---
id: config-digital-wallet-open-id-update-key-store
title: "Update key store"
description: "Changes the name, the settings or the credentials of a key store that the organisation added. The operation changes only the members that the body gives. `settings`, when given, replaces all the settings. A credential field that the body does not give keeps the stored value."
sidebar_label: "Update key store"
hide_title: true
hide_table_of_contents: true
api: eJztXO1v2zjS/1cIfUoARXG73cOd91A8Wae76+tbrk5a4NoAYqSxzYtEqiQV1xfkf38wQ+pdsZPuHXCHzZc2lilyOJzX3wx9G6RgEi0KK5QMpsFszeUKDLNrYJLnENJfBqwVcmWY0vQ50ZCCtIJnhqkl4+watsxYpYHZNbc0RukVl8JwnJjxNIU0Yuf4vADtHiZ+LSWzLb2SQ34F2jRzXKl0y1biBkzE4oqIOGSbNUh6LkOmoch4AobxLOsQG7GTFqFsKSBLe1OnCgyTytJc7BqgcDunraTshmclRF/kF3ne2/RSZZna0Fhe2jU+TtymcrBrlUbsE5JY0xx1R0VuVFyz4CC+4WVm45DFfGOOrnNDf/6r1HB0Ddsj9+2hO40NzzKwLIUMLHQI7p0LHUOWepqYkG4sz8EvHDKjGGfG8gz5lmiwTMINaHy0NRH7FfkycuIkHrDxM4eslBkY06aOZxp4umVrTo/ziP2iNINvPC8yCBmX7AR315eciiFLrXIWJ5kAaRdEWMysqp7MQFuxRGZCzCRAaka/4TKtnp9pccMtvIZtHNLz3YzsrlyLgH8hWUNybbqagXOSOBG3lJSQkDxYMJbxFRcyYnPLDL+pxtBOnfCTPONDGl1wY1DikWFxWqgUSSZ2n83foQrin+0Dyfm1O6XfFm+ZESsJmmVqhQdOK4dMSWBW5ODlsl6KlNet0TqJJReZqbnUPN8ofQ0pu4Kl0t4yWPhmK4GIX0wmMQOZGrYRds3i887bTr2ENQy4zgQKWZt5rQ1F8U8MMgO1mJEiGhLKEbK8iOHXtjQsBq2Vjp21KbS6ESnovplKuES9d4eAliLOVMKzNheEYSjCdEI4wnCZXqlvXcPWmae9QvRFBmFQG7t5GkyDRMmlWJ2KlbA8+0Sy9L4AOU8vitQJ5wJfDcKg4JrnYEGbYPr5tmejL6T4WgITxK6lcJvrsCTy2zlSBcgrrtCYuAcpt/yKG4hRjvyztcljtlS6wyA/pZBoHDLaQ9gcSmvt2qImGrhtn0tj6TXYUktIoyAMBG6h4HYdhAF6mGAaXPuNz9MgDDR8LYWGNJhaXUIYmGQNOQ+mt4HdFjjaWC3kKgiDnH97A3Jl18H0Ty/uwsAbl2AadDYf3F26WcHYn1W6xam6DD1v+x5VCcUILYmSFqTFGXhRZN6aH//T4DS3Q1LV1T8hsXieGplhBRj81m1754aeTSZhj8p3sCGXPDjtkHHLcmUsezaZIPWaJyg6ZHDy0lh2Baz0QiMHzhlluzk0nm341pBOcR8BGMViWWZZjCqB0s6TBArrjrNh+qw0VuWgGTmr4I52Tcq39/D6W+1rbk+457ard96NUUDgbEW97ZZNRxt4wKWya6IRR1Fo4ezWYXczteyEQWWlhnJz0os4KlJxr2R+tlV00qajjgnQPkh4vyQV70uMFZYIcczsM2jRWpFLBt8saMkzhubkZ65QuX/jZi1mShfsI05RxwNt63WAqzIfexw6i+l9HLoRb8fxtXPNpRHWBwmGgVwJWYsiTdBVmM8BT1MNxgRh0A1+gsu78P79rpICw5/dOyZhQEFCef5VqVUGbJapMmWv3y527dTPXu21nobEBb4JYztMSHiWteJTtVyKBGNJkGmhhLQYJ6gyvc5NtCIqeCFMlKg87jOj0MpvFG0T7SlEu/cBtWEnQ3w8uJMhKNoaVrhRJxAnnxaopaqUOw++ijUPH7RrnBT5W+/ez+xWJrWsA2rynPglvuT8XumdwVJkUGcSIG+EVjKHZrpCqwSM6XPQrbKHV92AeZ/aNBHojVMRzXIu+QpSiqR2Ma4fmXcYuEINIUOgrkHWZqHlMlx8+1YkWhm1tOyVtJqz+amLhLr8d7RdfHgztIQ9FtHIC50hR0ByacmhulCW/nyMImJQuEcLC66tsJXUsfM1x5N9U0rutZHiUdA3IoFd3PQxrn//lFvOzrSyPoJWkp1CzmU6ZqDsWqtyte5Hv5UoZdwulc59LFiTi1zGQHSmt4VV7D1KOGimVdZ4DiEFBqPCQMqWQhvLDk7P1KkTz7TUcNhnP532G34F2W7OJibZw9ivJc8wukqZ1UhOxcPaJx78/XxxdkhBm4ZcWaCNoyWrLbY7gYVYSW5RzGdKGqWtKHN2MFvMDtnJ2bw6gMQk8WA7iUmcLLUEqDSg52lweXd5FwatiH3oGz