Keys

Read key

GET/v4/config/ows/key-management/keys/{keyId}

Returns one signing key of the organisation: its key store, public JWK, certificate chain values and certificate assessment. The same shape as an item of List keys, without usage. Public values only. A retired key gives 404, and so does the wallet key of the organisation (the automatic key of the deployment, the holder identity of the organisation wallet) while it has no certificate chain. A sandbox organisation reads the keys of its main organisation.

Read key

Language of the request sample

curl 'https://demo-api.igrant.io/v4/config/ows/key-management/keys/{keyId}' \
  -H 'Authorization: ApiKey <your-api-key>'

{
  "keyId": "cc9ea8a5e46a45768e197cfafb3cfcd7",
  "name": "EAA signing key",
  "keyStore": {
    "id": "local-openbao",
    "type": "local",
    "name": "Local vault"
  },
  "origin": "created",
  "algorithm": "ES256",
  "status": "active",
  "jwk": {
    "kid": "cc9ea8a5e46a45768e197cfafb3cfcd7",
    "kty": "EC",
    "crv": "P-256",
    "x": "DlsfFV5XHrCUGozkUB9Kk7KNIGrbLom7w_eADn5e8xQ",
    "y": "1Dnd_bH_ID02fHpMvmxFaUZ4hpSds9JONSWikNfc7g4",
    "alg": "ES256",
    "x5t": "R5aNBocxgx5EshVldhgKPbtpfEA",
    "x5t#S256": "qS40Bw2m9GehVG9R-iOK9bCYjGsRvnlsEExDcggSVvs",
    "x5c": [
      "MIIDgTCCAyagAwIBAgIQcavPGUuTy3gOaLXPgl9bRTAKBggqhkjOPQQDAjBlMQswCQYDVQQGEwJTRTEXMBUGA1UECgwOT3JnYW5pemF0aW9uIDExPTA7BgNVBAMMNE9yZ2FuaXphdGlvbiAxIFRlc3QgUHJvdmlkZXIgQ0EgKE5PVCBGT1IgUFJPRFVDVElPTikwHhcNMjYxMTA4MTQ0NjExWhcNMjYxMjA4MTQ0NzExWjBmMQswCQYDVQQGEwJTRTEYMBYGA1UECgwPRXhhbXBsZSBCYW5rIEFCMRswGQYDVQRhDBJWQVRTRS01NTY2Nzc4ODk5MDExIDAeBgNVBAMMF0V4YW1wbGUgQmFuayBFQUEgc2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDlsfFV5XHrCUGozkUB9Kk7KNIGrbLom7w/eADn5e8xTUOd39sf8gPTZ8eky+bEVpRniGlJ2z0k41JaKQ19zuDqOCAbUwggGxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBTrP7taA4RCRoafhKUX+ayf+oV9EzAdBgNVHQ4EFgQUP+HL2A1PdSRQHLmnIGAaNNAqBIswgbYGCCsGAQUFBwEBBIGpMIGmMIGjBggrBgEFBQcwAoaBlmh0dHBzOi8vZXVkaXdhbGxldC1zZXJ2aWNlLmV1YncuZGV2L29yZ2FuaXNhdGlvbi82MDkwNTI3Ny1kOTUzLTRlZjctYWE0Yy1jZWM0MTNkMDBkOTMvc2VydmljZS90ZXN0LWNhLzQ1NmYzOGU3LTZkMTMtNDI1Zi04Y2I5LTI1Y2MwNzYxODQyYS9jZXJ0aWZpY2F0ZTCBpQYDVR0fBIGdMIGaMIGXoIGUoIGRhoGOaHR0cHM6Ly9ldWRpd2FsbGV0LXNlcnZpY2UuZXVidy5kZXYvb3JnYW5pc2F0aW9uLzYwOTA1Mjc3LWQ5NTMtNGVmNy1hYTRjLWNlYzQxM2QwMGQ5My9zZXJ2aWNlL3Rlc3QtY2EvNDU2ZjM4ZTctNmQxMy00MjVmLThjYjktMjVjYzA3NjE4NDJhL2NybDAKBggqhkjOPQQDAgNJADBGAiEAsZfNUYmEjxbbAymjy7r8HTEWj01QDPv/9aoeHnMCRW0CIQCAeuc87Bj8NxT8rsCcebSt2RxhDN/C0ZAgLYYaum26tg==",
      "MIICDjCCAbOgAwIBAgIQUZwLcqhrd2hejESOFWFLOzAKBggqhkjOPQQDAjBlMQswCQYDVQQGEwJTRTEXMBUGA1UECgwOT3JnYW5pemF0aW9uIDExPTA7BgNVBAMMNE9yZ2FuaXphdGlvbiAxIFRlc3QgUHJvdmlkZXIgQ0EgKE5PVCBGT1IgUFJPRFVDVElPTikwHhcNMjYxMDI5MDMzNjM1WhcNMzUxMDI5MDMzNjM1WjBlMQswCQYDVQQGEwJTRTEXMBUGA1UECgwOT3JnYW5pemF0aW9uIDExPTA7BgNVBAMMNE9yZ2FuaXphdGlvbiAxIFRlc3QgUHJvdmlkZXIgQ0EgKE5PVCBGT1IgUFJPRFVDVElPTikwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQEOiQ6kMJ2zWARYT07sUP0Y9iq5JQCZ+rEomPqUQsfsU/ZwVfN5IN5a6CajwRnwxpAlPx3Vcc7yVVnZt21FN/Zo0UwQzASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU6z+7WgOEQkaGn4SlF/msn/qFfRMwCgYIKoZIzj0EAwIDSQAwRgIhAMM5xzqXnCz4+932zNB/H4tCcSnFcCr3lkEEfRk5PIWHAiEAivDfARxgmzXgrXcY6A0ISbgXXv7hZIB+Aw4Vfw4zjbQ="
    ],
    "x5c_expiry": "2026-12-08T14:47:11Z"
  },
  "hasCertificateChain": true,
  "certificateSource": "uploaded",
  "testCertificate": false,
  "certificatePreset": "eaa-provider",
  "certificateAssessment": {
    "keyUsageType": "B",
    "fitsCredentialCategories": [
      "eaa"
    ],
    "qcPsb": null,
    "categoryMessages": {
      "eaa": [],
      "qeaa": [
        "A QEAA needs a qualified seal certificate. This key has an EAA certificate (no QcCompliance statement; no QcSSCD statement; no QcType eseal). Request a certificate with the preset QEAA provider (qeaa-provider)."
      ],
      "pub-eaa": [
        "A PuB-EAA needs a qualified seal certificate with the QcPSB statement. This key has an EAA certificate (no QcPSB statement with its three values; no QcCompliance statement; no QcSSCD statement; no QcType eseal or eidaspsbeaa). Request a certificate with the preset PuB-EAA provider (pub-eaa-provider)."
      ],
      "mdl": [
        "An mDL needs an ISO/IEC 18013-5 document signer certificate. This key has an EAA certificate (no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset mdoc Document Signer (mdoc-document-signer)."
      ],
      "pid": [
        "A PID needs a PID provider certificate. This key has an EAA certificate (no QcType pid). Request a certificate with the preset PID provider (pid-provider)."
      ]
    },
    "fitsMdocCredentialCategories": [],
    "mdocCategoryMessages": {
      "eaa": [
        "An EAA needs a seal certificate of a legal person. This key has an EAA certificate (keyUsage type B, not C; no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset EAA provider (mdoc) (eaa-provider-mdoc)."
      ],
      "qeaa": [
        "A QEAA needs a qualified seal certificate. This key has an EAA certificate (no QcCompliance statement; no QcSSCD statement; no QcType eseal; keyUsage type B, not C; no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset QEAA provider (mdoc) (qeaa-provider-mdoc)."
      ],
      "pub-eaa": [
        "A PuB-EAA needs a qualified seal certificate with the QcPSB statement. This key has an EAA certificate (no QcPSB statement with its three values; no QcCompliance statement; no QcSSCD statement; no QcType eseal or eidaspsbeaa; keyUsage type B, not C; no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset PuB-EAA provider (mdoc) (pub-eaa-provider-mdoc)."
      ],
      "pid": [
        "A PID needs a PID provider certificate. This key has an EAA certificate (no QcType pid; keyUsage type B, not C; no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset PID provider (mdoc) (pid-provider-mdoc)."
      ]
    }
  },
  "qscd": false,
  "trust": null,
  "createdAt": "2026-11-08T14:46:47Z",
  "updatedAt": "2026-11-08T14:47:21Z"
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:read

