---
id: config-digital-wallet-open-id-list-key-stores
title: "List key stores"
description: "Lists the key stores of the organisation. The first key store is the local key store that takes new keys. The other key store of the installation comes next, but only when the organisation has keys in it. Then come the key stores that the organisation added, oldest first."
sidebar_label: "List key stores"
hide_title: true
hide_table_of_contents: true
api: eJztGttu2zj2Vwg9JYDsuGlnsfAOBptxMjOepG2mThpgOwHESMcWJxKpklQcT+F/X5xD6mo5Sbu7L7v70rgUee538kuQgIm1KKxQMpgGF8JYw2wK7B42zFilwTC1pBWlV1wKw3HrmF2lwJZCG9vsZMIdzVTMs9ayTblllt+DYRLW+MG488qmoFsbPSIhjeVZRohYrHI692hDdldapmS2YesU5A5NLOWGgDMhmbCEwp3vM+QI6h/nSQJJyFSWgLGOt/Hv8nd5wgyXyZ167G5fwaCkhDUs50IOiItLswbNJDyAJmI5izUkIK3gGZ7lDawpi5pvZqbkUqxKDUnETKrWhq1TEaet446UNc8ysAh7/LsMwkAVoImAeRJMg5ignIqVsDy7oa3vC5DzBLV+DpsFMRGEgQZTKGnABNMvwfFkgn+6doLsGNAPIgamwZZaQtITxjgIEaMFafE8L4pMxETM0R8GgXwJTJxCzvGX3RQQTAN19wfENgiDQiPpVjgS7mvamq1ca74JwgG6nrHcIAyEhdwMobXCZrhQCWMH/knfrFOVJYYZsZJCrpz17XWXZ/XfEeB4RwwiadFsrBZytUPgtRSfS2CCoC4F6F24LCIHHakC5B1XUVgtJNzyO24gYkpXa6nJI7ZUum2bQ34aMsgMMM6ur+enSDo88rwgYXawBdvQc/AcJ1ebAvYSH2GseYYkdoDW/SNX7EpzaYQN2z5SMRsis7iecp2suUa7jkst7IblKimzQdCHY3bG47QbEGIuWWmAISIunTucXM5xXSqL4SVkccrlCm2DJZCBBYpT0QMvM+tYkgweLWjJM1ZRrzT7hZtUzJQu2EfcOmxi0SouRve5ackGBYvR8GelVhmwWabKhJ2/XYxZxNem3qwkevEKmcAoJNnJzYLxOFaltOwA/3P+dnGIh/4sNYzuYTPqkHyCy4TwwZGnWc4lX0HCflm8HbMoKVTiySq4tsJWqNhVyjMw7KKU3JP3y+JtHVoOTi/VKSKOTezPa8iVhdrjqp1rYVOSiQOyECvJLVI1U9IobUWZs4PZYnaIKgnJor2FMs4+lzxDZ0mY1aWxNdBCqweRgGYHv10tLg/JrGWZB9NPzqiDMCCGgzDwsg/CwAsWf3WlhRZeqATDoomD2x0XQdeoMA65hyyzjN/hfqtLGIp8Nb19t0GDZJFIoupLtbOOVpnoZHLEbVidPthBW2BRK3KkaJmx0oW3iJBFKzK2UYyKcCaG4URIC0ZEqExkpAoqlTu3PHxuK5dx3jJmJ3I30XPLcmUs2W4nDAA6ZsVfJxIh3m0YSJ4Php+cP16AXNk0mL6aTPryfcfzoXA0t2iWpY+6u0VJNxReUGXkrGEberU3pNwplQGXO6FwQSk/QrW/KBizAwRYyfawQwMC2YaBsdyW5vkovKB9Q3GYx1Y8QNTUYg1Ja6XvzZhFoLXSEeNLC0hzrKSEmAi0WGJRAl1ykUGCMUIYtG4XJzSgD0LSdjmHECn0O/EbYuj6kt/mnMk6fF/vTjcpaPCuIh64hVZuF6bFKydhGLW0mDyiaWUE1UpT17mQmINsAsxBZf51+Lrj8T3IpPExcp46M4dVsghb4b4+3DDMMniAjEWL9z9d3Zx8OMP9O8G7PofUOYs5m5GHYtavOfmaxPgURwjUAx/RYuJwcBZXecmZxD1AUZfWVM3vI6E2TAehidc94US/LN6SCHzS2yuN6Gw2wr1IZwIJFqyQjGpx8P3C6OS1nd7iwKVABFsRGU2Z70KqldBX9QnEIgHDUrVmwlZabUnkgPLh4W5gbMwSQyTujxqbiKr2pMFXygyMoUUD1gq5Mh572/EqUw7CIDW5+9drkOJFS0xBK4V1vLKGgbHHo9ptKxYVEf14Q+Y5Zu+odOYofA0WaVQS3i+D6af9tXyVqfdj+spoSrV8Z4PxrWA+WPj5mg+/j9nJbsYjXUnVbubGwTbcz1FdTezn6JvLyIpZ5xSeWV8yY81lGsf2VbVXhmEgV0LWEiQAY2omP5dCQ0IhPEk0GKqNSpsis64jDG6f4reprZ7T4b569ylOq0jhea3B5FgJwqMwtiOEmGeZcVMIgrhcihjbN5BJoYS0LKJYdJ+bsSuEeCHMOFZ51BdGoZVnFC2CeAqx1f2A+elJgTQl5n6BPFnTPyGOKkQevohr3xs03HvIDjOVR4nC+Y2yTAP3vnGzYLGfaDjcS0Gx3DViIB+EVpISZVOuxmBMX4IOyzOy2i3Cn3Kbp1uZJwXXSyhdAdbTIqvuQdYBrjUVYUutcvZWxFphsGRn0mrO5qcUUnryd7Rdf7gYnBq0RUQ7rzUGQAuSSzunBiQT4H9+jSP69uUpL/yq9u4JaVK6DKvzp9xydtlUN0qyU8i5TIYClE21KlcuRhE2sZJNT1Rk3C6Vzt3BhlyUMubBmd4UVrH3aOGgmVYZuFBwh0FfYHgWBhI/+6QG1ZlnUmo47IuftH3B7yB7WrLYET4t2Bf2qNQe9Hrkr+qNKwW4CqPHTmxiZ0stAyoN6HkS3G5vt2EwOLMcmrR1Wf0Ju0veGWiypYAsGS4EwqoXqnuPZvDJOHvgWQl7Rm7Oe+j7WV7YDcmL/LKV46vpNmSJmdbjmajgxqyVRruMXNKb029SMv5wUrl0DcM5bKK/tar0yGvsxMVg/7kew0Q8xhB3Dpt5C8FJtUh7+yWrR7igrQ0BMxwZLqko20eVG8hE6PxXSL1T1rUWVBrXq17LA4sNzkJIhEgTmh2C0DguhaTcx5OEXI1nl52xZq/53bbKxi9btCle8DuRid7+4QHwTTXabywG53KJcjolLdflWjNNPOgZ2e6NxaGbyHuZirxQmjhEJyMpG01/GtnPUi7oEza7ETuQqj73RHfUJugF9yNI1ktJqCeNe1jRsAQNMoYX8oUzo0sffs5hY2pEIYsgEfTXjTmj1nTymTYM47Azzw6V/0HaOpqpho3TPSi/hueBm4Z6+lD1Vo5D3En4Kd56tEEYIFaaF2r8t8cmFo49aijLG4SCtJBzICmYexqnGkL6HCKCilA+mzgZ6NtoQCX6sXq3kW/nMVPnIaIHk3ACbizy22JGY98lz2jogTOQum/uhWzUFnbO1bwG02DVQncmXwRsSyX2DCNwSy04nFyB3okm78r8zpUO+252qiFJpwCrUb5GiVUML/aO3J4eRb3Hqm9g6seb3O9mFzWmqMqPB6jDldIbFn22pogwWrR2UfrE1LghyDu5VpiWunxn65a5ZRnwZvwaskgqO+rDdhQLqv/9DVFUynup1jLqDIIdEb14N8WuuB8D44yL3HQNiQQ7ZgsAYhyjbcNLe5JRn0Ght+nFOsbR1Rlb+Ilxxo2dpYADjxP7DaN50YyOEVR/EBqiEV1fzWqJ3MFSeWt2ZSbuGhpl14R9AIPNDd6zZtkzA5HqcrN9sE+yW3ZW1h/bdicmu9eU6v5rR9p1GddHhRWXHwL35tc5GMNXg3P85wa7m0FUbg4dMqogDV8Cs/BoqYNtX9i6sqxqVROwXGSsd6lS67Hmax8zXo3xv8e29plV5wrieHL8l9Gryeh4cvVqMp