismatch`, `purpose-reuse`]"} schema={{"type":"string","description":"The kind of warning. `test-certificate`, the answer issues or shows a certificate of the built-in test CA: the text is always the text of the example. `preset-override`, a value of the request is not the fixed value of the preset; the request value applies. `profile-mismatch`, the certificate does not agree with the preset of the key. `purpose-reuse`, the certificate chain of the key has a preset, and the new CSR, test certificate or chain upload has another preset: use one key for each purpose.","enum":["test-certificate","preset-override","profile-mismatch","purpose-reuse"],"example":"test-certificate"}}></SchemaItem><SchemaItem collapsible={false} name={"message"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The text of the warning, for a person.","example":"Development and testing only. The built-in test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it. Do not use it in production."}}></SchemaItem><li><div style={{"fontSize":"var(--ifm-code-font-size)","opacity":"0.6","marginLeft":"-.5rem"}}>]</div></li></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>affectedCredentialConfigurations</strong><span className={"openapi-schema__name"}> object[]</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The credential configurations that sign with the key, whose signing key check fitted with the old chain and gives `does-not-fit` with the test certificate. An empty list when there is none.

</div><li><div style={{"fontSize":"var(--ifm-code-font-size)","opacity":"0.6","marginLeft":"-.5rem","paddingBottom":".5rem"}}>Array [</div></li><SchemaItem collapsible={false} name={"credentialDefinitionId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The credential definition of the configuration.","example":"6f1c2a7e-0d4b-4c55-9a43-2f7e1b9d8c10"}}></SchemaItem><SchemaItem collapsible={false} name={"credentialConfigurationId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The credential configuration id, as in the OID4VCI Credential Issuer Metadata.","example":"EmployeeBadge-sdjwt"}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The `label` of the configuration, else its `display.name`, else the `label` of the credential definition.","example":"Employee badge"}}></SchemaItem><SchemaItem collapsible={false} name={"credentialCategory"} required={false} schemaName={"object"} qualifierMessage={undefined} schema={{"type":"string","title":"CredentialCategoryId","description":"The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. `none` (no certificate rule), `pid` (person identification data), `eaa` (non-qualified attestation), `qeaa` (qualified attestation) or `pub-eaa` (attestation issued by or for a public sector body).","enum":["none","pid","eaa","qeaa","pub-eaa"],"example":"eaa"}}></SchemaItem><SchemaItem collapsible={false} name={"messages"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","description":"The rules that the new certificate does not fit, with the fix, as in `signingKeyCheck.messages`.","items":{"type":"string","description":"One text."}}}></SchemaItem><li><div style={{"fontSize":"var(--ifm-code-font-size)","opacity":"0.6","marginLeft":"-.5rem"}}>]</div></li></div></details></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"key\": {\n    \"keyId\": \"3f2a91c47b8d4e6fa0c5d7e18b924f30\",\n    \"name\": \"PID issuance 2026\",\n    \"keyStore\": {\n      \"id\": \"local-openbao\",\n      \"type\": \"local\",\n      \"name\": \"Local vault\"\n    },\n    \"origin\": \"created\",\n    \"algorithm\": \"ES256\",\n    \"status\": \"active\",\n    \"isDefault\": true,\n    \"jwk\": {\n      \"kty\": \"EC\",\n      \"crv\": \"P-256\",\n      \"x\": \"<base64url-x-coordinate>\",\n      \"y\": \"<base64url-y-coordinate>\",\n      \"kid\": \"3f2a91c47b8d4e6fa0c5d7e18b924f30\",\n      \"alg\": \"ES256\",\n      \"x5c\": [\n        \"string\"\n      ],\n      \"x5t\": \"<base64url-sha1-thumbprint>\",\n      \"x5t#S256\": \"<base64url-sha256-thumbprint>\",\n      \"x5c_expiry\": \"2027-11-21T10:00:00Z\"\n    },\n    \"dids\": [\n      \"did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqZ...\"\n    ],\n    \"hasCertificateChain\": false,\n    \"certificateSource\": null,\n    \"testCertificate\": false,\n    \"certificatePreset\": null,\n    \"certificateAssessment\": {\n      \"keyUsageType\": \"B\",\n      \"fitsCredentialCategories\": [\n        \"eaa\"\n      ],\n      \"fitsCredentialCategoriesForMdl\": [\n        \"eaa\"\n      ],\n      \"mdlDocumentSigner\": false,\n      \"qcPsb\": {\n        \"countryOfLegislation\": \"SE\",\n        \"authSourceIdentification\": \"cn=Example Register,o=Example AB,c=SE\",\n        \"legislationIdentification\": \"https://www.example.se/law/2026-123\"\n      },\n      \"categoryMessages\": {\n        \"none\": [\n          \"string\"\n        ],\n        \"pid\": [\n          \"string\"\n        ],\n        \"eaa\": [\n          \"string\"\n        ],\n        \"qeaa\": [\n          \"string\"\n        ],\n        \"pub-eaa\": [\n          \"string\"\n        ]\n      },\n      \"mdlConfigurationMessages\": {\n        \"none\": [\n          \"string\"\n        ],\n        \"pid\": [\n          \"string\"\n        ],\n        \"eaa\": [\n          \"string\"\n        ],\n        \"qeaa\": [\n          \"string\"\n        ],\n        \"pub-eaa\": [\n          \"string\"\n        ]\n      }\n    },\n    \"trustedListExemption\": {\n      \"listUri\": \"https://example.com/tl/eaa-providers.xml\",\n      \"service\": \"Example EAA provider\",\n      \"certificateSha256\": \"string\",\n      \"leafSha256\": \"string\",\n      \"match\": \"string\",\n      \"setAt\": \"2026-10-22T10:00:00Z\",\n      \"setBy\": \"string\",\n      \"applies\": true,\n      \"reason\": \"string\"\n    },\n    \"qscd\": false,\n    \"trust\": {\n      \"status\": \"qualified\",\n      \"checkedAt\": \"2026-10-21T10:00:00Z\",\n      \"detail\": \"Qualified certificate for electronic seals; the private key is in a QSCD (the QcSSCD statement of the certificate; the trusted list has no QSCD qualifier for it). Issuer: CN=Intesi Group EU Qualified Electronic Seal CA G3 ECC (CA/QC, granted, trusted list of IT).\"\n    },\n    \"usage\": {\n      \"credentialDefinitions\": 2,\n      \"presentationDefinitions\": 1\n    },\n    \"createdAt\": \"2026-10-20T10:00:00Z\",\n    \"updatedAt\": \"2026-10-20T10:00:00Z\"\n  },\n  \"warnings\": [\n    {\n      \"code\": \"test-certificate\",\n      \"message\": \"Development and testing only. The built-in test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it. Do not use it in production.\"\n    }\n  ],\n  \"affectedCredentialConfigurations\": []\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"400"} value={"400"}><div>