9pYeGIhLidqjThFTvxKbk/K0pLR5NpF2JuVcky4DfAVGnvy9V/h0u9h+Be3oDEtnzmaIZc6/s4MvBOMS7NBuWNwmIMtJqXo+B7vOMjia/c4O8j5j7P9EhiGsCDmJag8adxzkjPT94yFLvfSesez/BYmnv2fzdS8h8QhFHr/MhNkNl1ptEZOLvWAFWyzXWdLaDHZvFsrbfGqmsRoT+Pa731tslZCVbw5JqvanNPJtMPiRgGzEtVapq8sjUO/UD19hlkL9rfw6aO4xUeXcm9+1R7HANCiSJZN+bEvyjwlHKlt276DmPUcsgLchoY96zRQHGMeKxWWZOMhSz+CbPwW5d43w1RKLTjFTZkCodoalW6QXlnm43xQ0CII6iCqRnlPxE7kawkPMGPa3NrxJTulrMxX/VIMUPn8gBhv7y7a3J4lybD5owbs1E6pey6zHOutz4TLvw3btlKqemIcHDPNxX1PMFft6rU75qpXwa0MGn0W9JMh4F3l3Sh4mvYumwqdAEcr6TeY6dWNY+SBolsE9bOJut4bRqsrS3M9Pg49xYlcv8SVZEE2w7p/B7O/eeXbRftv5v5zy9dlnHuTvfV7Oi3xdthHDi9DZxNwgPvw6jB3dDVDwd11m19cQZ5Q18DwnbHN89pOJ0HGqczIYcH34vZCBJFEXDBWRXi7ZIFQqAqMXDT+dnOhKTl74gEDaZQ0jhhfD6ZjANHlf1DPBVS0moEedMWyOt0vQLBhjH8d8NKlZa2kMMeQtHH19cqS00dLF7D1owF5s7aeH11BQEHCA2DnM5GujCXSMeAn/8qLJOzi4v5aRf66YGHod/Bvp2gjt1LPEFne0hiBxV648GWbrXHbzasMuc11+kG/aiBpNTCblmu0jIbnfowYq94sh5A1xhYMVyo8kWYE3hojadpWBcptC+SMGGjKvalLX039hQ1UWjDm/sgnaiJEnHwTrjjwMMUh9EwTPMk7877o6ogQmQ9KselDBEXRp/n3u+lZ9XIR6VpIUm0l9CHp4ck1rLMMZkjKSSj6Bxlk0g0UfxIjOyiTAwCLgcqsg/hRciYX+F4B54/AuKl+mAs0jrIrEbW1ioTxrZt27bAyKwuOBy0GRa3LMcaJTNRujiqC64OuTsiJM+JGJoTIS0YgcCOx76dURmUiYZoNEVgHU0j2+khepTdjhkAVMxqfx1LhOvehd9bLRirFBCxwuwqBnRM4RvcbIPnu2NvSLlSKgMuh2DGWm0Mi/HYH2SMKxjC8baLxOMkCMJTbW+/FV64GuCIHeaJFTcQN7XWbl0TOwxc4ZDxpQXtgvhOFZccKNZGsZUhToVB6XZ2QgPqoK+IeJVzCyKFfiR+hyt0dckPc8rkMa/Hq9OnNWjwqkLBVMu3C9Ou7xAzEHRE5xFP664A/6QJ451JzF146+1bJf61+briyTVgmb3SMVKe2jOHrGlsqM19/XKzYZbBDWQsXrz/5fzTyYdXY90PzXtInZOYVzPSUPT69U4e4xh37Qgn9ZMf0cPUrYERflVqIJFo0jHiuZD3klALppuhsdc95sS/Ld7u6QXxA11IT3SmkFLInR7V7OD3M6Pj14bArHOBOG1FZDxlvtBbPamS5xQSkYJha7XBTNSfaosjBx5gHBjGYQ0/bmSCjD+itM16vs0EH9Y1N7d6W/EqUQ7CYG1y968/QbIXLTYFLRfW0cp6jp0FwEWv8Nd1SBF7R6Ez9+nhw9DJylPvK3892JpSLN8ZYHx9Ih8N/HzM51CHscYIPCupOg0bOzGEpxLmUwnzqYT5VMJ8KmE+lTD/e0uYM6/hkI4hbd2tUisr5m2D/uLRQCCscqE69/AC4EA1V7och9yc9tD3r/LCbolfVY9R5ZurGg5kqZnW8Excgd4YPjqnN6e/6ZDxj0Fr7E+tKD32J3bibLD/uoZhYleoew3beWuBk+ohje2HrN2u2nCsZ/ceqhwgE6PynyP17rAutKDQuH7qT3nkYbNmISTOSAjNgCAUjjMhyffxNCVV49lZB9bsJb/txsNbwsp5wa9EJnrjudZ8O6ylVN2TndZUlipfeMJTrsO1Bk086AkZzcKv0XPBhoLuwymLXT0N9yXyQmnaISoZcdlo+q/h/WzNBX2FyW7MDqSq39uRHbUJcq11O4NTJOuhJNRI4z1b0bAEDTKBB+4LMaMzb35ew9bUC4UshlTQ/w7mjFvo5J40jHrMSTw7VP4HaeucTAU2Tu9Z8jF7xuZcC/koylLlVm6HOJLWJ3vrlw3CAFclvFDjv71tYuDYo4a8vMFZkBZSDiQFfU+jVGOL7luIZsVZvpokHcnbCKASfVs9TOTbfszUfojoQSecgoNF/r6YEey75BmBHoiB1Hlzz2TjadENFo/XoBusUugO8kWT3VGIPUML3DoWBCdXoAfW5F2JTcyod/dVdiqQpBOA1Uv+gByrNry4F3LbDUW9x6hvBPXjje932EW9Ulz5xwM8w5XSWxZ/taaI0Vq0RpH7RNe4rfpDuucnTOu4fGbrHnOLBe8Gfg1ZLJU96s/tKHZdzr5CFJfyWqqNjDtAsCOiZ++mmBX3bWCScZGbriARYyO2AKCNo7Vt9tJGMup3kOltejGOcXR1YAuPGGfc2BneUYH0xH4HNC8a6Bin6gOhIQrRxfms5oi7EOJbRaiRBIwdg7Jrwj6AweQGC55ZtgcQqYqb7Rf7JLvHTsr6sG0XMRmWKdX1YyHtOozrL0U3d9Ix/DoHY/hqFMffB+xuR5dyOHTIKII0fOmu4lAG2y7Y+sYEb4FSsFxkrFdUqc9x5BpSOnaMyb9Htu4Tq04J4vnk+Z+Onk2Onk/On02mkx+nk8k/Aledb+J8dR00LG7Td4l3P3ZT1IjOffK+T85dHoGQ4vdwZFY5EytG73Y8gCkTx5QwcH0//yal96Xf30FQ75QEmi2iqoW6+vpWWOOevtLTKYe0MNj7crZe3O09f8t7Dj1b31AO7VP7YNvcdb1Ka+Ap3dCisP+FaxB5cC9HmzNUFpqpFKoS0WnrbC7DgWnsGrDm7bEIoT6kF5PJ3cj0Y8Fefa4/c7w2WpRoDfyNtMB3xwzLuR1HPFIqdf0MdPHW26PmAqAGwtxueCbQqA1a1jqj8cYnrpELY4RchSNRjrOKwwt7dfvEuD11ly65/+TNUtznWcwsIL61WW8HBjgYysWzP7BcXEhMxJUW/yId7bPmxR+YNed9ofV1lVZd2mXdwjDXo9Tn3l+euNf6iYHWhXM+ykR0NEM2/viHtttz6ctu1L+gmWtQ6PKISqCuekyB+kkhqIXzM0VXlmNl9HPgrzUzd6/ZNbPNT198nB0GIcbw7G3dT4CsqRtOi5I4gxeCp8HxzfNjV2o5Tt18Rw4qPcb+ApEeI/LSNCbQRzpmc3zb3CK+o4AB9zN2ffoUcuW3i069036bQq6OeCEisdJc2kgoqmx2JzjTKi0TX0kdnWbfDAvLV1U32Mjrxn3dJ+SyOYcFiqOTouo0GqDRPfA3rd1BNnetT7w5rgp4vX7RszmpTu/nKgiLdFdmq7v+nXli5papKw+FhqX4hr39lOk7GhlBV77B32ouMuIB9rofhgyiVdSbdsr8i9Ssi+xA5O1lHFFoiar5obnW/aoGYaut9i4kt7vV6vu93ep+Ve9tjsKVhb1iYVl0+mfsBHbsJNJdVhQG1pWX3zqopvpIcWmnUdqNHumgdl/saM1GcBqTMsx13CruFXzut+yUBVE5leF1ej8CP/nsbdjM3e+NbxrjSd6obFB9t/Cf8TsqI9TN6PjhOzq9UUqXqjLAPCEDDDkXqA+mLBDv+79GB2oxFr82j7rK09a7nnTXL1WpL7U0KzxabG3F/9Gq8HZbjDNjBPp8BC2WAlMoNmvde5gbU3KJMOB7snfzQ8Kexl88w06xaonaRp4dUteMSlRmUNmEodIWSHzHeD/ndIKu0AljSgipmdu1cNzgClvmbWbnWkZpSMsslynXqTmi/QouLVtmiGmQhnpOE7WffpixjzN28LdP54chm786/4UtTo/+9umcfZy51eaL9+zZnyfPfjj6keWnKjnOT990SmFK59wSmpmJBKRpa+VJwZM1sOfRZHB0m80m4vR1pPTq2L9rjt/MZ6/eLV4d4Tt3DTDUHCcyK1VJWZ8edrqCNu7Yn0+ev4h+iJ5Rj50yNueyRc9FdVfGBwx9m9gKDZ5+HWl44/Lp15Gefh3p6deRnn4d6Xt+HckHrMil4yLDyt2ddwm3PiH4HNw8dxekloKavTtJgfuBJSk8ztdKDPwDlxoEYTBt/cTQZRislbE4+e0tdilf6OzuDh9/LUFTXoP3JLRwYCnmD1UDt6vJ7XAQBx98dnjI/rd/pWn0aKoEQ26b63WBY3X3V5yot8ZnHshAN2Dm2HR07iDgaoJBuo35knvjhH5oaOfYdip5dnEehMGV/42nnDLrQPMNxsN8E0yDL8GXgISGIinK5vH5bZBxuSqpPhO4aelKaIki2M6rrimv8n+0alZdjvRTrJo97S7Z7it/xQjmNWxf1sPdN/e+UKd1bjSeD4LS/w9BBtIm
sidebar_class_name: "put api-method"
info_path: docs/openid4vc-api/igrant-io-api-documentation
custom_edit_url: null
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import ApiTabs from "@theme/ApiTabs";
import DiscriminatorTabs from "@theme/DiscriminatorTabs";
import MethodEndpoint from "@theme/ApiExplorer/MethodEndpoint";
import SecuritySchemes from "@theme/ApiExplorer/SecuritySchemes";
import MimeTabs from "@theme/MimeTabs";
import ParamsItem from "@theme/ParamsItem";
import ResponseSamples from "@theme/ResponseSamples";
import SchemaItem from "@theme/SchemaItem";
import SchemaTabs from "@theme/SchemaTabs";
import Markdown from "@theme/Markdown";
import OperationTabs from "@theme/OperationTabs";
import TabItem from "@theme/TabItem";