18N51M/hFgmdWu89V90Ii4Td/t9vY5ihrT2Wfvz9m56yNwpPgtEplVycSKgRubFwll4oQSBmWRfCsZu07vr37/BYJ6WhIYtoiq1tTV32+F9dzT3/R0rkNaM9h9PVuv7vaZv5U9dzNbP1Duxqe2YtvSvd32eWuefLhvKXC8rvQtwZvJK9TIi5+XtCHTldFMJVBdH5229HYbPvMUpTk9VD3UCnwzmWwHwA8VgrXOf+QJE7IoMVJonoMFHWy3xH3/jQc2Y0qLP0lPXdF8557r/I+KZi791JuuDzVz94NdGdENhLu8oTx5UohzwJ8U3CzHi4lPgX8mxdw7KfeWZH765uPsMAgxhbK39XUeiiYHmyp8ZLUCkgzHa+Tg6OH4yE06jxIHb+QmFUd4vSeSI2x8mntB+q+pXmE5FgzR2OXyFHLlOUQ30lkwDVJrCzM9OkogVyNeiLFYaS7tWCi6S+gCuNQqKWN/dzEI5jkIC8tX1fuLgePGfe4TctuIfoEW6AynUkDT2ruFMBCIyumuCmzT4MQbfzUy773QupxTcO3ONV33T4OfKgJHHTgRc2jqWV+hYSkeIfG1taORUbNoXcqymouMZFDwGA5DBuPVuAd2yvzB7zeq1CgO7HV/iMYUzIVcqspZeUzOCjkXKEhTFtia/b0RXs2/+LlZ6kq9rbCeWOpDVZVCr88U+he+QsK/aIG8fYPpTJ7q84+gxVJgtmOz1pvDuTEll9ixvSffmB9SmzB88BIv9SsUtT9dHtIFp4pVRq9ChaEpJEg8Y3yv5YRpmFVMGFNCSO/u3G3bA2LYMO9fnSeRpSH1WC4TrhMzIn4Fl5YtM3pEiar1kiZqb17P2McZO/j15uowZPOzq5/Y4nT0680V+zhz2OaL9+zVXyevXo++Y/mpio/y04vO1FLpnFtqPDMRgzQUDSvLLXicAjseT3ZUt16vx5w+j5VeHfmz5uhiPjt7tzgb4ZltU8M36kRhJSoua+3hoyTQxqn9eHL8Zvx6/IqeQyhjcy5b9Fx0Hv3s3Ce1ssj/Hwb/dz0M9oEWW5yjIsMZz9Zb5Befuz4FD8fuBe9S0LOgTv5yb4ul8BVhK4f5BW9Rt2GQKmMR3Jcv+ILlWmfbLS5/LkFT0sU3dFq4QvrTbV3qUdq7x7QQ4BC8sPTYLitdfuhVNNt2Bv757Mrfa3VTyj2lFP+j1SBzuWnB7mcXRwL+27q/6R75Hn3wHDY/1Nvdl70H6ozmdqP0scr9J6Wzr0Q=
sidebar_class_name: "get api-method"
info_path: docs/openid4vc-api/igrant-io-api-documentation
custom_edit_url: null
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import ApiTabs from "@theme/ApiTabs";
import DiscriminatorTabs from "@theme/DiscriminatorTabs";
import MethodEndpoint from "@theme/ApiExplorer/MethodEndpoint";
import SecuritySchemes from "@theme/ApiExplorer/SecuritySchemes";
import MimeTabs from "@theme/MimeTabs";
import ParamsItem from "@theme/ParamsItem";
import ResponseSamples from "@theme/ResponseSamples";
import SchemaItem from "@theme/SchemaItem";
import SchemaTabs from "@theme/SchemaTabs";
import Markdown from "@theme/Markdown";
import OperationTabs from "@theme/OperationTabs";
import TabItem from "@theme/TabItem";

