Certificates

Delete certificate chain

DELETE/v4/config/ows/key-management/keys/{keyId}/certificate-chain

Removes the certificate chain of a key. Send the body {"confirm": "DELETE"}. The key then has no x5c, x5t and x5t#S256, and cannot sign with cryptographicKeyFormat x509 until it gets a new chain from Upload certificate chain or Create test certificate.

The key store must have the capability certificateChain (local, vault, gcp-kms, aws-kms, azure-key-vault, dpod). The wallet refuses while the key signs with the x509 format for a credential definition, a presentation definition, a status list, the signed issuer metadata or a wallet provider configuration: select another key for these uses first. A test certificate of the key goes into the CRL of its test CA. The answer lists the credential configurations that no longer fit without the chain.

Language of the request sample

curl -X DELETE 'https://demo-api.igrant.io/v4/config/ows/key-management/keys/{keyId}/certificate-chain' \
  -H 'Authorization: ApiKey <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "confirm": "DELETE"
}'

{
  "affectedCredentialConfigurations": []
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:update

Path parameters

keyIdstringrequired
The keyId of a key of the organisation, from List keys or from the answer of Create key. It is also the kid of its JWK.

Body

application/json

The confirmation of the delete.

confirmenum<string>required
Must be DELETE.
Available options:DELETE
Example:"DELETE"

Response

application/json

The chain is removed. The answer lists the affected credential configurations.

affectedCredentialConfigurationsobject[]
The credential configurations whose signing key check fitted with the chain and gives does-not-fit without it. An empty list when there are none.