---
id: config-digital-wallet-open-id-import-key
title: "Import key"
description: "Imports a private key that you already have into a key store that can import keys (capability `import`: `local` with the OpenBao backend, and `vault`). A cloud KMS, a DPoD partition and the hardware security module of the installation never import a key: create the key there, or reference a key that you made there. The X.509 certificate chain of the key is optional. With a chain, the key gets the chain as its `x5c` value, so it can sign with the `x509` format at once. This operation replaces the removed `POST /v2/config/digital-wallet/openid/key-management/x509-certificate`."
sidebar_label: "Import key"
hide_title: true
hide_table_of_contents: true
api: eJztPWtz2za2fwXD/SLNULQlO2mi3e1cRVa6al5O5DTbzWZKiIQk1CShEKBtteP/fuccACT4sCynux/urWd2ug4JAgcH5/2AfvdiJqOcbxUXmTf25ulW5EoSSrY5v6KKkUu2I2pDFdmJgtAkZzTekQ29YoRnShCKA6QSOdPDIpoRjrPAG0l6Ed3SJU+42pFQvwjHJExERJOQXHO1IWrDyLsty15QQZY0umRZ7BOaxSS8okWiwn5AJiRKRBGTV28WPqHk7FyckS3NFQe4cSxMsqF5fE1zRiSLihxWTEVcJIyIFb7nmVQ0SSh+lLErlltQcRtjEuUM9gxj9b5ZznwicpKzFctZFjGz4RIjKY2ZHheQiw0j/wyeHD8nEcsVX/EIJos2lGcWAviWSyIQ3zQJyCdAANWD/HLImimJ/9AfU0m4kiS8eRKF5IomBfOJFIRrbEu+zipEhjdPjp+HZCXylCpCFRFZhLDhsizXm8/ZNqER04vkLBVXLCbh+bvFBTm6Gh1FIlvx9VHM11zRZHBNk4SpI7FlGY+PLtlukNKMrlnKMnUE6w2cDYfBv7N/Z4ALl4TSQiqyhGdCsUixWENMyZZKeS3yGHeEaHXwpM9IskwRnpEoYTQnit2ogCyYOfMVT+BgSQh/hEgKgCs7Lb6y/wj1GelPJBGZpQzJxgD0gEzI+avp4i/DkR7UC4PtcBQCBYTBdnUT9jWIXDY3AqDYZQIyV2QjklgSdkMjlexwKQcdAZlWCJMESLYiCQAxYXRVoyJu6MF5tBK5Xraa1y9ZQQBNusP1KoAapCm9jGT5FY8Y2RY1egN6zWOWj/FZC5YVz6VCYs00W0lZsBxQyWi0cYcG5JMdZJeKaJYJRVbcAFp9TN0vfaDuS8a2Gi4ExzIRHE0Ap3U+e4PkoI/AxTXLony3hdPB83xWo8Ve+GL2w/wtmb2dfvj5/GJ2Rs4/zH+aXMzIq9nPzhFXk3Qcce0A7YzT2YeL+cv5dHIxC/vInCuRJOLa0vShCM0Uy1MWc5QfzkLOmFwIVUP1Pq6j5HwwevJUk5578DlbFZJ1yntgP6EcOgeqcDiGqGthxIwcG7EIeBKFcti6RI2LYp/YE5jWUQ+yPWFrGu3cE5y9Mcd2notocLHbsjE59cvTC/tI9bTOum1QHGLEERsqG8ittpeWqOvgsm4UlvNewyo1YiaxYBqbhdTaRR9HVORXzO/6AKjvZstzFoPsgS93TIHo5zHqI/sJsisoAKqKnNkzi0Ses0jV4dSyNGeqyDPZIGYtFVkSk3BVJAlO+4sWqFxa/TCu8XFFOTn7WjBpmJArJMRJgxxqClFLgH1qq8gUT0ACwBnRtjoNyIUgNI4rzblmGeg2IPXp4kM1b/kcnpb6D8Y3wYKD5kpL0GKbCBo7ErGcz7zpUPB2br3/0ggyVpIxZRxrqSSa65xutzxb4zskPwpHXSQK7B5Js3gpbojI1zTjUqtvg0LXeAn+nXm+V0Ixj72xp9X4mdbin1CJg501j7WZ94rtPN8zx/dCxDtv/HvDHizVZSUBHTlRKhuju9po8WvKWCO3HF3hAh5nNGWBgQcI3xurvGA+bEKxTAFsaZEoDmbfEdDJIKaKwmMZbViKf6ndlnljTyx/ZZHyfG+bA0IUZxLewkacUVLlPFt7vqeJzht7S57RHHBSR0KXSeCXBoHIUUJVWKLZH1I/jo2ibQiQSlpeNHDvl6hMdhrRHYwyBzlhAfRB0zcNCUnoSrHc6igfBD2oKL+uh+CMUOmgLg68W9+z57oXqeUg30t59ppla7XxxsMWkq3CMEreRTqKPJhnu8mpLM35fVhGGwxlODDKkhGWbtUuIG8FoZm8diQhV7iXS7ZbAC3OO3eT0hsL+dPTJuivSjq2ykKbYg6Bl+zT4Q0F5F3N9ovZCpjfmnzoKTW9LEUvQaOwa3SygG3YDU23QN8efjAAY31JBWwNOOueTQ2Pj5u7ektT5rgtPm7OrEKu0ULQQlxWG/DB4UiFVGR4fAwUmNNIsbwB4Pn