Key stores

Test key store

POST/v4/config/ows/key-management/key-stores/{keyStoreId}/test

Runs a connection test of a key store and returns the result. The request has no body. The answer is 200 also when the test fails: then ok is false and message says why. The wallet stores the result in lastCheckedAt and lastCheckResult of the key store, and sets the status of a key store that the organisation added to active or error.

`type`	Test
`local`	The health check of the key store of the installation.
`vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`	The connection test of Create key store; when the key store has a key of the organisation, also a test signature, verified with the stored public key.
`dpod`	The partition is active on the HSM signer (else `message` gives its state, for example a wrong PIN), a signature with a session key, and a test signature with a key of the organisation when there is one.
`csc`	Get an OAuth 2.0 token and list the credentials. No signature: it needs the PIN and an authorisation.

For a key store of a provider with qualified true, the test also checks each key of the organisation in it against the EU trusted lists again, also when the connection fails. The results go to trust of each key and qualifiedStatus of the key store.

Test key store

Language of the request sample

curl -X POST 'https://demo-api.igrant.io/v4/config/ows/key-management/key-stores/local-openbao/test' \
  -H 'Authorization: ApiKey <your-api-key>'

{
  "ok": true,
  "message": null,
  "checkedAt": "2026-11-08T14:46:46Z"
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:read

Path parameters

keyStoreIdstringrequired
The key store ID, from List key stores. local-openbao or local-hsm for a local key store of the installation, else the id that Create key store returned.
At most 64 characters.
Example:"local-openbao"

Response

application/json

The result of the connection test, passed or failed.

okboolean
true when the connection test passed.
Example:true
messagestring | null
Why the test failed, as a safe text without secrets or provider details. null when the test passed.
checkedAtstring | null
When the test ran (ISO 8601 date-time, UTC).
Example:"2026-10-20T10:05:00Z"