Skip to main content

List keys

GET 
/v2/config/digital-wallet/openid/key-management/keys

Lists the signing keys of the organisation, grouped by secure vault. The wallet uses these keys to sign OID4VCI credentials and OpenID4VP responses.

The response gives one entry for each secure vault that the organisation configured, with the public key and the DIDs of each key. This operation returns public key material only. It never returns the private part of a key.

This operation has no query parameters and no pagination. It returns every key of every vault.

Request​

Header Parameters

    X-SandboxOrgId stringrequired

    Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet.

    The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org instead.

    X-SubwalletId is the deprecated name of this header. The service continues to accept it, but X-SandboxOrgId wins if you send both headers.

    The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400.

    Example: 6889e1a4c5b2f30001a3d710

Responses​

The service returned the keys of the organisation.

Response Headers
    Schema
      keyManagementServices object[]nullablerequired

      One entry for each secure vault of the organisation. The value is null when the organisation has no vault.

    • Array [
      • id integerrequired

      Possible values: [1, 2, 3, 4]

      Secure vault ID. 1 for the iGrant.io vault, 2 for the Hashicorp vault, 3 for the QTSP vault, 4 for the database backed vault.

      name stringrequired

      Possible values: [igrantioVault, hashicorpVault, qtsp, dbBackedVault]

      Name of the secure vault.

      keys object[]nullablerequired

      Keys that the vault holds. The list is empty when the vault holds no key.

    • Array [
      • isDefault booleanrequired

      Shows true when the wallet signs with this key by default.

      jwk objectrequired

      Public key in JSON Web Key (JWK) format. The service sends only the members below. It removes every other member that the vault holds, which includes the private key member d.

      kty stringrequired

      Key type. The service always sends this member. The vault creates elliptic curve keys, so the value is EC.

      crv string

      Elliptic curve identifier. The usual value is P-256. A key that the organisation imported can also use secp256k1.

      x string

      X coordinate of the elliptic curve point, in base64url format.

      y string

      Y coordinate of the elliptic curve point, in base64url format.

      kid string

      Key identifier.

      alg string

      Signature algorithm for the key. The vault sets ES256 for a P-256 key.

      x5c string[]

      Certificate chain of the key, in leaf to root order. Each item is a base64 encoded DER certificate. The service adds this member only when a certificate chain is linked to the key.

      x5t string

      SHA-1 thumbprint of the leaf certificate. The service adds this member only when a certificate chain is linked to the key.

      x5t#S256 string

      SHA-256 thumbprint of the leaf certificate. Note the # in the member name. The upload certificate chain operation gives the same value as x5t_s256.

      dids string[]nullablerequired

      DIDs that come from this key.

    • ]
    • ]
    Loading...
    Last updated on