8DM0+Cv7U6Hj01Lu9dfn+s+ZUh76+3N7qIXIrMqm5eXQ87JZXVkNp9LK4dCiQgvHUwZpRAQlFztc8QyUX2uFhQMINlY59NwVO0oNWNJEs1Oq3ZkhkomaMeTW5RbfbBJ5zkR39KgHQfUJLcYVoWvB1xrO1ltL1bb7LGKK+pjVYTUf4Fc01aEdLFa5K8X02P5PGeRcpI6tcpIgeQKZhFtjitlgmPNJ2JVUs5zQhIks0q2nrAoa5SgJkdY2GtLtpfWnXKc7Mh+KKo6mfEwpufM5U0BLkl2zXzaZ1LH3M+NeCER6zDA6mciBKG047tiRFbrLKX7vVaEdtaLY2jj263ZYnJfAGlST89foyuORxWCfwk9WIPh9Gp98tn8Wn7OmKHkdP4u/Y8Nny+eh0dXK8jymzIknoEqbR6u+BTLrmVywjSyB2QuOUZ1yqnCprMjq+tY51oH3pWDex1S+VPUNCgCmsT2Bo3irtvcxdCdcucm8zcCe92nNrEQP/g5Sgl7pHhOrp71sGXJPumbMiBbmG83q+h9ad53vraDu4TKXne/Ra2r9+K3I2gCCLHRVvBWjPSEbelxaU+2hpL6107fs16hq9blMmc4ABVzALfrn1PS1AD6HjOiz/qHxiEgFcSrQkWEBCQ6OhFhyGWy3hNkRHRTU9mkB0DB0kGzXUAqURN+wQm/3A0QR62Sqa6QTQmsrFiFvDTB1Oj7bGwlL42dnRTwIvx4RWW7sxQFrJWIV4DDpQBVvny4QiHZIz2PJ8z4KMNraFok5RdvCt79FkLXKuNunDD3dR+qPlJK7krVHcbDF6giJCKqoKeT8VL3DcXZLcQYYTqLVqSa9BQhopfsUaQls/BFC4PNMmmAPNUoiE0awNzkZcSxICGhwJ2YZGQfwVAFrurIFXWx4muPW9X68v75eR55Ui5hn5cfHuLfnElgTM0N6Pn171jRddd/8ly9CXSHZWkacsXYJtVqlvPabp5elxJNRarqGJ1e7+IwPAYEQdIJpc050s1+TSLKRHYe4AIpYsSWCiSAdL8LkJFTs6OZxNG6c5m8JJRvnV/eDN6itUSqIBSRlC6wIAXzZgwGcAxs39QPyTRELkMc8A69a/qQO2FTxT6J0tqWRPT4s8sSddW/Zv5evBzaCa9XuA5IDT+vm/AsmuCcnlIXobKKd5Ht2GGJqE32CG0WR9gMzpEGg1V891jUIUaRjKqsVdu8XezZPIWZ/mOW1b+9N92STMDQE6UFvEpfcOGrVy10lPg6MgUFcLs5cBaatWcAh82Q/IDOL5XLEUFqDmtMHvFjGLydnsQz3YX2PvuM7WWvS0bMju4J4OCEYh2TAa2+xAFea0oKaxiHCgdtAwK9naz55gulXVuO0cggU0izYih7OCXR+gjsATuwctaEndPFEH0Nk/JoMhUZsiXW5znpWuUzNh8B/D9F3cKjd0OKjg+F5TqvoLUu1B2wCqP2Qjb4XJt4Z/Ca3tY7aBvgXu9P6gK/o9jkjQQoJizlT9Ituyub7Z0ZOn7e1Gv2AI/gCROcNxRPHKwG7uFPny48X0v3N0o+PRd4PhcDAaXgyPx8fwv3+1DHjQ1WCzxzyW98qcrpiAtWEeyB4xi1imcppwCXGXygfrnc3P+hh8K3fyGaAbQ6bst1Gc/nb2bBitz2+e/XTJv/txWRRv0pc/55/O1z+LndpdfvzXCdt93ajhr89fLb/+KwgC3F9H8OabDbnyBLK7Mvt4oNXgexLytWPDYBJYKdWcC1Hk0UFxgTr0n8Dsb2WIW8oCzlLiYQYk1FxVOiIHZDYOc42M9V1j8xC0yiCi5rtlwRM1AHYHZTOdkB6CbqovGjqqmrqvNW3MrlgitlB9oKU8kwoiYToYFX5VcmvWqc2i0fD+YnEOKyEZQsh1T3Sjm+uMY2XRV/eszD493wMwPB8md10s+PetHuYQ6UPpsxITYYt4dKDS4lvLmxa+MeseN3EEqUgOGl8egGedT5L45orlyNKSiEJJjiUxUCORUAV0T2KBYXitY/m9XHCeM8k69eV+LtDpb/jWnvZebkCiS3iD2vQETrFMPyAv9xhP1YKQgTHZNPNJRiyVuBU+dRAzdo2HAvlJx6ltkKVN7mb1iI0hJweoiZRMytRGnpPk3cobf747yjzt/LQtX0xhTqt2wTVFodRBjhEP8O9C0jVDz89wY8l1BD4FS5oZJcOhIkTp+gaSnr0mZyIqkPDA9mY5hD90Jggmfx+dL16gN48lSL5ju96oMjYgwRyMNiy61PY51qbodetBAwi8tMtrmuQCydg9SW19vDaYSo0NbtFmQ1c6rgwL+sZkAc/lIyAKgoehOXZfp6uQOKVPwjROLEI0PkKbivBJ+DU6l0v7pWFUQIMsog2aQJOMzCYTkjEWS4yqNzK1aF1D2UVCtiyXIjPlYt2SMCAfTMK/jgEnQ4zkDUuW4fweo3Rg/9UPQkS/BtPIhkgUmWOJs3iAnMluABNOsA6raCDFii/qhWK6JiHuTBiUOP42sVKn57usPNKbXSzmZPaWnAyfk9PhaDAiUUKh6uM0OAlGPlGwDBlCmHESjoGhP7BtAc6JVrAvWg/xRE0lXumIBiSchuOux2cdj3GKS7abZRHfbsAbApM8h0eTdc6QiQISzsLxAaNetiD0v3XBhuZ1EamNLl3FVuG+V8tBAsFdsh1IMFi5r0tlquGutp54vvfC872p53tnnu/NPN972VbP3gswR0EUTUthNS1l1b1W88V+KdfcJKzjaqHOL13rx8qeEBRBCBIJ0i