Key stores

List provider keys

GET/v4/config/ows/key-management/key-stores/{keyStoreId}/provider-keys

Lists the keys that the provider of an external key store already has, so that the organisation can sign with one of them. Give the providerKeyName of a provider key, with the keyStoreId, to Create key to reference it.

`type`	Provider keys	`providerKeyName`
`vault`	The Transit keys of type `ecdsa-p256`.	The name of the Transit key.
`gcp-kms`	The enabled `EC_SIGN_P256_SHA256` versions of the `ASYMMETRIC_SIGN` crypto keys of the key ring.	The path of the crypto key version.
`aws-kms`	The enabled `ECC_NIST_P256` `SIGN_VERIFY` customer keys of the region.	The key ARN.
`azure-key-vault`	The enabled EC P-256 signing keys of the vault, in their current version.	The key ID with its version.
`dpod`	The key pairs of the partition with the label prefix `ows:`.	The label of the key pair.
`csc`	The CSC credentials of the user (at most 50), with their certificates.	The credential ID.

The cloud KMS types read at most 200 keys and return at most 50. A key that the credentials of the key store cannot read is left out. linked and keyId show a provider key that a key of the organisation already references. Only an external key store lists provider keys: a local key store gives 400.

List provider keys

Language of the request sample

curl 'https://demo-api.igrant.io/v4/config/ows/key-management/key-stores/local-openbao/provider-keys' \
  -H 'Authorization: ApiKey <your-api-key>'

{
  "providerKeys": [
    {
      "providerKeyName": "signing-key-1",
      "algorithm": "ES256",
      "jwk": {
        "kty": "EC",
        "crv": "P-256",
        "x": "<base64url-x-coordinate>",
        "y": "<base64url-y-coordinate>",
        "alg": "ES256"
      },
      "linked": false,
      "keyId": null,
      "certificate": {
        "subjectDN": "CN=Example Organisation AB,O=Example Organisation AB,C=SE",
        "issuerDN": "CN=Example QTSP CA,O=Example QTSP,C=SE",
        "serialNumber": "4a3f9c",
        "validFrom": "2026-01-01T00:00:00Z",
        "validTo": "2028-01-01T00:00:00Z",
        "certificates": [
          "string"
        ]
      }
    }
  ]
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:read

Path parameters

keyStoreIdstringrequired
The key store ID, from List key stores. local-openbao or local-hsm for a local key store of the installation, else the id that Create key store returned.
At most 64 characters.
Example:"local-openbao"

Response

application/json

The keys of the provider.

providerKeysobject[]
The provider keys.