Test key store

POST 
/v2/config/digital-wallet/openid/key-management/key-stores/:keyStoreId/test

Does a connection test of a key store, then saves the result in lastCheckedAt and lastCheckResult, and sets status to active or error. The request has no body.

Type	Test
local	The health check of the key store of the installation.
vault	Log in with the authentication method, read the health of the vault and list the keys of the Transit mount. When the key store has a key of the organisation, also sign a test message and verify the signature with the stored public key.
gcp-kms	List the keys of the key ring. When the key store has a key of the organisation, also sign and verify as for vault.
aws-kms	List the keys of the region. When the key store has a key of the organisation, also sign and verify.
azure-key-vault	Get a token of the application and list the keys of the vault. When the key store has a key of the organisation, also sign and verify.
dpod	Check that the partition is active on the HSM signer, and sign and verify with a session key that does not stay in the partition. When the key store has a key of the organisation, also sign and verify. When the partition is not active, message tells its state, for example a wrong PIN.
csc	Get an OAuth 2.0 token and list the credentials. The test does not sign: a signature needs the PIN and an authorisation.

The answer is 200 OK also when the test fails: then ok is false and message tells why, as a safe text.

For a key store of a provider with qualified true (category qtsp), the operation also checks each key of the organisation in the key store against the EU trusted lists again, also when the connection test fails. The result is in trust of the key and in qualifiedStatus of the key store.

Request

Path Parameters

keyStoreId stringrequired
Possible values: <= 64 characters
Unique identifier of the key store. local-openbao, local-database or local-hsm for a key store of the installation, else the identifier that the create key store operation returned.
Example: local-openbao

Responses

200

The service did the connection test and returned the result.

Response Headers

application/json

Schema

Schema

ok booleanrequired

Shows true when the connection test passed.

message stringnullablerequired

Why the connection test failed, as a safe text. It never has a secret or the detail of the provider. null when the test passed.

checkedAt stringnullablerequired

Time of the connection test, in UTC.

Example (from schema)

{
  "ok": true,
  "message": null,
  "checkedAt": "2026-10-20T10:05:00Z"
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

404

The organisation has no key store with this ID.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

Internal server error

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Loading...