2tKdE8CLcczDRTGtUYZgoVmvhF2sYpgOetrNxn7pdqpIkuyNB1oYfHptavtdndA1Cha5HY/GyyqD5vzYvlL0WVxgKkkV7DsMuLhPV9jS7S0wKw9FJ00pZApQmMYZTiBNnga0ETMHliQhXYBfaEwq96TPd7LCTdFsuBHuS8shbZcgdjdLDGxGkliyB/txTxru+SNGwHJB0mZhhFm1P/n1mhHtuHB3VXC4fsIfeXIn8TJ/8Vol9p6wg0fe2U2iQOs8MR6RisG/ODOcK7YA99soRZANHlqWBNeYl+zBLRKGJGjWgWwBze1Cp7HcHvgtS1wTvUMy9tdWubuGSK/67NxqWOfnCJDPDIc//Pea5FMt8comhqTazo6Lae4bTmi3dH89mUDJ8dD08GT8gFGiQvghPSq5ggbCp0TcbsRrEMnBln5DA4DnCu4EkwDKAwbinUhkQ5VzyiSb+Tk3qxiFDXhCJfB1wKZ4r07DVU1SF3lZkzs4FOxxHt3wOdHZm/x9FdXNLwKjRpVwUpK8ISFqlcZDxyCQz9DapUzpcFFNMdRFSkd168GMwmk/6YoMl4sSBDYzI+tSbjs+AE0T7JMnZDJr4D27v5GQmPg1NA/vPT4ehpMAxO0CCoxqAJlSREbXJmIqJSy1NjoVuuKA3z0PgIvKPmBu3zfPdu9ZqtudQ9NAdURKCgwy9Lm5leg1UChEhOhk+fDoaEJtsNBVNZxLrWL5x91AmUWQFA0Ix8zIBhE3ptTOwavs4XLwbPgpPB8RMkt3MI4gJZLxAoXPhaOOVoNtDcqNiq+HYxw9xQoTY6pjKviabDtl1kNF3ydSEK2RRtBhMwPzyPiMRVSK/cyGm/nlSiWkSLFckZ4P6KkZhjNKbgcsN09awMyMSU342OT585G/bRnhOZykVSPa7vOcr+PjOrfYAjViz3Rflo8sKP/q7RklQE8C146cYFnGyRAaPpEBQ6km22wWp0LALkILZsEm4PJkf9gHyUgMGPH+ak9+HllJw8f/a0rwUo9orcgJftfHLS/0OI3Ci1leOjo+vr68A8DSQ7Suj1EdRDDYajk1ZsvpO79lDgvlP4cvvlEI+2Ke56bXnS1zLQiCqnBEW7Dy3Zcp9Dl4nmqm5QRUv6CiCtMVAR4Bm7IleTCliSKBLCO7EBxl8Xck3TiKl1lB0UFN6FfGhT2SezMaNhDaQ3TIKelAfqp5ZFV37fPMKXZUirbdT5e4NhaJXTpjW7su2bxrDDFsRa6coYuQX7rcp4Ghhy9a69stVlBfWUZVBoxW8CMsmcuFY94g52fOBEhZrGPrTxybIgdgobCVKDG9P1l5GQ5bnI35SPkXpNUAgx0FZraNC1PZw7bG9g222tcOGAD8Dke9AHXx/8hTU+H/BRQwAdYNiCWPlP0aC2i+ok6HadaTux9B+g+kCXC1GXhJDT0jiZuvM8ctwjxz1yXDfHdcUxemEqxS9QSmPa8e/3zRqUG5CX0MBaj3IgnfZsjLYWXDGRF8gWsViHce4O0/Sdntem79p0c2HNUmaAwVEaD50j2xUSbppgTxj43pBZl39vHdUO22CPEOuggQfk4nxbuHFfamteFck+MHPXFd77tjTet2TxZlcs35WJKuzgQNq6L1OHmsMkml5zqWY2zXSY1rjo+rLLyL47l0WrfvA7jlCHBKmdA0U4ese4A0mwrxQesphMJ9DdzBMtwquFsPMISt2oZkiLVKd3yFFRXRrFqazSI3MmoTst1Itobs2EFvq2ha0CgEuyFAUcrOim2drCGxpXSqqaBOrjIWABdj5dLbBeK+yP61kM3bIYmh3X2rVQoOSMSpGFRIIZcb3R7WDYx6YEJCF7pfeC10MoiztI1QGWP+Y8LMtOtY9gq2MtoPo4P354bd+0jo4icTd9+5xFUKUZQ6kUlxg4fWclV1lDoQOxAqq0gTty05YNVP9XHDk5n9cbl8omLo0gU+89drbTawIJ0VRTnGbe2lI166ebQW7ZiT4PPdzW/q14tmZ5rfivg8ztbClV0SYkvY1pC7mDI3CYKVupoFUTZXfC07LQTvt38PrFLiS9641AEuJlWatt9IeKrSUzvmvbXDG4OiRr3A4BWPc/EumRSo7cWJsMblJs3jEIftgCNizjuuVeo5QMj+X+aTGiY7nqoOF4DAeNxMPZ2x0M/WYDOLe929Vxk+PBaOTWN+L8LzrrM1uQGGbujLI3mzC0pDhg2ob5YNc4MABzb50D6TV7urtUQn9vCVs5L2q8rzKK202zOq/AG51hzu0rptOEkirDUhVjY9UeJmwYCore+8X0DICyBSqYfykjzNrzM02r7oy6OKy8kaasHHG6AdEqjWQUmlxUOQjkZmyj27r2typ1rG+rM4WAax+m+l+xHWr/TnXv4KdsU3I2W2vqun/vupKqpTHpGtS/VpqzjzVakLW6JtTX2B7Q7P2s+r+MFrQBO5FlLGqSoQYZVB+Dldoy8tDerbDccdi2fFyrpsJMbeOF2gi81qtnUYUkMZ0cvZ9Wjq9B/TqnmWIxpJK6UFX2+mJnQ/eCqKWrpE9J86h+3ReMJmBTCFnvnLLs2sU2qMjBnr6LfTKhBk181c4aLBmSCajkzS4zcZ2ZQbVbzowYaGzeGDC+zSsYs2HJTGla1duCtpc2KVh0yWK4h8ZNiJYQgnR0IfZ8z4BVT4lWA0Bd6Um7dcQ9EtQptsdpqgr7LnF41zbaKmZYVzExU5Qn3wAfhGBopIybtLa9Kdp8rluATVaoCL10iVqUe71haNU139qzc+dDk