Path parameters

keyIdstringrequired
The keyId of a key of the organisation, from List keys or from the answer of Create key. It is also the kid of its JWK.

Response

application/json

The key.

keyIdstring
The key ID. The wallet makes it and it never changes. It is also jwk.kid, and the value that a credential definition, a presentation definition or a configuration gives as its signing key.
Example:"3f2a91c47b8d4e6fa0c5d7e18b924f30"
namestring | null
A free name, for example what the key signs. Set on create or with Update key. null when the key has no name.
At most 100 characters.
Example:"PID issuance 2026"
keyStoreobject
The key store that holds the key.
originenum<string> | null
How the key came to the organisation. created, the wallet created it in the key store. imported, Import key. referenced, the key was already in the key store of the provider, and the wallet signs with it there.
Available options:created,imported,referenced
Example:"created"
algorithmstring | null
The signature algorithm of the key, ES256.
Example:"ES256"
statusstring
Always active in an answer. A retired key (see Delete key) is not returned.
Example:"active"
jwkobject
The public key as a JWK. Public members only, never d.
hasCertificateChainboolean
true when the key has an X.509 certificate chain, so it can sign with cryptographicKeyFormat x509.
Example:false
certificateSourceenum<string> | null
Where the certificate chain comes from. uploaded, Upload certificate chain. imported, Import key with a certificate. test-ca, a test certificate of the built-in test CA. qtsp, the certificate of the CSC credential of a remote signing key store. null without a certificate chain.
Available options:uploaded,imported,test-ca,qtsp
testCertificateboolean
true when certificateSource is test-ca: the key has a test certificate, for development and testing only. Wallets and verifiers outside this platform do not trust it.
Example:false
certificatePresetstring | null
The certificate preset of the chain. For a test certificate, the preset of its request; for an uploaded chain, the preset of the newest CSR of the key. null when there is none.
certificateAssessmentobject
The certificate assessment of the key. Every key has one, also a key without a certificate chain.
qscdany
Whether the key store keeps the key in a qualified signature or seal creation device (QSCD), from the key store. false, or provider for a key of a remote signing key store, where the QTSP decides.
Example:false
trustobject | null
For a key of a key store of a provider with qualified true only, its qualified status against the EU trusted lists. null for every other key.
createdAtstring<date-time> | null
When the key was added (ISO 8601 date-time, UTC).
Example:"2026-10-20T10:00:00Z"
updatedAtstring<date-time> | null
When the key last changed (ISO 8601 date-time, UTC).
Example:"2026-10-20T10:00:00Z"