A check of the request failed (`<field>: <problem>`, as for the generate CSR operation), the preset is unknown, `validityDays` is more than the preset allows (`validityDays: at most <n> days for the preset <preset id> (<document>)`), the test root of the domain expired (`The test CA of the organisation for the domain <domain> expired on <time>.`), the key store of the key cannot make a CSR (a QTSP key store), or the organisation is a sandbox organisation (`Subwallets are not allowed to issue test certificates.`).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"401"} value={"401"}><div>

Unauthorized

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"403"} value={"403"}><div>

The installation switched the test CA off (`The built-in test CA is switched off in this installation.`).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"404"} value={"404"}><div>

The organisation has no key with this key ID (`Key not found: <keyId>`).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"409"} value={"409"}><div>

The key has a certificate chain from another CA (`The key has a certificate chain from another CA. Delete the chain first.`). The delete certificate chain operation removes it.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"500"} value={"500"}><div>

Internal server error

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"503"} value={"503"}><div>

The key store of the key or the local key store of the test CA does not answer, for example `Failed to issue the test certificate: Key management service is not available`.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"507"} value={"507"}><div>

Insufficient Storage: the HSM partition of the key store has no room for a new key. This is the partition of the installation HSM (the local key store in a hardware security module), or the DPoD partition of a key store of your organisation. The text is `The HSM partition has no room for a new key. Remove unused key pairs (kms signer orphans list) or give the partition more room.` A new try fails the same way: the answer has no `Retry-After`, so do not send the request again before room is free. For the installation HSM, the operator of the installation removes the unused key pairs or gives the partition more room. For a DPoD partition of your organisation, delete unused key pairs in the partition or give it more room. Some operations put the text after their own text: the test CA (`Failed to make the test CA: The HSM partition has no room ...`), the deploy of the organisation wallet (`Failed to deploy the OpenID digital wallet for organisation ID <id>: ...`) and the create of a sandbox organisation (`Failed to deploy sandbox organisation: ...`). A route that signs can also give this answer for an organisation that has no default key yet, because the wallet makes the default key the first time that it needs it.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem><TabItem label={"Example"} value={"Example"}><ResponseSamples responseExample={"{\n  \"errorCode\": 507,\n  \"errorDescription\": \"The HSM partition has no room for a new key. Remove unused key pairs (kms signer orphans list) or give the partition more room.\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem></ApiTabs></div></div>