<h1 className={"openapi__heading"}>Update key store</h1>

<MethodEndpoint method={"put"} path={"/v2/config/digital-wallet/openid/key-management/key-stores/{keyStoreId}"}></MethodEndpoint>



Changes the name, the settings or the credentials of a key store that the organisation added. The operation changes only the members that the body gives. `settings`, when given, replaces all the settings. A credential field that the body does not give keeps the stored value.

The credentials follow the authentication method. When `settings.authentication.method` changes (`vault`, `aws-kms`, `azure-key-vault`), the wallet deletes the stored credentials of the old method in the same change, so a stale secret never stays. Give the credentials of the new method, unless the wallet already has them. For example, an Azure key store that changes from `clientSecret` to `clientCertificate` needs `clientCertificate` and `clientPrivateKey`, and the wallet deletes the stored `clientSecret`.

The wallet checks the settings and does the connection test again. It saves the change only when the test passes. For `dpod`, a new PIN or new credentials make the HSM signer log in again, one time. When the test of a `dpod` key store fails and the key store worked before, the text of the `400` ends with `The key store keeps its earlier settings and credentials.`; else the new values stay and the key store has the status `error`. The provider of a key store cannot change. A `local` key store is read only. A sandbox organisation cannot change a key store.


## Request

<details style={{"marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collapsed={false} open={true}><summary style={{}}><h3 className={"openapi-markdown__details-summary-header-params"}>Path Parameters</h3></summary><div><ul><ParamsItem className={"paramsItem"} param={{"description":"Unique identifier of the key store. `local-openbao`, `local-database` or `local-hsm` for a key store of the installation, else the identifier that the create key store operation returned.","in":"path","name":"keyStoreId","required":true,"schema":{"type":"string","maxLength":64},"example":"local-openbao"}}></ParamsItem></ul></div></details><MimeTabs className={"openapi-tabs__mime"}><TabItem label={"application/json"} value={"application/json-schema"}><details style={{}} className={"openapi-markdown__details mime"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-mime"}><h3 className={"openapi-markdown__details-summary-header-body"}>Body</h3><strong className={"openapi-schema__required"}>required</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}><div style={{"marginTop":"1rem","marginBottom":"1rem"}}>

The members to change.

</div></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"name"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 100 characters`"} schema={{"type":"string","maxLength":100,"description":"New name of the key store, at most 100 characters. It must be unique in the organisation. A key store always has a name, so `null` is not accepted.","example":"Customer vault"}}></SchemaItem><SchemaItem collapsible={false} name={"provider"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 64 characters`"} schema={{"type":"string","maxLength":64,"description":"The provider of the key store. It cannot change, so a given value must be the stored one (another value gives `400`).","example":"openbao"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><strong>settings</strong><span style={{"opacity":"0.6"}}> object</span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

All the settings of the type. They replace the stored settings.

</div></div><div><span className={"badge badge--info"}>oneOf</span><SchemaTabs><TabItem label={"vault"} value={"0-item-properties"}><SchemaItem collapsible={false} name={"address"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base address of the vault, with `https://`. The wallet refuses `http://` and private network addresses, unless the installation allows private addresses (for example on premises).","example":"https://vault.example.com:8200"}}></SchemaItem><SchemaItem collapsible={false} name={"namespace"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Namespace in the vault. Leave it out or send `null` when the vault has no namespaces.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"transitMount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the Transit secrets engine. The default is `transit`.","example":"transit"}}></SchemaItem><SchemaItem collapsible={false} name={"caCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM bundle of the certificate authorities that the wallet trusts for the TLS certificate of the vault. Without it, the wallet uses the system certificate authorities.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"clientCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM client certificate for mutual TLS. Required for the authentication method `cert`. With another method, send it when the listener of the vault requires mutual TLS. The private key of the certificate goes in the credential `clientPrivateKey`.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to the vault.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`userpass`, `approle`, `cert`, `token`]"} schema={{"type":"string","description":"Authentication method. `userpass` needs `username` and the credential `password`. `approle` needs `roleId` and the credential `secretId`. `cert` needs `clientCertificate` and the credential `clientPrivateKey`, and can have `role`. `token` needs the credential `token`.","enum":["userpass","approle","cert","token"],"example":"userpass"}}></SchemaItem><SchemaItem collapsible={false} name={"mount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the authentication method. The default is the name of the method (`userpass`, `approle` or `cert`).","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"username"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"User name, for the method `userpass`.","example":"wallet"}}></SchemaItem><SchemaItem collapsible={false} name={"roleId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Role ID, for the method `approle`.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"role"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Name of the certificate role, for the method `cert`. Optional.","example":null}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"gcp-kms"} value={"1-item-properties"}><SchemaItem collapsible={false} name={"project"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Google Cloud project ID of the key ring. A domain-scoped project ID (`example.com:my-project`) is also accepted.","example":"my-project"}}></SchemaItem><SchemaItem collapsible={false} name={"location"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Cloud KMS location of the key ring, for example `europe-west1`.","example":"europe-west1"}}></SchemaItem><SchemaItem collapsible={false} name={"keyRing"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 63 characters`"} schema={{"type":"string","maxLength":63,"description":"The name of the key ring. Letters, digits, `_` and `-`, at most 63 characters.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"protectionLevel"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`HSM`, `SOFTWARE`]"} schema={{"type":"string","description":"The protection level of the keys that the wallet creates. `HSM` (default) keeps the keys in hardware security modules of Google Cloud (the key store `protection` is `hsm-backed`). `SOFTWARE` keeps them in software (the key store `protection` is `software`).","enum":["HSM","SOFTWARE"],"example":"HSM"}}></SchemaItem></TabItem><TabItem label={"aws-kms"} value={"2-item-properties"}><SchemaItem collapsible={false} name={"region"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The AWS region of the keys, for example `eu-central-1`. Free text with a format check, not a fixed list.","example":"eu-central-1"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to AWS KMS.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`accessKey`]"} schema={{"type":"string","description":"Authentication method. `accessKey` (the only method) needs the credentials `accessKeyId` and `secretAccessKey`.","enum":["accessKey"],"example":"accessKey"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"azure-key-vault"} value={"3-item-properties"}><SchemaItem collapsible={false} name={"vaultUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The URL of the key vault (`https://<name>.vault.azure.net`) or of the managed HSM (`https://<name>.managedhsm.azure.net`), without a path and without a trailing `/`.","example":"https://my-vault.vault.azure.net"}}></SchemaItem><SchemaItem collapsible={false} name={"tenantId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Microsoft Entra tenant ID, a GUID or a domain name (for example `contoso.onmicrosoft.com`).","example":"00000000-0000-0000-0000-000000000000"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The application (client) ID of the app registration, a GUID.","example":"11111111-1111-1111-1111-111111111111"}}></SchemaItem><SchemaItem collapsible={false} name={"keyType"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`EC-HSM`, `EC`]"} schema={{"type":"string","description":"The key type of the keys that the wallet creates. `EC-HSM` (default) keeps the keys in hardware security modules (the key store `protection` is `hsm-backed`). `EC` keeps them in software (the key store `protection` is `software`). A managed HSM has `EC-HSM` keys only.","enum":["EC-HSM","EC"],"example":"EC-HSM"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the application logs in to Microsoft Entra ID.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`clientSecret`, `clientCertificate`]"} schema={{"type":"string","description":"Authentication method. `clientSecret` needs the credential `clientSecret`. `clientCertificate` needs the credentials `clientCertificate` and `clientPrivateKey`.","enum":["clientSecret","clientCertificate"],"example":"clientSecret"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"dpod"} value={"4-item-properties"}><SchemaItem collapsible={false} name={"tokenLabel"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 32 characters`"} schema={{"type":"string","maxLength":32,"description":"The label of the partition, at most 32 bytes in UTF-8, without a control character, `;`, `{` or `}`. The wallet removes the spaces around it.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"serialNumber"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** Value must match regular expression `^[0-9]{1,16}$`"} schema={{"type":"string","nullable":true,"pattern":"^[0-9]{1,16}$","description":"The serial number of the partition, a string of 1 to 16 digits. Optional; an empty string is the same as `null`, and a number is refused. When given, the HSM signer checks that the partition has this serial number.","example":null}}></SchemaItem></TabItem><TabItem label={"csc"} value={"5-item-properties"}><SchemaItem collapsible={false} name={"cscUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base URL of the CSC API of the QTSP, with `https://`.","example":"https://qtsp.example.com/csc"}}></SchemaItem><SchemaItem collapsible={false} name={"apiVersion"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`v1`, `v2`]"} schema={{"type":"string","description":"Version of the CSC API. The default is `v1`.","enum":["v1","v2"],"example":"v1"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"OAuth 2.0 client ID that the QTSP gave the organisation.","example":"client"}}></SchemaItem><SchemaItem collapsible={false} name={"userId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"User ID that the QTSP registered for the organisation.","example":"user-1"}}></SchemaItem></TabItem></SchemaTabs></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><strong>credentials</strong><span style={{"opacity":"0.6"}}> object</span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Write-only credentials to change. A field of the same authentication method that you leave out keeps the stored value.