<h1 className={"openapi__heading"}>List key stores</h1>

<MethodEndpoint method={"get"} path={"/v2/config/digital-wallet/openid/key-management/key-stores"}></MethodEndpoint>



Lists the key stores of the organisation. The first key store is the local key store that takes new keys. The other key store of the installation comes next, but only when the organisation has keys in it. Then come the key stores that the organisation added, oldest first.

A sandbox organisation gets the key stores of its main organisation. The answer never has a credential of a key store: `credentialsConfigured` shows which credentials the wallet has.


<div><div><ApiTabs label={undefined} id={undefined}><TabItem label={"200"} value={"200"}><div>

The service returned the key stores.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>keyStores</strong><span className={"openapi-schema__name"}> object[]</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The key stores of the organisation.

</div><li><div style={{"fontSize":"var(--ifm-code-font-size)","opacity":"0.6","marginLeft":"-.5rem","paddingBottom":".5rem"}}>Array [</div></li><SchemaItem collapsible={false} name={"id"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Unique identifier of the key store. `local-openbao`, `local-database` or `local-hsm` for a key store of the installation, else a UUID.","example":"local-openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"type"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`local`, `vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`, `dpod`, `csc`]"} schema={{"type":"string","description":"Type of the key store. `local` is a key store of the installation (OpenBao Transit, the wallet database, or the hardware security module of the installation). Each organisation can use it, and the API cannot add, change or delete it. `vault` is an external OpenBao or HashiCorp Vault of the organisation. `gcp-kms` is a key ring in Google Cloud KMS. `aws-kms` is one region of an AWS account (AWS KMS). `azure-key-vault` is an Azure key vault or managed HSM. `dpod` is a partition of a Thales Luna Cloud HSM service (DPoD). `csc` is a remote signing service with the Cloud Signature Consortium (CSC) API, for example a qualified trust service provider (QTSP).","enum":["local","vault","gcp-kms","aws-kms","azure-key-vault","dpod","csc"],"example":"local"}}></SchemaItem><SchemaItem collapsible={false} name={"provider"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The provider of the key store, an `id` of the providers of the list key store types operation (for example `openbao`, `hashicorp-vault`, `google-cloud-kms` or `intesi`). `null` for a `local` key store. It cannot change. An organisation has at most one key store of each provider.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 100 characters`"} schema={{"type":"string","maxLength":100,"description":"Name of the key store. It is unique in the organisation.","example":"Local vault"}}></SchemaItem><SchemaItem collapsible={false} name={"local"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` for a key store of the installation (type `local`).","example":true}}></SchemaItem><SchemaItem collapsible={false} name={"status"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`active`, `disabled`, `error`]"} schema={{"type":"string","description":"Status of the key store. `active` when the key store works. `error` after a connection test that failed. `disabled` is reserved.","enum":["active","disabled","error"],"example":"active"}}></SchemaItem><SchemaItem collapsible={false} name={"protection"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`software`, `hsm`, `hsm-backed`, `dedicated-hsm`, `provider`]"} schema={{"type":"string","nullable":true,"description":"Where the private keys of this key store are. `software`: in the software of a key management service (`local` with the backend `openbao` or `database`, `vault`, `gcp-kms` with the protection level `SOFTWARE`, `azure-key-vault` with the key type `EC`). `hsm`: in the hardware security module of the installation (`local` with the backend `hsm`). `hsm-backed`: in a cloud KMS that keeps the keys in hardware security modules of the cloud provider (`gcp-kms` with `HSM`, `aws-kms`, `azure-key-vault` with `EC-HSM`). `dedicated-hsm`: in a hardware security module partition of the organisation (`dpod`). `provider`: at the provider, which decides how it protects the keys (`csc`). An organisation key store has the `protection` of its provider, unless its settings decide.","enum":["software","hsm","hsm-backed","dedicated-hsm","provider"],"example":"software"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><strong>settings</strong><span style={{"opacity":"0.6"}}> object</span><strong style={{"fontSize":"var(--ifm-code-font-size)","color":"var(--openapi-required)"}}> required</strong></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Settings of the key store type. Never a secret.

