Delete certificate chain

DELETE 
/v2/config/digital-wallet/openid/key-management/keys/:keyId/certificate-chain

Removes the certificate chain of a key. The key then has no x5c, x5t and x5t#S256 values, and it cannot sign with the x509 format until you upload a new chain with the upload certificate chain operation.

This operation is for keys in a key store with the capability certificateChain (local, vault, gcp-kms, aws-kms, azure-key-vault and dpod). It needs a request body: send {"confirm": "DELETE"}. A sandbox organisation cannot remove a certificate chain.

The wallet refuses to remove the chain while the key signs with the x509 format: a credential definition, a presentation definition, a status list, the signed issuer metadata or the wallet provider global configuration that uses the key with cryptographicKeyFormat x509. Select another key for these uses first. When the key has a test certificate, the test CA revokes it, and the new CRL is made in the same change.

Request

Path Parameters

keyId stringrequired

Unique identifier of the key

application/json

Body

required

Confirmation of the delete operation.

confirm stringrequired

Possible values: [DELETE]

Confirmation string. Set the value to DELETE.

Responses

200

The wallet removed the certificate chain.

Response Headers

application/json

Schema

Schema

affectedCredentialConfigurations object[]required
The credential configurations whose signing key check fitted with the chain and gives does-not-fit without the chain. They then show does-not-fit in their signingKeyCheck. An empty list when there is none.
Array [
credentialDefinitionId stringrequired
The credential definition of the configuration.
credentialConfigurationId stringrequired
The credential configuration id, as in the OID4VCI Credential Issuer Metadata.
name stringrequired
The label of the configuration, else its display.name, else the label of the credential definition.
credentialCategory object
The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. none (no certificate rule), pid (person identification data), eaa (non-qualified attestation), qeaa (qualified attestation) or pub-eaa (attestation issued by or for a public sector body).
messages string[]required
The rules that the new certificate does not fit, with the fix, as in signingKeyCheck.messages.
]

Example (from schema)

{
  "affectedCredentialConfigurations": []
}

400

The confirmation string is missing or is not DELETE, the key has no certificate chain, the key store of the key does not take a certificate chain (A certificate chain delete is not available for a key of a QTSP key store: the chain comes from the QTSP.), or the organisation is a sandbox organisation.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

404

The organisation has no key with this key ID.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

409

The key signs with the x509 format (Certificate chain is in use with cryptographicKeyFormat x509: <counts>. Select another key for these uses first.). <counts> is for example 1 credential definition(s), 1 presentation definition(s), 1 status list(s), 1 signed issuer metadata, 1 wallet provider global configuration(s).

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

Internal server error

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Loading...