</div></div><div><span className={"badge badge--info"}>oneOf</span><SchemaTabs><TabItem label={"vault"} value={"0-item-properties"}><SchemaItem collapsible={false} name={"password"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Password, for the method `userpass`.","example":"<yourPassword>"}}></SchemaItem><SchemaItem collapsible={false} name={"secretId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Secret ID, for the method `approle`.","example":"<yourSecretId>"}}></SchemaItem><SchemaItem collapsible={false} name={"token"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Vault token, for the method `token`.","example":"<yourToken>"}}></SchemaItem><SchemaItem collapsible={false} name={"clientPrivateKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"PEM private key of `clientCertificate`, without a password. Required for the method `cert`, and when you give `clientCertificate` with another method.","example":"<yourClientPrivateKeyPem>"}}></SchemaItem></TabItem><TabItem label={"gcp-kms"} value={"1-item-properties"}><SchemaItem collapsible={false} name={"serviceAccountKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The JSON key file of a Google Cloud service account, as one string (the text of the file, not an object). Required. The wallet checks that the text is JSON, that `type` is `service_account`, that it has `client_email` and a PEM `private_key`, and that the service account is of `googleapis.com`. The wallet never sends a request to an address of the key file.","example":"<the text of the service account key file>"}}></SchemaItem></TabItem><TabItem label={"aws-kms"} value={"2-item-properties"}><SchemaItem collapsible={false} name={"accessKeyId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The access key ID. Required.","example":"<yourAccessKeyId>"}}></SchemaItem><SchemaItem collapsible={false} name={"secretAccessKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The secret access key. Required.","example":"<yourSecretAccessKey>"}}></SchemaItem></TabItem><TabItem label={"azure-key-vault"} value={"3-item-properties"}><SchemaItem collapsible={false} name={"clientSecret"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The client secret of the application, for the method `clientSecret`.","example":"<yourClientSecret>"}}></SchemaItem><SchemaItem collapsible={false} name={"clientCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The PEM certificate of the application, for the method `clientCertificate`.","example":"<yourClientCertificatePem>"}}></SchemaItem><SchemaItem collapsible={false} name={"clientPrivateKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The PEM private key of `clientCertificate`, without a password, for the method `clientCertificate`. It must be the private key of the certificate.","example":"<yourClientPrivateKeyPem>"}}></SchemaItem></TabItem><TabItem label={"dpod"} value={"4-item-properties"}><SchemaItem collapsible={false} name={"authTokenConfigUri"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 2048 characters`"} schema={{"type":"string","maxLength":2048,"description":"The value `AuthTokenConfigURI` of `Chrystoki.conf`, an https URL.","example":"<AuthTokenConfigURI>"}}></SchemaItem><SchemaItem collapsible={false} name={"authTokenClientId"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 512 characters`"} schema={{"type":"string","maxLength":512,"description":"The value `AuthTokenClientId` of `Chrystoki.conf`.","example":"<AuthTokenClientId>"}}></SchemaItem><SchemaItem collapsible={false} name={"authTokenClientSecret"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 2048 characters`"} schema={{"type":"string","maxLength":2048,"description":"The value `AuthTokenClientSecret` of `Chrystoki.conf`.","example":"<AuthTokenClientSecret>"}}></SchemaItem><SchemaItem collapsible={false} name={"pin"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 256 characters`"} schema={{"type":"string","maxLength":256,"description":"The PIN of the Crypto Officer of the partition. The HSM signer logs in one time with each new PIN. After a wrong PIN it does not log in again until you give a new PIN, because the partition locks after too many wrong PINs.","example":"<yourCryptoOfficerPin>"}}></SchemaItem></TabItem><TabItem label={"csc"} value={"5-item-properties"}><SchemaItem collapsible={false} name={"clientSecret"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"OAuth 2.0 client secret that the QTSP gave the organisation. Required.","example":"<yourClientSecret>"}}></SchemaItem><SchemaItem collapsible={false} name={"userPin"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"PIN of the user at the QTSP. Optional. The wallet uses it for a referenced key that has no PIN of its own (`providerSecret`), and for document signing.","example":"<yourUserPin>"}}></SchemaItem></TabItem></SchemaTabs></div></details></SchemaItem></ul></details></TabItem></MimeTabs><div><div><ApiTabs label={undefined} id={undefined}><TabItem label={"200"} value={"200"}><div>