</div></div><div><span className={"badge badge--info"}>oneOf</span><SchemaTabs><TabItem label={"local"} value={"0-item-properties"}><SchemaItem collapsible={false} name={"backend"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`openbao`, `database`, `hsm`]"} schema={{"type":"string","description":"Where the installation keeps the keys. `openbao` for OpenBao Transit (`local-openbao`), `database` for the wallet database (`local-database`, legacy, no new keys), `hsm` for the hardware security module of the installation (`local-hsm`). With `hsm`, the new local keys of the organisations go to the HSM; the keys in `local-openbao` stay there and keep working.","enum":["openbao","database","hsm"],"example":"openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"protection"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`software`, `hsm`]"} schema={{"type":"string","description":"How the key store protects the keys. `software` for the backends `openbao` and `database`, `hsm` for the backend `hsm`.","enum":["software","hsm"],"example":"software"}}></SchemaItem></TabItem><TabItem label={"vault"} value={"1-item-properties"}><SchemaItem collapsible={false} name={"address"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base address of the vault, with `https://`. The wallet refuses `http://` and private network addresses, unless the installation allows private addresses (for example on premises).","example":"https://vault.example.com:8200"}}></SchemaItem><SchemaItem collapsible={false} name={"namespace"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Namespace in the vault. Leave it out or send `null` when the vault has no namespaces.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"transitMount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the Transit secrets engine. The default is `transit`.","example":"transit"}}></SchemaItem><SchemaItem collapsible={false} name={"caCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM bundle of the certificate authorities that the wallet trusts for the TLS certificate of the vault. Without it, the wallet uses the system certificate authorities.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"clientCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM client certificate for mutual TLS. Required for the authentication method `cert`. With another method, send it when the listener of the vault requires mutual TLS. The private key of the certificate goes in the credential `clientPrivateKey`.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to the vault.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`userpass`, `approle`, `cert`, `token`]"} schema={{"type":"string","description":"Authentication method. `userpass` needs `username` and the credential `password`. `approle` needs `roleId` and the credential `secretId`. `cert` needs `clientCertificate` and the credential `clientPrivateKey`, and can have `role`. `token` needs the credential `token`.","enum":["userpass","approle","cert","token"],"example":"userpass"}}></SchemaItem><SchemaItem collapsible={false} name={"mount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the authentication method. The default is the name of the method (`userpass`, `approle` or `cert`).","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"username"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"User name, for the method `userpass`.","example":"wallet"}}></SchemaItem><SchemaItem collapsible={false} name={"roleId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Role ID, for the method `approle`.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"role"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Name of the certificate role, for the method `cert`. Optional.","example":null}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"gcp-kms"} value={"2-item-properties"}><SchemaItem collapsible={false} name={"project"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Google Cloud project ID of the key ring. A domain-scoped project ID (`example.com:my-project`) is also accepted.","example":"my-project"}}></SchemaItem><SchemaItem collapsible={false} name={"location"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Cloud KMS location of the key ring, for example `europe-west1`.","example":"europe-west1"}}></SchemaItem><SchemaItem collapsible={false} name={"keyRing"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 63 characters`"} schema={{"type":"string","maxLength":63,"description":"The name of the key ring. Letters, digits, `_` and `-`, at most 63 characters.