Skip to main content
Keys

Import key

POST/v4/config/ows/key-management/keys/import

Imports a private key that you already have, optionally with its X.509 certificate chain, into a key store with the capability import: the local key store with the OpenBao backend, or a vault key store (where the wallet uses the wrapping key of the vault). A cloud KMS, a DPoD partition and the HSM of the installation never import a key: create the key there or reference it with Create key.

The private key must be a P-256 key protected with a password. Send a multipart/form-data body with the file in file and its password in password. The file is one of:

  • A PKCS#12 file (.p12, .pfx) with exactly one private key and optional certificates. The wallet finds the leaf certificate of the private key and puts the chain in order (leaf first, then the issuer of each certificate).
  • PEM text with one encrypted PKCS#8 private key (BEGIN ENCRYPTED PRIVATE KEY), optionally followed by the certificates in leaf, intermediate, root order.

The wallet refuses a key without a password (BEGIN PRIVATE KEY, BEGIN EC PRIVATE KEY, a PKCS#12 file without a password) and a legacy encrypted PEM key (Proc-Type: 4,ENCRYPTED). When the file has certificates, one must be for the private key, each must use P-256 and be valid now, and the chain signatures must verify.

With a chain, the key gets it as x5c (certificateSource imported) and can sign with cryptographicKeyFormat x509 at once. Without one, add a chain later with Generate CSR and Upload certificate chain. An organisation can have at most 1000 keys. No answer returns the password.

Authorizations

  • Authorizationstringheaderrequired

    Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.

    Scope:keys:create

Body

multipart/form-data

The key file, its password, and the optional key store and name.

  • filefilerequired

    A PKCS#12 file (.p12, .pfx), or a PEM file with an encrypted PKCS#8 private key (BEGIN ENCRYPTED PRIVATE KEY). One P-256 private key and, optionally, its certificate chain; in a PEM file, the certificates follow the key in leaf, intermediate, root order.

  • passwordstring<password>required

    The password of the PKCS#12 file, or the passphrase of the encrypted PKCS#8 key. Required, not empty. Send it only in the body, never in the URL.

    At least 1 character.

  • keyStoreIdstring

    The key store of the key, with the capability import. Optional; default local-openbao, the local key store with the OpenBao backend (also on an installation where local-hsm is the default key store of a new key, because the HSM of the installation never imports a key).

    At most 64 characters.

    Example:"local-openbao"

  • namestring

    A free name of the key, for example what it signs, at most 100 characters. Optional.

    At most 100 characters.

    Example:"PID issuance 2026"

Response

application/json

The imported key, with origin imported. hasCertificateChain is false when the file has no certificate.

  • keyIdstring

    The key ID. The wallet makes it and it never changes. It is also jwk.kid, and the value that a credential definition, a presentation definition or a configuration gives as its signing key.

    Example:"3f2a91c47b8d4e6fa0c5d7e18b924f30"

  • namestring | null

    A free name, for example what the key signs. Set on create or with Update key. null when the key has no name.

    At most 100 characters.

    Example:"PID issuance 2026"

  • keyStoreobject

    The key store that holds the key.

  • originenum<string> | null

    How the key came to the organisation. created, the wallet created it in the key store. imported, Import key. referenced, the key was already in the key store of the provider, and the wallet signs with it there.

    Available options:created,imported,referenced

    Example:"created"

  • algorithmstring | null

    The signature algorithm of the key, ES256.

    Example:"ES256"

  • statusstring

    Always active in an answer. A retired key (see Delete key) is not returned.

    Example:"active"

  • jwkobject

    The public key as a JWK. Public members only, never d.

  • hasCertificateChainboolean

    true when the key has an X.509 certificate chain, so it can sign with cryptographicKeyFormat x509.

    Example:false

  • certificateSourceenum<string> | null

    Where the certificate chain comes from. uploaded, Upload certificate chain. imported, Import key with a certificate. test-ca, a test certificate of the built-in test CA. qtsp, the certificate of the CSC credential of a remote signing key store. null without a certificate chain.

    Available options:uploaded,imported,test-ca,qtsp

  • testCertificateboolean

    true when certificateSource is test-ca: the key has a test certificate, for development and testing only. Wallets and verifiers outside this platform do not trust it.

    Example:false

  • certificatePresetstring | null

    The certificate preset of the chain. For a test certificate, the preset of its request; for an uploaded chain, the preset of the newest CSR of the key. null when there is none.

  • certificateAssessmentobject

    The certificate assessment of the key. Every key has one, also a key without a certificate chain.

  • qscdany

    Whether the key store keeps the key in a qualified signature or seal creation device (QSCD), from the key store. false, or provider for a key of a remote signing key store, where the QTSP decides.

    Example:false

  • trustobject | null

    For a key of a key store of a provider with qualified true only, its qualified status against the EU trusted lists. null for every other key.

  • createdAtstring<date-time> | null

    When the key was added (ISO 8601 date-time, UTC).

    Example:"2026-10-20T10:00:00Z"

  • updatedAtstring<date-time> | null

    When the key last changed (ISO 8601 date-time, UTC).

    Example:"2026-10-20T10:00:00Z"