7d5txpSJhBbHQ/vD+IEIPi/GhncpneYVVtk76MF/F1Lqjag+2t7CzZXAJ9aesnNBT39gMzxyrAxmb79+zxTTHLyQy6KLRB5Bf2sgnYBfDadkB9OyGw6JT2UF74VEH4DfSsyv+i3YwNGxrk0WxLHAQof7fmG7muog1KboSRzZKVN+ffK4IqucdehkU6lU4YB9uoKwyh4uOhIl/VgaC1gFOCwlv2s0O0rKzdUELMVz7hO2ADJYto5U1bcVS+RNOtdExiVKJ0gPBlsxHSvMLQ3WTmto5Pu9XUOWuJdiCZEgNJBwrbhGgtdvF0LjKGQh6cGq1rm2gu8ysZjEJhOzKSrI0lTiezIqZewnlXYcBAOrWtrDB01Ovnvw/YdCHUZfQRBTOdAvhWChx6qC8OwlQbtRMjdgH7BHl/sWf8Dfkaj29IqZLedy96LBPqlW20c19WGvknjPweVq+4SKksX/9vga8c9sXIMr3Vwbuso73dwrwPwK1FYNcrrznXTW9bdgtXV59RuhOnqA7mrv+GOCJ5xc6xV71KIey5fMCKvG0yB5OFfp8fHutblwKt7XCRiJmQqYtgD/n3mHOAXvyVE66Kg+rqL+crzPD0+vu2YvoPGnJJmCqkauPhrS3OaMgWhAn2h0h2XvdkrD8s7VCVJuZQ8W9sbfHQDgA0Z2wtku68Q9LvshPrVkq27YJvLO7caWujsLa6YLqzf/ahTHa3rwc5nb/zq0zLIiW3Dd1zUeifsTme332wV41kNwO57Wh9wP+QDroa870rI6s4RbXjULxLUdxsYcGsXDqKT1HUVIUibJg8N/8Q89DEzxvtv6AI1UXP6J0bNRZOojJnfuiWPSzI/6yKs54/Yq7BX3cUuKxMATdbyUUpveFqkjnWOtwWadkbnxsp2V2N5XbNItzQ3hmy73Qna62spWueSuF5ZTeDKT7MgXF3YkGq2bEAJ0W/B2Mrj4QXRNeiqpdu08+RPrdjBS87hxlU4VZYTXKYDRyd/Yhxd1G4f7Ah+ota/ohyN9CaFYS5C/+YARo8nWw73No4/Y2hA0bUELJmbeE3rNOnhZbxnpz9N+56Pd928Ka/VB6SlTG0E3OO7FWjHbincAug99IJ+4PkjreE9nW5CqD830wBnLBWGQsBQzhMnkRWzVAzolgccoyYBh1vxmhOc5yIudPT4jmnum2Gh6Bry0nd8LvXrJiBfKuQvgDo1UdkjqAp09APfg/sgzOlZp2fsTYzatvW1dcAgt4rxFFsmavpbqnyDIZmwNk95gU318wdsxW+sxRtqGAn2t5h7UFROeYI42NIImmRYsA4a046J+fBvO1HkgA64L/D7UEeteLYSlpFphIzMUoxherLYAhn8T4W8cv/8h+pRHevugTXQUn5kWQfvKhHAewpvh0iQBGuV3pro0Sr+Ca8NwAaUqphGYnwPr4/svUPumOtcbveH5278oeSo8z56FyISiTTdzHCELINvpFGkv5k4jxK6acPHqyb96kaDnW1sdeIsEALC41E0i2keywHul9NMkRXU3OijNZhGaD+dTMlPU7ib7aLvk/ns4iVZnA1+/HRBfprq1aAXwhY1pWciOsIyrSq2Y67ZB6mT8IhlEiWlpdwtjTaMjILj1tFBCTrF14HI10fmW3n0ej6dvV3MBvDNbZXbqo4TkBWb2h3LESA29LGPjkfQzjzEO6CFVCnNHHjmpTPRZCNHuTz+0szjL808/tLM4y/NPP7SzOMvzTz+0szjL808/tLM/7FfmjFOFQjFo20CCZ5bY33+bhzVz97VSP8OwopjLVBNx+sfq8mw+6Gu5/UDWd6rBq7wBjzg8Wfv99/h3saPeXJ7C4+/FixHLxuuVM+5Tp99/lLmddDLBUN07E215Tkwtf1o23jjzp+UAb9UfzTB2yGc4a2IyK3rp4NV4/ne0vyUTooRDcz24bx+9acGErzJuoOqjWbzh1OGRrOdA0XTV9XAwn8B9M5P/gYW/Su2+74crt/c+UHpH+vRcL6QMftf5MHWYw==
sidebar_class_name: "post api-method"
info_path: docs/openid4vc-api/igrant-io-api-documentation
custom_edit_url: null
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import ApiTabs from "@theme/ApiTabs";
import DiscriminatorTabs from "@theme/DiscriminatorTabs";
import MethodEndpoint from "@theme/ApiExplorer/MethodEndpoint";
import SecuritySchemes from "@theme/ApiExplorer/SecuritySchemes";
import MimeTabs from "@theme/MimeTabs";
import ParamsItem from "@theme/ParamsItem";
import ResponseSamples from "@theme/ResponseSamples";
import SchemaItem from "@theme/SchemaItem";
import SchemaTabs from "@theme/SchemaTabs";
import Markdown from "@theme/Markdown";
import OperationTabs from "@theme/OperationTabs";
import TabItem from "@theme/TabItem";