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"protectionLevel"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`HSM`, `SOFTWARE`]"} schema={{"type":"string","description":"The protection level of the keys that the wallet creates. `HSM` (default) keeps the keys in hardware security modules of Google Cloud (the key store `protection` is `hsm-backed`). `SOFTWARE` keeps them in software (the key store `protection` is `software`).","enum":["HSM","SOFTWARE"],"example":"HSM"}}></SchemaItem></TabItem><TabItem label={"aws-kms"} value={"3-item-properties"}><SchemaItem collapsible={false} name={"region"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The AWS region of the keys, for example `eu-central-1`. Free text with a format check, not a fixed list.","example":"eu-central-1"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to AWS KMS.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`accessKey`]"} schema={{"type":"string","description":"Authentication method. `accessKey` (the only method) needs the credentials `accessKeyId` and `secretAccessKey`.","enum":["accessKey"],"example":"accessKey"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"azure-key-vault"} value={"4-item-properties"}><SchemaItem collapsible={false} name={"vaultUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The URL of the key vault (`https://<name>.vault.azure.net`) or of the managed HSM (`https://<name>.managedhsm.azure.net`), without a path and without a trailing `/`.","example":"https://my-vault.vault.azure.net"}}></SchemaItem><SchemaItem collapsible={false} name={"tenantId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Microsoft Entra tenant ID, a GUID or a domain name (for example `contoso.onmicrosoft.com`).","example":"00000000-0000-0000-0000-000000000000"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The application (client) ID of the app registration, a GUID.","example":"11111111-1111-1111-1111-111111111111"}}></SchemaItem><SchemaItem collapsible={false} name={"keyType"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`EC-HSM`, `EC`]"} schema={{"type":"string","description":"The key type of the keys that the wallet creates. `EC-HSM` (default) keeps the keys in hardware security modules (the key store `protection` is `hsm-backed`). `EC` keeps them in software (the key store `protection` is `software`). A managed HSM has `EC-HSM` keys only.","enum":["EC-HSM","EC"],"example":"EC-HSM"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the application logs in to Microsoft Entra ID.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`clientSecret`, `clientCertificate`]"} schema={{"type":"string","description":"Authentication method. `clientSecret` needs the credential `clientSecret`. `clientCertificate` needs the credentials `clientCertificate` and `clientPrivateKey`.","enum":["clientSecret","clientCertificate"],"example":"clientSecret"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"dpod"} value={"5-item-properties"}><SchemaItem collapsible={false} name={"tokenLabel"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 32 characters`"} schema={{"type":"string","maxLength":32,"description":"The label of the partition, at most 32 bytes in UTF-8, without a control character, `;`, `{` or `}`. The wallet removes the spaces around it.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"serialNumber"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** Value must match regular expression `^[0-9]{1,16}$`"} schema={{"type":"string","nullable":true,"pattern":"^[0-9]{1,16}$","description":"The serial number of the partition, a string of 1 to 16 digits. Optional; an empty string is the same as `null`, and a number is refused. When given, the HSM signer checks that the partition has this serial number.","example":null}}></SchemaItem></TabItem><TabItem label={"csc"} value={"6-item-properties"}><SchemaItem collapsible={false} name={"cscUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base URL of the CSC API of the QTSP, with `https://`.","example":"https://qtsp.example.com/csc"}}></SchemaItem><SchemaItem collapsible={false} name={"apiVersion"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`v1`, `v2`]"} schema={{"type":"string","description":"Version of the CSC API. The default is `v1`.","enum":["v1","v2"],"example":"v1"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"OAuth 2.0 client ID that the QTSP gave the organisation.","example":"client"}}></SchemaItem><SchemaItem collapsible={false} name={"userId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"User ID that the QTSP registered for the organisation.","example":"user-1"}}></SchemaItem></TabItem></SchemaTabs></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>credentialsConfigured</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