The service tested and saved the change, and returned the key store.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"id"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Unique identifier of the key store. `local-openbao`, `local-database` or `local-hsm` for a key store of the installation, else a UUID.","example":"local-openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"type"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`local`, `vault`, `gcp-kms`, `aws-kms`, `azure-key-vault`, `dpod`, `csc`]"} schema={{"type":"string","description":"Type of the key store. `local` is a key store of the installation (OpenBao Transit, the wallet database, or the hardware security module of the installation). Each organisation can use it, and the API cannot add, change or delete it. `vault` is an external OpenBao or HashiCorp Vault of the organisation. `gcp-kms` is a key ring in Google Cloud KMS. `aws-kms` is one region of an AWS account (AWS KMS). `azure-key-vault` is an Azure key vault or managed HSM. `dpod` is a partition of a Thales Luna Cloud HSM service (DPoD). `csc` is a remote signing service with the Cloud Signature Consortium (CSC) API, for example a qualified trust service provider (QTSP).","enum":["local","vault","gcp-kms","aws-kms","azure-key-vault","dpod","csc"],"example":"local"}}></SchemaItem><SchemaItem collapsible={false} name={"provider"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"The provider of the key store, an `id` of the providers of the list key store types operation (for example `openbao`, `hashicorp-vault`, `google-cloud-kms` or `intesi`). `null` for a `local` key store. It cannot change. An organisation has at most one key store of each provider.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 100 characters`"} schema={{"type":"string","maxLength":100,"description":"Name of the key store. It is unique in the organisation.","example":"Local vault"}}></SchemaItem><SchemaItem collapsible={false} name={"local"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` for a key store of the installation (type `local`).","example":true}}></SchemaItem><SchemaItem collapsible={false} name={"status"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`active`, `disabled`, `error`]"} schema={{"type":"string","description":"Status of the key store. `active` when the key store works. `error` after a connection test that failed. `disabled` is reserved.","enum":["active","disabled","error"],"example":"active"}}></SchemaItem><SchemaItem collapsible={false} name={"protection"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`software`, `hsm`, `hsm-backed`, `dedicated-hsm`, `provider`]"} schema={{"type":"string","nullable":true,"description":"Where the private keys of this key store are. `software`: in the software of a key management service (`local` with the backend `openbao` or `database`, `vault`, `gcp-kms` with the protection level `SOFTWARE`, `azure-key-vault` with the key type `EC`). `hsm`: in the hardware security module of the installation (`local` with the backend `hsm`). `hsm-backed`: in a cloud KMS that keeps the keys in hardware security modules of the cloud provider (`gcp-kms` with `HSM`, `aws-kms`, `azure-key-vault` with `EC-HSM`). `dedicated-hsm`: in a hardware security module partition of the organisation (`dpod`). `provider`: at the provider, which decides how it protects the keys (`csc`). An organisation key store has the `protection` of its provider, unless its settings decide.","enum":["software","hsm","hsm-backed","dedicated-hsm","provider"],"example":"software"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><strong>settings</strong><span style={{"opacity":"0.6"}}> object</span><strong style={{"fontSize":"var(--ifm-code-font-size)","color":"var(--openapi-required)"}}> required</strong></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Settings of the key store type. Never a secret.