<h1 className={"openapi__heading"}>Import key</h1>

<MethodEndpoint method={"post"} path={"/v2/config/digital-wallet/openid/key-management/keys/import"}></MethodEndpoint>



Imports a private key that you already have into a key store that can import keys (capability `import`: `local` with the OpenBao backend, and `vault`). A cloud KMS, a DPoD partition and the hardware security module of the installation never import a key: create the key there, or reference a key that you made there. The X.509 certificate chain of the key is optional. With a chain, the key gets the chain as its `x5c` value, so it can sign with the `x509` format at once. This operation replaces the removed `POST /v2/config/digital-wallet/openid/key-management/x509-certificate`.

The private key must be protected with a password, so that the key is never sent in clear text. Send the file in `file` and its password in `password`. The file is one of these:

- A PKCS#12 file (`.p12` or `.pfx`) that is protected with the password. It holds exactly one private key. Certificates are optional. The leaf certificate is the certificate for the private key, and the other certificates are its chain. The service puts the chain in order: the leaf certificate first, then the issuer of each certificate. When the service cannot find the issuer of a certificate, it keeps the order of the file.
- PEM text with exactly one encrypted PKCS#8 private key (`BEGIN ENCRYPTED PRIVATE KEY`) that is encrypted with the password. Certificates (`BEGIN CERTIFICATE`) can follow the key: the leaf certificate first, then the intermediate certificates, then the root certificate.

The private key must be a P-256 key. The service refuses a private key that is not protected in one of these two formats: a key without a password (`BEGIN PRIVATE KEY`, `BEGIN EC PRIVATE KEY`), a legacy encrypted PEM key (`Proc-Type: 4,ENCRYPTED`) and a PKCS#12 file without a password. When the file has certificates, one of them must be for the private key. The service refuses the file when a certificate does not use the P-256 curve, when a certificate is expired or not yet valid, or when a chain signature is not correct. The service never returns the password. The field `fullchain_file` is removed: the service refuses a request with it.

A key without a certificate cannot sign with the `x509` format until it has a certificate chain. To add a chain, generate a CSR with the generate CSR operation, get a certificate for it, and upload the chain with the upload certificate chain operation.

An import into a `vault` key store uses the wrapping key of that vault. A sandbox organisation cannot import a key.


## Request

<MimeTabs className={"openapi-tabs__mime"}><TabItem label={"multipart/form-data"} value={"multipart/form-data-schema"}><details style={{}} className={"openapi-markdown__details mime"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-mime"}><h3 className={"openapi-markdown__details-summary-header-body"}>Body</h3><strong className={"openapi-schema__required"}>required</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}><div style={{"marginTop":"1rem","marginBottom":"1rem"}}>

The file with the private key and the optional certificate chain, its password, and optional key store and name.

</div></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"file"} required={true} schemaName={"binary"} qualifierMessage={undefined} schema={{"type":"string","format":"binary","description":"PKCS#12 file (`.p12`, `.pfx`) or PEM file with an encrypted PKCS#8 private key (`BEGIN ENCRYPTED PRIVATE KEY`). The file holds one P-256 private key and, optionally, its certificate chain. In a PEM file, put the certificates after the key, in leaf, intermediate and root order."}}></SchemaItem><SchemaItem collapsible={false} name={"password"} required={true} schemaName={"password"} qualifierMessage={"**Possible values:** `non-empty`"} schema={{"type":"string","format":"password","minLength":1,"description":"Password of the PKCS#12 file, or passphrase of the encrypted PKCS#8 private key. It must not be empty. No answer returns it."}}></SchemaItem><SchemaItem collapsible={false} name={"keyStoreId"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 64 characters`"} schema={{"type":"string","maxLength":64,"description":"Key store for the key, a key store with the capability `import`. Optional. The default is the local key store that takes new keys.","example":"local-openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 100 characters`"} schema={{"type":"string","maxLength":100,"description":"Name of the key, for example what it signs. Optional, at most 100 characters.","example":"PID issuance 2026"}}></SchemaItem></ul></details></TabItem></MimeTabs><div><div><ApiTabs label={undefined} id={undefined}><TabItem label={"201"} value={"201"}><div>

The service imported the key and returned it. `origin` is `imported`. `hasCertificateChain` is `false` when the file has no certificate.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"keyId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Unique identifier of the key. The wallet makes it, and it cannot change. The value is the same as `jwk.kid`.","example":"3f2a91c47b8d4e6fa0c5d7e18b924f30"}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 100 characters`"} schema={{"type":"string","nullable":true,"maxLength":100,"description":"Name of the key, given by an administrator when the key is created or with the update key operation. `null` when the key has no name.","example":"PID issuance 2026"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>keyStore</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The key store that holds the key.

</div><SchemaItem collapsible={false} name={"id"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Unique identifier of the key store.","example":"local-openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"type"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`local`, `vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`, `dpod`, `csc`]"} schema={{"type":"string","description":"Type of the key store.","enum":["local","vault","gcp-kms","aws-kms","azure-key-vault","dpod","csc"],"example":"local"}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Name of the key store.","example":"Local vault"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"origin"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`created`, `imported`, `referenced`]"} schema={{"type":"string","nullable":true,"description":"How the key came to the organisation. `created`, the wallet created the key in the key store (also in a cloud KMS or a DPoD partition of the organisation). `imported`, the import key operation imported the key, with or without a certificate chain. `referenced`, the key was already in the key store of the provider, and the wallet signs with it there.","enum":["created","imported","referenced"],"example":"created"}}></SchemaItem><SchemaItem collapsible={false} name={"algorithm"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Signature algorithm of the key.","example":"ES256"}}></SchemaItem><SchemaItem collapsible={false} name={"status"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Status of the key. The wallet signs with a key that has the status `active`.","example":"active"}}></SchemaItem><SchemaItem collapsible={false} name={"isDefault"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the wallet signs with this key by default.","example":true}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>jwk</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Public key in JSON Web Key (JWK) format. The service sends only public members. It never sends the private key member `d`.