For each credential field of the key store type, `true` when the wallet has a value. The answer never has the value. Empty for the type `local`. The fields: `vault` `password`, `secretId`, `token`, `clientPrivateKey`; `gcp-kms` `serviceAccountKey`; `aws-kms` `accessKeyId`, `secretAccessKey`; `azure-key-vault` `clientSecret`, `clientCertificate`, `clientPrivateKey`; `dpod` `authTokenConfigUri`, `authTokenClientId`, `authTokenClientSecret`, `pin`; `csc` `clientSecret`, `userPin`.

</div><SchemaItem name={"property name*"} required={false} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean"}} collapsible={false} discriminator={false}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"capabilities"} required={true} schemaName={"string[]"} qualifierMessage={"**Possible values:** [`create`, `import`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete`]"} schema={{"type":"array","description":"What the key store can do. The type sets them. `local` (the key store that takes new keys): `create`, `import`, `sign`, `csr`, `certificateChain`, `test` (no `import` with the backend `hsm`). `local` (the other key store of the installation): `sign`, `csr`, `certificateChain`, `test`. `vault`: `create`, `import`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete`. `gcp-kms`, `aws-kms`, `azure-key-vault` and `dpod`: `create`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete` (no `import`). `csc`: `reference`, `sign`, `listProviderKeys`, `test`, `edit`, `delete`.","items":{"type":"string","enum":["create","import","reference","sign","csr","certificateChain","listProviderKeys","test","edit","delete"]},"example":["create","import","sign","csr","certificateChain","test"]}}></SchemaItem><SchemaItem collapsible={false} name={"qscd"} required={true} schemaName={""} qualifierMessage={undefined} schema={{"description":"Shows if the key store keeps the keys in a qualified signature creation device (QSCD). `false`, or `provider` for the type `csc`, where the QTSP decides.","example":false}}></SchemaItem><SchemaItem collapsible={false} name={"keyCount"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","description":"Number of keys of the organisation in the key store.","example":3}}></SchemaItem><SchemaItem collapsible={false} name={"qualifiedStatus"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`qualified`, `not-qualified`, `unknown`]"} schema={{"type":"string","nullable":true,"description":"Only for a key store of a provider with `qualified` `true` (category `qtsp`): `qualified` when every key of the key store is qualified and there is at least one key, `not-qualified` when a key is not, else `unknown`. `null` for every other key store: no other key store claims a qualified status. See `trust` of the key.","enum":["qualified","not-qualified","unknown"],"example":null}}></SchemaItem><SchemaItem collapsible={false} name={"lastCheckedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the last connection test, in UTC. `null` before the first test.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>lastCheckResult</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Result of a connection test of a key store.

</div><SchemaItem collapsible={false} name={"ok"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the connection test passed.","example":true}}></SchemaItem><SchemaItem collapsible={false} name={"message"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Why the connection test failed, as a safe text. It never has a secret or the detail of the provider. `null` when the test passed.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"checkedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the connection test, in UTC.","example":"2026-10-20T10:05:00Z"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"createdAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Creation time of the key store, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"updatedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the last change of the key store, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem><li><div style={{"fontSize":"var(--ifm-code-font-size)","opacity":"0.6","marginLeft":"-.5rem"}}>]</div></li></div></details></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"keyStores\": [\n    {\n      \"id\": \"local-openbao\",\n      \"type\": \"local\",\n      \"provider\": null,\n      \"name\": \"Local vault\",\n      \"local\": true,\n      \"status\": \"active\",\n      \"protection\": \"software\",\n      \"settings\": {},\n      \"credentialsConfigured\": {},\n      \"capabilities\": [\n        \"create\",\n        \"import\",\n        \"sign\",\n        \"csr\",\n        \"certificateChain\",\n        \"test\"\n      ],\n      \"qscd\": false,\n      \"keyCount\": 3,\n      \"qualifiedStatus\": null,\n      \"lastCheckedAt\": null,\n      \"lastCheckResult\": {\n        \"ok\": true,\n        \"message\": null,\n        \"checkedAt\": \"2026-10-20T10:05:00Z\"\n      },\n      \"createdAt\": \"2026-10-20T10:00:00Z\",\n      \"updatedAt\": \"2026-10-20T10:00:00Z\"\n    }\n  ]\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"401"} value={"401"}><div>

Unauthorized

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"500"} value={"500"}><div>

Internal server error

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem></ApiTabs></div></div>