</div></div><div><span className={"badge badge--info"}>oneOf</span><SchemaTabs><TabItem label={"local"} value={"0-item-properties"}><SchemaItem collapsible={false} name={"backend"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`openbao`, `database`, `hsm`]"} schema={{"type":"string","description":"Where the installation keeps the keys. `openbao` for OpenBao Transit (`local-openbao`), `database` for the wallet database (`local-database`, legacy, no new keys), `hsm` for the hardware security module of the installation (`local-hsm`). With `hsm`, the new local keys of the organisations go to the HSM; the keys in `local-openbao` stay there and keep working.","enum":["openbao","database","hsm"],"example":"openbao"}}></SchemaItem><SchemaItem collapsible={false} name={"protection"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`software`, `hsm`]"} schema={{"type":"string","description":"How the key store protects the keys. `software` for the backends `openbao` and `database`, `hsm` for the backend `hsm`.","enum":["software","hsm"],"example":"software"}}></SchemaItem></TabItem><TabItem label={"vault"} value={"1-item-properties"}><SchemaItem collapsible={false} name={"address"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base address of the vault, with `https://`. The wallet refuses `http://` and private network addresses, unless the installation allows private addresses (for example on premises).","example":"https://vault.example.com:8200"}}></SchemaItem><SchemaItem collapsible={false} name={"namespace"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Namespace in the vault. Leave it out or send `null` when the vault has no namespaces.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"transitMount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the Transit secrets engine. The default is `transit`.","example":"transit"}}></SchemaItem><SchemaItem collapsible={false} name={"caCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM bundle of the certificate authorities that the wallet trusts for the TLS certificate of the vault. Without it, the wallet uses the system certificate authorities.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"clientCertificate"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"PEM client certificate for mutual TLS. Required for the authentication method `cert`. With another method, send it when the listener of the vault requires mutual TLS. The private key of the certificate goes in the credential `clientPrivateKey`.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to the vault.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`userpass`, `approle`, `cert`, `token`]"} schema={{"type":"string","description":"Authentication method. `userpass` needs `username` and the credential `password`. `approle` needs `roleId` and the credential `secretId`. `cert` needs `clientCertificate` and the credential `clientPrivateKey`, and can have `role`. `token` needs the credential `token`.","enum":["userpass","approle","cert","token"],"example":"userpass"}}></SchemaItem><SchemaItem collapsible={false} name={"mount"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Mount path of the authentication method. The default is the name of the method (`userpass`, `approle` or `cert`).","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"username"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"User name, for the method `userpass`.","example":"wallet"}}></SchemaItem><SchemaItem collapsible={false} name={"roleId"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Role ID, for the method `approle`.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"role"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Name of the certificate role, for the method `cert`. Optional.","example":null}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"gcp-kms"} value={"2-item-properties"}><SchemaItem collapsible={false} name={"project"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Google Cloud project ID of the key ring. A domain-scoped project ID (`example.com:my-project`) is also accepted.","example":"my-project"}}></SchemaItem><SchemaItem collapsible={false} name={"location"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Cloud KMS location of the key ring, for example `europe-west1`.","example":"europe-west1"}}></SchemaItem><SchemaItem collapsible={false} name={"keyRing"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 63 characters`"} schema={{"type":"string","maxLength":63,"description":"The name of the key ring. Letters, digits, `_` and `-`, at most 63 characters.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"protectionLevel"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`HSM`, `SOFTWARE`]"} schema={{"type":"string","description":"The protection level of the keys that the wallet creates. `HSM` (default) keeps the keys in hardware security modules of Google Cloud (the key store `protection` is `hsm-backed`). `SOFTWARE` keeps them in software (the key store `protection` is `software`).","enum":["HSM","SOFTWARE"],"example":"HSM"}}></SchemaItem></TabItem><TabItem label={"aws-kms"} value={"3-item-properties"}><SchemaItem collapsible={false} name={"region"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The AWS region of the keys, for example `eu-central-1`. Free text with a format check, not a fixed list.","example":"eu-central-1"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the wallet logs in to AWS KMS.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`accessKey`]"} schema={{"type":"string","description":"Authentication method. `accessKey` (the only method) needs the credentials `accessKeyId` and `secretAccessKey`.","enum":["accessKey"],"example":"accessKey"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"azure-key-vault"} value={"4-item-properties"}><SchemaItem collapsible={false} name={"vaultUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The URL of the key vault (`https://<name>.vault.azure.net`) or of the managed HSM (`https://<name>.managedhsm.azure.net`), without a path and without a trailing `/`.","example":"https://my-vault.vault.azure.net"}}></SchemaItem><SchemaItem collapsible={false} name={"tenantId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The Microsoft Entra tenant ID, a GUID or a domain name (for example `contoso.onmicrosoft.com`).","example":"00000000-0000-0000-0000-000000000000"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"The application (client) ID of the app registration, a GUID.","example":"11111111-1111-1111-1111-111111111111"}}></SchemaItem><SchemaItem collapsible={false} name={"keyType"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`EC-HSM`, `EC`]"} schema={{"type":"string","description":"The key type of the keys that the wallet creates. `EC-HSM` (default) keeps the keys in hardware security modules (the key store `protection` is `hsm-backed`). `EC` keeps them in software (the key store `protection` is `software`). A managed HSM has `EC-HSM` keys only.","enum":["EC-HSM","EC"],"example":"EC-HSM"}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>authentication</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

How the application logs in to Microsoft Entra ID.

</div><SchemaItem collapsible={false} name={"method"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`clientSecret`, `clientCertificate`]"} schema={{"type":"string","description":"Authentication method. `clientSecret` needs the credential `clientSecret`. `clientCertificate` needs the credentials `clientCertificate` and `clientPrivateKey`.","enum":["clientSecret","clientCertificate"],"example":"clientSecret"}}></SchemaItem></div></details></SchemaItem></TabItem><TabItem label={"dpod"} value={"5-item-properties"}><SchemaItem collapsible={false} name={"tokenLabel"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** `<= 32 characters`"} schema={{"type":"string","maxLength":32,"description":"The label of the partition, at most 32 bytes in UTF-8, without a control character, `;`, `{` or `}`. The wallet removes the spaces around it.","example":"ows-signing"}}></SchemaItem><SchemaItem collapsible={false} name={"serialNumber"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** Value must match regular expression `^[0-9]{1,16}$`"} schema={{"type":"string","nullable":true,"pattern":"^[0-9]{1,16}$","description":"The serial number of the partition, a string of 1 to 16 digits. Optional; an empty string is the same as `null`, and a number is refused. When given, the HSM signer checks that the partition has this serial number.","example":null}}></SchemaItem></TabItem><TabItem label={"csc"} value={"6-item-properties"}><SchemaItem collapsible={false} name={"cscUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Base URL of the CSC API of the QTSP, with `https://`.","example":"https://qtsp.example.com/csc"}}></SchemaItem><SchemaItem collapsible={false} name={"apiVersion"} required={false} schemaName={"string"} qualifierMessage={"**Possible values:** [`v1`, `v2`]"} schema={{"type":"string","description":"Version of the CSC API. The default is `v1`.","enum":["v1","v2"],"example":"v1"}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"OAuth 2.0 client ID that the QTSP gave the organisation.","example":"client"}}></SchemaItem><SchemaItem collapsible={false} name={"userId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"User ID that the QTSP registered for the organisation.","example":"user-1"}}></SchemaItem></TabItem></SchemaTabs></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>credentialsConfigured</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