</div><SchemaItem collapsible={false} name={"kty"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Key type. The service always sends this member. The keys are elliptic curve keys, so the value is `EC`.","example":"EC"}}></SchemaItem><SchemaItem collapsible={false} name={"crv"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Elliptic curve identifier. The keys are P-256 keys, so the value is `P-256`.","example":"P-256"}}></SchemaItem><SchemaItem collapsible={false} name={"x"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"X coordinate of the elliptic curve point, in base64url format.","example":"<base64url-x-coordinate>"}}></SchemaItem><SchemaItem collapsible={false} name={"y"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Y coordinate of the elliptic curve point, in base64url format.","example":"<base64url-y-coordinate>"}}></SchemaItem><SchemaItem collapsible={false} name={"kid"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Key identifier. The value is the same as `keyId`.","example":"3f2a91c47b8d4e6fa0c5d7e18b924f30"}}></SchemaItem><SchemaItem collapsible={false} name={"alg"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Signature algorithm for the key, for example `ES256` for a P-256 key.","example":"ES256"}}></SchemaItem><SchemaItem collapsible={false} name={"x5c"} required={false} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","description":"Certificate chain of the key as it is stored, in leaf to root order (for a test certificate, the leaf and the test root). Each item is a base64 encoded DER certificate. The service adds this member only when the key has a certificate chain. The `x5c` header of a signature and the mdoc `x5chain` have the leaf and the intermediate certificates, without the trust anchor.","items":{"type":"string","description":"One base64 encoded DER certificate."}}}></SchemaItem><SchemaItem collapsible={false} name={"x5t"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"SHA-1 thumbprint of the leaf certificate. The service adds this member only when the key has a certificate chain.","example":"<base64url-sha1-thumbprint>"}}></SchemaItem><SchemaItem collapsible={false} name={"x5t#S256"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"SHA-256 thumbprint of the leaf certificate. Note the `#` in the member name. The upload certificate chain operation gives the same value as `x5t_s256`.","example":"<base64url-sha256-thumbprint>"}}></SchemaItem><SchemaItem collapsible={false} name={"x5c_expiry"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Expiry time of the leaf certificate, in UTC. The service adds this member only when the key has a certificate chain.","example":"2027-11-21T10:00:00Z"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"dids"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","description":"DIDs that come from this key.","items":{"type":"string","description":"One decentralised identifier (DID)."},"example":["did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqZ..."]}}></SchemaItem><SchemaItem collapsible={false} name={"hasCertificateChain"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the key has an X.509 certificate chain. Then the key can sign with the `x509` format.","example":false}}></SchemaItem><SchemaItem collapsible={false} name={"certificateSource"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`uploaded`, `imported`, `test-ca`, `qtsp`, `null`]"} schema={{"type":"string","nullable":true,"description":"Where the certificate chain of the key comes from. `uploaded`, the upload certificate chain operation. `imported`, the import key operation with a certificate. `test-ca`, the built-in test CA (the create test certificate operation), for development and testing only. `qtsp`, the certificate of the QTSP credential. `null` when the key has no certificate chain.","enum":["uploaded","imported","test-ca","qtsp",null],"example":null}}></SchemaItem><SchemaItem collapsible={false} name={"testCertificate"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` only when `certificateSource` is `test-ca`. The built-in test CA issued the certificate, which is for development and testing only. Wallets and verifiers outside this platform do not trust it.","example":false}}></SchemaItem><SchemaItem collapsible={false} name={"certificatePreset"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The preset of the certificate chain of the key (the list certificate presets operation). For a test certificate, the preset of its request. For an uploaded chain, the preset of the newest CSR of the key. `null` when there is none.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>certificateAssessment</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

What the leaf certificate of the key allows: its key usage type, the credential categories that it fits, the mDL Document Signer profile, its QcPSB statement, and the texts of the save check for each category. The wallet reads the certificate chain of the key. A key without a certificate chain, or with a leaf that the wallet cannot read, gives `keyUsageType` `null`, empty lists, `mdlDocumentSigner` `false`, `qcPsb` `null` and texts such as `An EAA needs a seal certificate of a legal person. This key has no certificate. Request a certificate with the preset EAA provider (eaa-provider).` The texts do not count the trusted-list exemption of the key: an exempt key is never refused.

</div><SchemaItem collapsible={false} name={"keyUsageType"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`A`, `B`, `C`, `D`, `E`, `F`, `null`]"} schema={{"type":"string","nullable":true,"description":"The key usage type of the leaf certificate (ETSI EN 319 412-2 clause 4.3.2, table 1). `A`: nonRepudiation. `B`: nonRepudiation and digitalSignature. `C`: digitalSignature. `D`: digitalSignature and keyEncipherment or keyAgreement. `E`: keyEncipherment or keyAgreement. `F`: nonRepudiation, digitalSignature and keyEncipherment or keyAgreement. `null` when the certificate has another key usage (for example with keyCertSign) or no key usage.","enum":["A","B","C","D","E","F",null],"example":"B"}}></SchemaItem><SchemaItem collapsible={false} name={"fitsCredentialCategories"} required={true} schemaName={"CredentialCategoryId[]"} qualifierMessage={"**Possible values:** [`none`, `pid`, `eaa`, `qeaa`, `pub-eaa`]"} schema={{"type":"array","description":"The credential categories that the certificate fits (the list credential categories operation), without `none`. A PID certificate fits only `pid`, and a PID certificate with another key usage type fits no category.","example":["eaa"],"items":{"type":"string","title":"CredentialCategoryId","description":"The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. `none` (no certificate rule), `pid` (person identification data), `eaa` (non-qualified attestation), `qeaa` (qualified attestation) or `pub-eaa` (attestation issued by or for a public sector body).","enum":["none","pid","eaa","qeaa","pub-eaa"],"example":"eaa"}}}></SchemaItem><SchemaItem collapsible={false} name={"fitsCredentialCategoriesForMdl"} required={true} schemaName={"CredentialCategoryId[]"} qualifierMessage={"**Possible values:** [`none`, `pid`, `eaa`, `qeaa`, `pub-eaa`]"} schema={{"type":"array","description":"The credential categories that the certificate fits for an mDL configuration, without `none`. The rules are the same as for `fitsCredentialCategories`, but `eaa`, `qeaa` and `pub-eaa` also accept key usage Type C. A key signs an mDL configuration only when `mdlDocumentSigner` is `true` and the category of the configuration is in this list.","example":["eaa"],"items":{"type":"string","title":"CredentialCategoryId","description":"The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. `none` (no certificate rule), `pid` (person identification data), `eaa` (non-qualified attestation), `qeaa` (qualified attestation) or `pub-eaa` (attestation issued by or for a public sector body).","enum":["none","pid","eaa","qeaa","pub-eaa"],"example":"eaa"}}}></SchemaItem><SchemaItem collapsible={false} name={"mdlDocumentSigner"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the certificate has the Document Signer profile of ISO/IEC 18013-5 Table B.3 (key usage `digitalSignature` and extended key usage `1.0.18013.5.1.2`, both critical). A key signs an mDL (doctype `org.iso.18013.5.1.mDL`) only with this profile.","example":false}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>qcPsb</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The QcPSB statement (`0.4.0.194126.1.3`) of a PuB-EAA provider, with all three values. `null` when the certificate has no QcPSB statement. A key with this statement signs only the attestations under its law (`legislationIdentification`, `countryOfLegislation`) and from its authentic source (`authSourceIdentification`), ETSI TS 119 412-6 clause 8.3.

