Skip to main content

List key store types

GET 
/v2/config/digital-wallet/openid/key-management/key-store-types

Lists the key store types and the key store providers. A key store holds signing keys of the organisation. Its type tells what it can do, and its provider is the product or the partner. The first type is local, the key store of the installation, with canAdd false (its protection is hsm when the installation keeps the new keys in its hardware security module). Then come the types that the installation lets an organisation add (from vault, gcp-kms, aws-kms, azure-key-vault, dpod and csc).

providers is the catalogue of the installation in display order: OpenBao, HashiCorp Vault, Google Cloud KMS, AWS KMS and Azure Key Vault (category external-vault), Thales Luna Cloud HSM (DPoD) (category hsm), Intesi Group (category qtsp) and a CSC-compatible provider (category remote-signing), plus the providers that the installation adds. A provider is in the list only when the installation lets an organisation add its type and does not hide the provider. An organisation has at most one key store of each provider: a provider of which the organisation has a key store is always in the list, with canAdd false and notAvailableReason The organisation already has a key store of this provider. The type dpod is not in the default list of an installation, and it also needs the HSM signer of the platform: without it, the provider thales-dpod has canAdd false (This installation has no HSM signer for DPoD partitions.). A type that the installation does not allow is not in keyStoreTypes.

Responses​

The service returned the key store types.

Response Headers
    Schema
      keyStoreTypes object[]required

      The key store types, local first.

    • Array [
      • type stringrequired

      Possible values: [local, vault, gcp-kms, aws-kms, azure-key-vault, dpod, csc]

      The key store type.

      name stringrequired

      Display name of the type, for example Local vault, External vault (OpenBao or HashiCorp Vault), Google Cloud KMS, AWS KMS, Azure Key Vault, Thales Luna Cloud HSM (DPoD) or Remote signing service (CSC API).

      canAdd booleanrequired

      Shows true when the organisation can add a key store of a provider of this type (see providers). Always false for local. For dpod, false also when the installation has no HSM signer.

      protection stringnullablerequired

      Possible values: [software, hsm, dedicated-hsm]

      Where the keys of a key store of the type are, when the type decides it. local, software for the OpenBao or the database backend, hsm for a hardware security module backend. dpod, dedicated-hsm (a type whose providers are all hardware security modules with one protection). null for the other types; each provider has its own protection.

      qscd required

      Shows if a key store of this type keeps the keys in a qualified signature creation device (QSCD). false, or provider for csc, where the QTSP decides.

      capabilities string[]required

      What a key store of this type can do. See capabilities of the key store.

      keyOrigins string[]required

      Possible values: [created, imported, referenced]

      How keys come into a key store of this type. created (the create key operation), imported (the import key operation) and referenced (the create key operation with providerKeyRef). local, created and imported (only created with the backend hsm). vault, all three. gcp-kms, aws-kms, azure-key-vault and dpod, created and referenced. csc, referenced.

      authenticationMethods string[]nullablerequired

      Possible values: [userpass, approle, cert, token, accessKey, clientSecret, clientCertificate]

      The values of authentication.method in the settings of the type. vault userpass, approle, cert, token. aws-kms accessKey. azure-key-vault clientSecret, clientCertificate. null for the other types.

      apiVersions string[]nullablerequired

      Possible values: [v1, v2]

      The CSC API versions of the type csc. null for the other types.

    • ]
      • providers object[]required

      The key store providers, in display order (the category, then order).

    • Array [
      • id stringrequired

      Unique identifier of the provider in the catalogue. Give it in provider when you create a key store.

      category stringrequired

      Possible values: [external-vault, hsm, qtsp, remote-signing]

      The group of the provider, the box of the dashboard. external-vault: OpenBao, HashiCorp Vault and the cloud key management services that the organisation runs or rents (Google Cloud KMS, AWS KMS, Azure Key Vault). hsm: hardware security modules of the organisation (Thales Luna Cloud HSM, DPoD). qtsp: known qualified trust service providers. remote-signing: any other service with the Cloud Signature Consortium (CSC) API; it never claims a qualified status.

      type stringrequired

      Possible values: [vault, gcp-kms, aws-kms, azure-key-vault, dpod, csc]

      The key store type of the provider. Give the same value in type when you create a key store.

      name stringrequired

      Display name of the provider.

      order integerrequired

      The position of the provider in its category. The list is in display order (the category, then order).

      logo stringnullablerequired

      The key of a logo that the dashboard has (openbao, hashicorp-vault, intesi), else null. The providers google-cloud-kms, aws-kms, azure-key-vault and thales-dpod have null, and the dashboard shows a neutral icon.

      logoUrl stringnullablerequired

      An https URL of the logo of a provider that the installation added, else null. Without a logo, the dashboard shows a neutral icon.

      protection stringrequired

      Possible values: [software, hsm-backed, dedicated-hsm, provider]

      Where the private keys are. software: in the software of the key management service (openbao, hashicorp-vault). hsm-backed: in a cloud KMS that keeps the keys in hardware security modules of the cloud provider (google-cloud-kms, aws-kms, azure-key-vault). dedicated-hsm: in a hardware security module partition of the organisation (thales-dpod). provider: at the provider (a QTSP decides). A key store can have another protection than its provider when its settings decide, for example Google Cloud KMS keys of the protection level SOFTWARE.

      qualified booleanrequired

      Shows true for a known qualified trust service provider (category qtsp only). Only the key stores of such a provider get a qualified status (qualifiedStatus of the key store, trust of the key).

      region stringnullablerequired

      The country of the provider (ISO 3166-1 alpha-2), else null.

      defaults objectrequired

      Settings to fill in for a new key store of the provider. They are not secret. Built in, openbao and hashicorp-vault give transitMount, google-cloud-kms gives protectionLevel HSM, azure-key-vault gives keyType EC-HSM, intesi gives cscUrl and apiVersion, and other-csc gives apiVersion. An entry of the installation can also give location (gcp-kms) or region (aws-kms).

      property name* string
      apiVersions object[]nullablerequired

      For the type csc, the exact CSC API versions of the wallet. null for the other types.

    • Array [
      • value stringrequired

      Possible values: [v1, v2]

      The value of apiVersion in the settings.

      label stringrequired

      The exact CSC API version.

    • ]
      • canAdd booleanrequired

      Shows true when the organisation can add a key store of the provider. false only when the organisation already has a key store of the provider, or (thales-dpod) the installation has no HSM signer.

      notAvailableReason stringnullablerequired

      Why the organisation cannot add a key store of the provider, The organisation already has a key store of this provider. or This installation has no HSM signer for DPoD partitions. null when canAdd is true.

    • ]
    Loading...
    Last updated on