Skip to main content

List provider keys

GET 
/v2/config/digital-wallet/openid/key-management/key-stores/:keyStoreId/provider-keys

Lists the keys that the provider of a key store has, so that you can sign with one of them. Give its providerKeyRef to the create key operation.

TypeProvider keysproviderKeyRef
vaultThe Transit keys of type ecdsa-p256.The name of the Transit key.
gcp-kmsThe enabled EC_SIGN_P256_SHA256 versions of the crypto keys of the key ring with the purpose ASYMMETRIC_SIGN.The path of the crypto key version.
aws-kmsThe enabled ECC_NIST_P256 SIGN_VERIFY customer keys of the region.The key ARN.
azure-key-vaultThe enabled EC P-256 signing keys of the vault, in their current version.The key ID with its version.
dpodThe key pairs of the partition with the label prefix ows:.The label of the key pair.
cscThe CSC credentials of the user (50 at most), with their certificates.The credential ID.

The cloud KMS types read at most 200 keys of the provider and return at most 50. A key that the credentials of the key store cannot read (no right to read it, or not found) is not in the list; the other keys are. The list call itself must work, else the operation fails. Each provider key has its public key in jwk (for csc, the public key of the leaf certificate). linked and keyId show when a key of the organisation already references the provider key. A local key store has no provider keys.

Request​

Path Parameters

    keyStoreId stringrequired

    Possible values: <= 64 characters

    Unique identifier of the key store. local-openbao, local-database or local-hsm for a key store of the installation, else the identifier that the create key store operation returned.

    Example: local-openbao

Responses​

The service returned the keys of the provider.

Response Headers
    Schema
      providerKeys object[]required

      The keys of the provider.

    • Array [
      • providerKeyRef stringrequired

      Reference of the key at the provider. For vault, the name of the Transit key. For gcp-kms, the path of the crypto key version (projects/<project>/locations/<location>/keyRings/<keyRing>/cryptoKeys/<key>/cryptoKeyVersions/<version>). For aws-kms, the key ARN. For azure-key-vault, the key ID with its version (<vaultUrl>/keys/<name>/<version>). For dpod, the label of the key pair in the partition (ows:<keyId> for a key that the wallet created). For csc, the ID of the CSC credential.

      algorithm stringnullablerequired

      Signature algorithm of the key.

      jwk objectnullablerequired

      The public key of the provider key in JSON Web Key (JWK) format: kty, crv, x, y, and alg when the provider gives it. It has no kid: the wallet gives the key its own keyId when you reference it. For csc, the public key of the leaf certificate. null when the provider gives no P-256 public key.

      kty string

      Key type. The value is EC.

      crv string

      Elliptic curve identifier. The value is P-256.

      x string

      X coordinate of the elliptic curve point, in base64url format.

      y string

      Y coordinate of the elliptic curve point, in base64url format.

      alg string

      Signature algorithm of the key.

      property name* anynullable

      The public key of the provider key in JSON Web Key (JWK) format: kty, crv, x, y, and alg when the provider gives it. It has no kid: the wallet gives the key its own keyId when you reference it. For csc, the public key of the leaf certificate. null when the provider gives no P-256 public key.

      linked booleanrequired

      Shows true when a key of the organisation already references this provider key.

      keyId stringnullablerequired

      The key of the organisation that references this provider key. null when linked is false.

      certificate objectnullablerequired

      For csc, the certificate of the CSC credential. null for the other types, and when the QTSP gives no certificate.

      subjectDN string

      Distinguished name of the certificate subject.

      issuerDN string

      Distinguished name of the certificate issuer.

      serialNumber string

      Serial number of the certificate.

      validFrom stringnullable

      Start of the validity of the certificate.

      validTo stringnullable

      End of the validity of the certificate.

      certificates string[]

      Certificate chain, leaf first. Each item is a base64 encoded DER certificate.

    • ]
    Loading...
    Last updated on