</div><SchemaItem collapsible={false} name={"countryOfLegislation"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The country of the law, an ISO 3166-1 alpha-2 code, or `EU` for European Union law (ETSI TS 119 412-6 PSB-8.3-05). A PrintableString of two characters in the certificate.","example":"SE"}}></SchemaItem><SchemaItem collapsible={false} name={"authSourceIdentification"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The unambiguous identification of the authentic source (PSB-8.3-04), for example a list of relative distinguished names. At most 2048 characters, no control character.","example":"cn=Example Register,o=Example AB,c=SE"}}></SchemaItem><SchemaItem collapsible={false} name={"legislationIdentification"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The identification of the law under which the public sector body is responsible for the authentic source (PSB-8.3-02). Use a URI (RFC 3986) when one exists (PSB-8.3-03). At most 2048 characters, no control character.","example":"https://www.example.se/law/2026-123"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>categoryMessages</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

For each credential category, the texts of the save check for a configuration that is not an mDL. `none` is always an empty list.

</div><SchemaItem collapsible={false} name={"none"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"pid"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"eaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"qeaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"pub-eaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>mdlConfigurationMessages</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

For each credential category, the texts of the save check for an mDL configuration (`mso_mdoc` with doctype `org.iso.18013.5.1.mDL`) of that category. First the category rule (with key usage Type C also allowed for `eaa`, `qeaa` and `pub-eaa`), then the ISO/IEC 18013-5 Document Signer rule. `none` has only the Document Signer rule.

</div><SchemaItem collapsible={false} name={"none"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"pid"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"eaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"qeaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem><SchemaItem collapsible={false} name={"pub-eaa"} required={true} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","items":{"type":"string"}}}></SchemaItem></div></details></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>trustedListExemption</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The trusted-list exemption of a key: the certificate of the key is in a trusted list, or chains to a listed CA. While the exemption applies, a rule of the signing key check that the key does not fit gives the check result `exempt` and no refusal. The exemption is bound to the leaf certificate that the key had when the exemption was set (`leafSha256`): with another leaf, `applies` is `false` and `reason` says why and what to do (`null` while it applies). `listUri` is the source of the exemption: the URL of the trusted list, or a text, for example a recorded decision. Only the platform operator sets or removes it; the API cannot change it. The other members: `listUri` (the trusted list), `service` (the service of the list), `certificateSha256` (the SHA-256 fingerprint of the certificate of the list), `match` (how the certificate of the key matched the list), `setAt` (the time, in UTC) and `setBy` (who set it). Each of them can be `null`.

</div><SchemaItem collapsible={false} name={"listUri"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"example":"https://example.com/tl/eaa-providers.xml"}}></SchemaItem><SchemaItem collapsible={false} name={"service"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"example":"Example EAA provider"}}></SchemaItem><SchemaItem collapsible={false} name={"certificateSha256"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem><SchemaItem collapsible={false} name={"leafSha256"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem><SchemaItem collapsible={false} name={"match"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem><SchemaItem collapsible={false} name={"setAt"} required={false} schemaName={"date-time"} qualifierMessage={undefined} schema={{"type":"string","format":"date-time","nullable":true,"example":"2026-10-22T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"setBy"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem><SchemaItem collapsible={false} name={"applies"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","example":true}}></SchemaItem><SchemaItem collapsible={false} name={"reason"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"qscd"} required={true} schemaName={""} qualifierMessage={undefined} schema={{"description":"Shows if the key store keeps the key in a qualified signature creation device (QSCD). `false`, or `provider` for a key of a qualified trust service provider (key store type `csc`): the provider decides. The value comes from the key store.","example":false}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>trust</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The qualified status of a key of a key store of a qualified trust service provider: its leaf certificate against the EU trusted lists. The wallet checks it when the key is referenced and when the connection of the key store is tested.

</div><SchemaItem collapsible={false} name={"status"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`qualified`, `not-qualified`, `unknown`]"} schema={{"type":"string","description":"`qualified`: the certificate chains to a qualified certificate authority (service type CA/QC with the status granted) on the EU trusted list, and it is a qualified certificate for electronic signatures or electronic seals whose private key is in a qualified signature or seal creation device (QSCD). `not-qualified`: the trusted lists say no. `unknown`: the installation has no EU trusted list source, a list cannot be read, or the key was not checked yet.","enum":["qualified","not-qualified","unknown"],"example":"qualified"}}></SchemaItem><SchemaItem collapsible={false} name={"checkedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the check, in UTC. `null` when the key was not checked yet.","example":"2026-10-21T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"detail"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The facts that gave the result, for example the certificate authority and the trusted list, and whether the trusted list or the certificate says that the key is in a QSCD.","example":"Qualified certificate for electronic seals; the private key is in a QSCD (the QcSSCD statement of the certificate; the trusted list has no QSCD qualifier for it). Issuer: CN=Intesi Group EU Qualified Electronic Seal CA G3 ECC (CA/QC, granted, trusted list of IT)."}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>usage</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The number of credential definitions and presentation definitions that sign with the key. Only the list keys operation returns this member. A credential definition counts once, also when several of its configurations or its status lists use the key. The read key usage operation gives the details.