For each credential field of the key store type, `true` when the wallet has a value. The answer never has the value. Empty for the type `local`. The fields: `vault` `password`, `secretId`, `token`, `clientPrivateKey`; `gcp-kms` `serviceAccountKey`; `aws-kms` `accessKeyId`, `secretAccessKey`; `azure-key-vault` `clientSecret`, `clientCertificate`, `clientPrivateKey`; `dpod` `authTokenConfigUri`, `authTokenClientId`, `authTokenClientSecret`, `pin`; `csc` `clientSecret`, `userPin`.

</div><SchemaItem name={"property name*"} required={false} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean"}} collapsible={false} discriminator={false}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"capabilities"} required={true} schemaName={"string[]"} qualifierMessage={"**Possible values:** [`create`, `import`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete`]"} schema={{"type":"array","description":"What the key store can do. The type sets them. `local` (the key store that takes new keys): `create`, `import`, `sign`, `csr`, `certificateChain`, `test` (no `import` with the backend `hsm`). `local` (the other key store of the installation): `sign`, `csr`, `certificateChain`, `test`. `vault`: `create`, `import`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete`. `gcp-kms`, `aws-kms`, `azure-key-vault` and `dpod`: `create`, `reference`, `sign`, `csr`, `certificateChain`, `listProviderKeys`, `test`, `edit`, `delete` (no `import`). `csc`: `reference`, `sign`, `listProviderKeys`, `test`, `edit`, `delete`.","items":{"type":"string","enum":["create","import","reference","sign","csr","certificateChain","listProviderKeys","test","edit","delete"]},"example":["create","import","sign","csr","certificateChain","test"]}}></SchemaItem><SchemaItem collapsible={false} name={"qscd"} required={true} schemaName={""} qualifierMessage={undefined} schema={{"description":"Shows if the key store keeps the keys in a qualified signature creation device (QSCD). `false`, or `provider` for the type `csc`, where the QTSP decides.","example":false}}></SchemaItem><SchemaItem collapsible={false} name={"keyCount"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","description":"Number of keys of the organisation in the key store.","example":3}}></SchemaItem><SchemaItem collapsible={false} name={"qualifiedStatus"} required={true} schemaName={"string"} qualifierMessage={"**Possible values:** [`qualified`, `not-qualified`, `unknown`]"} schema={{"type":"string","nullable":true,"description":"Only for a key store of a provider with `qualified` `true` (category `qtsp`): `qualified` when every key of the key store is qualified and there is at least one key, `not-qualified` when a key is not, else `unknown`. `null` for every other key store: no other key store claims a qualified status. See `trust` of the key.","enum":["qualified","not-qualified","unknown"],"example":null}}></SchemaItem><SchemaItem collapsible={false} name={"lastCheckedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the last connection test, in UTC. `null` before the first test.","example":null}}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>lastCheckResult</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__nullable"}>nullable</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

Result of a connection test of a key store.

</div><SchemaItem collapsible={false} name={"ok"} required={true} schemaName={"boolean"} qualifierMessage={undefined} schema={{"type":"boolean","description":"Shows `true` when the connection test passed.","example":true}}></SchemaItem><SchemaItem collapsible={false} name={"message"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Why the connection test failed, as a safe text. It never has a secret or the detail of the provider. `null` when the test passed.","example":null}}></SchemaItem><SchemaItem collapsible={false} name={"checkedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the connection test, in UTC.","example":"2026-10-20T10:05:00Z"}}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"createdAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Creation time of the key store, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem><SchemaItem collapsible={false} name={"updatedAt"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","nullable":true,"description":"Time of the last change of the key store, in UTC.","example":"2026-10-20T10:00:00Z"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"id\": \"local-openbao\",\n  \"type\": \"local\",\n  \"provider\": null,\n  \"name\": \"Local vault\",\n  \"local\": true,\n  \"status\": \"active\",\n  \"protection\": \"software\",\n  \"settings\": {},\n  \"credentialsConfigured\": {},\n  \"capabilities\": [\n    \"create\",\n    \"import\",\n    \"sign\",\n    \"csr\",\n    \"certificateChain\",\n    \"test\"\n  ],\n  \"qscd\": false,\n  \"keyCount\": 3,\n  \"qualifiedStatus\": null,\n  \"lastCheckedAt\": null,\n  \"lastCheckResult\": {\n    \"ok\": true,\n    \"message\": null,\n    \"checkedAt\": \"2026-10-20T10:05:00Z\"\n  },\n  \"createdAt\": \"2026-10-20T10:00:00Z\",\n  \"updatedAt\": \"2026-10-20T10:00:00Z\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"400"} value={"400"}><div>

The key store is a `local` key store, the body or the settings are not valid, a credential that the settings need is missing, the organisation is a sandbox organisation, or the connection test failed. For a failed test, `errorDescription` tells why, as a safe text.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"401"} value={"401"}><div>

Unauthorized

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"404"} value={"404"}><div>

The organisation has no key store with this ID.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"409"} value={"409"}><div>

The organisation already has a key store with this name.

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"500"} value={"500"}><div>

Internal server error

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem></ApiTabs></div></div>