</div><SchemaItem collapsible={false} name={"credentialDefinitions"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","description":"Number of credential definitions that sign with the key.","example":2}}></SchemaItem><SchemaItem collapsible={false} name={"presentationDefinitions"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","description":"Number of presentation definitions that sign with the key.","example":1}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"createdAt"} required={true} schemaName={"date-time"} qualifierMessage={undefined} schema={{"type":"string","format":"date-time","nullable":true,"description":"Creation time of the key, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"updatedAt"} required={true} schemaName={"date-time"} qualifierMessage={undefined} schema={{"type":"string","format":"date-time","nullable":true,"description":"Time of the last change of the key, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"keyId\": \"3f2a91c47b8d4e6fa0c5d7e18b924f30\",\n  \"name\": \"PID issuance 2026\",\n  \"keyStore\": {\n    \"id\": \"local-openbao\",\n    \"type\": \"local\",\n    \"name\": \"Local vault\"\n  },\n  \"origin\": \"created\",\n  \"algorithm\": \"ES256\",\n  \"status\": \"active\",\n  \"isDefault\": true,\n  \"jwk\": {\n    \"kty\": \"EC\",\n    \"crv\": \"P-256\",\n    \"x\": \"<base64url-x-coordinate>\",\n    \"y\": \"<base64url-y-coordinate>\",\n    \"kid\": \"3f2a91c47b8d4e6fa0c5d7e18b924f30\",\n    \"alg\": \"ES256\",\n    \"x5c\": [\n      \"string\"\n    ],\n    \"x5t\": \"<base64url-sha1-thumbprint>\",\n    \"x5t#S256\": \"<base64url-sha256-thumbprint>\",\n    \"x5c_expiry\": \"2027-11-21T10:00:00Z\"\n  },\n  \"dids\": [\n    \"did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqZ...\"\n  ],\n  \"hasCertificateChain\": false,\n  \"certificateSource\": null,\n  \"testCertificate\": false,\n  \"certificatePreset\": null,\n  \"certificateAssessment\": {\n    \"keyUsageType\": \"B\",\n    \"fitsCredentialCategories\": [\n      \"eaa\"\n    ],\n    \"fitsCredentialCategoriesForMdl\": [\n      \"eaa\"\n    ],\n    \"mdlDocumentSigner\": false,\n    \"qcPsb\": {\n      \"countryOfLegislation\": \"SE\",\n      \"authSourceIdentification\": \"cn=Example Register,o=Example AB,c=SE\",\n      \"legislationIdentification\": \"https://www.example.se/law/2026-123\"\n    },\n    \"categoryMessages\": {\n      \"none\": [\n        \"string\"\n      ],\n      \"pid\": [\n        \"string\"\n      ],\n      \"eaa\": [\n        \"string\"\n      ],\n      \"qeaa\": [\n        \"string\"\n      ],\n      \"pub-eaa\": [\n        \"string\"\n      ]\n    },\n    \"mdlConfigurationMessages\": {\n      \"none\": [\n        \"string\"\n      ],\n      \"pid\": [\n        \"string\"\n      ],\n      \"eaa\": [\n        \"string\"\n      ],\n      \"qeaa\": [\n        \"string\"\n      ],\n      \"pub-eaa\": [\n        \"string\"\n      ]\n    }\n  },\n  \"trustedListExemption\": {\n    \"listUri\": \"https://example.com/tl/eaa-providers.xml\",\n    \"service\": \"Example EAA provider\",\n    \"certificateSha256\": \"string\",\n    \"leafSha256\": \"string\",\n    \"match\": \"string\",\n    \"setAt\": \"2026-10-22T10:00:00Z\",\n    \"setBy\": \"string\",\n    \"applies\": true,\n    \"reason\": \"string\"\n  },\n  \"qscd\": false,\n  \"trust\": {\n    \"status\": \"qualified\",\n    \"checkedAt\": \"2026-10-21T10:00:00Z\",\n    \"detail\": \"Qualified certificate for electronic seals; the private key is in a QSCD (the QcSSCD statement of the certificate; the trusted list has no QSCD qualifier for it). Issuer: CN=Intesi Group EU Qualified Electronic Seal CA G3 ECC (CA/QC, granted, trusted list of IT).\"\n  },\n  \"usage\": {\n    \"credentialDefinitions\": 2,\n    \"presentationDefinitions\": 1\n  },\n  \"createdAt\": \"2026-10-20T10:00:00Z\",\n  \"updatedAt\": \"2026-10-20T10:00:00Z\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"400"} value={"400"}><div>

The file or the password is missing, the request has the removed field `fullchain_file`, the private key is not protected with a password, the password is not correct or the file is not a PKCS#12 file or an encrypted PKCS#8 PEM, the file does not have exactly one private key, the private key is not a P-256 key, no certificate in the file is for the private key, a certificate does not use the P-256 curve, a certificate is expired or not yet valid, a chain signature is not correct, the key store cannot import keys, or the organisation is a sandbox organisation.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"401"} value={"401"}><div>

Unauthorized

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"404"} value={"404"}><div>

The organisation has no key store with this ID.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"409"} value={"409"}><div>

The organisation already has the key, or it has the maximum number of keys. For a file with a certificate, the service compares the leaf certificate (`x5t`), then the public key (the same private key with a new certificate is refused too). For a file without a certificate, it compares the public key.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"500"} value={"500"}><div>

Internal server error

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"503"} value={"503"}><div>

The provider of the key store is not available.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem></ApiTabs></div></div>