Keys

Update key

PUT/v4/config/ows/key-management/keys/{keyId}

Changes the name of a key, and the PIN of a key of a remote signing key store (csc). Only the members in the body change. The key ID, the key material and the key store never change here. The answer is the key as Read key returns it. A call with a sandbox API key changes the key of the main organisation.

Update key

Language of the request sample

curl -X PUT 'https://demo-api.igrant.io/v4/config/ows/key-management/keys/{keyId}' \
  -H 'Authorization: ApiKey <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "EAA signing key"
}'

{
  "keyId": "cc9ea8a5e46a45768e197cfafb3cfcd7",
  "name": "EAA signing key",
  "keyStore": {
    "id": "local-openbao",
    "type": "local",
    "name": "Local vault"
  },
  "origin": "created",
  "algorithm": "ES256",
  "status": "active",
  "jwk": {
    "kid": "cc9ea8a5e46a45768e197cfafb3cfcd7",
    "kty": "EC",
    "crv": "P-256",
    "x": "DlsfFV5XHrCUGozkUB9Kk7KNIGrbLom7w_eADn5e8xQ",
    "y": "1Dnd_bH_ID02fHpMvmxFaUZ4hpSds9JONSWikNfc7g4",
    "alg": "ES256"
  },
  "hasCertificateChain": false,
  "certificateSource": null,
  "testCertificate": false,
  "certificatePreset": null,
  "certificateAssessment": {
    "keyUsageType": null,
    "fitsCredentialCategories": [],
    "qcPsb": null,
    "categoryMessages": {
      "eaa": [
        "An EAA needs a seal certificate of a legal person. This key has no certificate. Request a certificate with the preset EAA provider (eaa-provider)."
      ],
      "qeaa": [
        "A QEAA needs a qualified seal certificate. This key has no certificate. Request a certificate with the preset QEAA provider (qeaa-provider)."
      ],
      "pub-eaa": [
        "A PuB-EAA needs a qualified seal certificate with the QcPSB statement. This key has no certificate. Request a certificate with the preset PuB-EAA provider (pub-eaa-provider)."
      ],
      "mdl": [
        "An mDL needs an ISO/IEC 18013-5 document signer certificate. This key has no certificate. Request a certificate with the preset mdoc Document Signer (mdoc-document-signer)."
      ],
      "pid": [
        "A PID needs a PID provider certificate. This key has no certificate. Request a certificate with the preset PID provider (pid-provider)."
      ]
    },
    "fitsMdocCredentialCategories": [],
    "mdocCategoryMessages": {
      "eaa": [
        "An EAA needs a seal certificate of a legal person. This key has no certificate. Request a certificate with the preset EAA provider (mdoc) (eaa-provider-mdoc)."
      ],
      "qeaa": [
        "A QEAA needs a qualified seal certificate. This key has no certificate. Request a certificate with the preset QEAA provider (mdoc) (qeaa-provider-mdoc)."
      ],
      "pub-eaa": [
        "A PuB-EAA needs a qualified seal certificate with the QcPSB statement. This key has no certificate. Request a certificate with the preset PuB-EAA provider (mdoc) (pub-eaa-provider-mdoc)."
      ],
      "pid": [
        "A PID needs a PID provider certificate. This key has no certificate. Request a certificate with the preset PID provider (mdoc) (pid-provider-mdoc)."
      ]
    }
  },
  "qscd": false,
  "trust": null,
  "createdAt": "2026-11-08T14:46:47Z",
  "updatedAt": "2026-11-08T14:46:47Z"
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:update

Path parameters

keyIdstringrequired
The keyId of a key of the organisation, from List keys or from the answer of Create key. It is also the kid of its JWK.

Body

application/json

The members to change.

namestring | null
The new name, at most 100 characters. null removes the name.
At most 100 characters.
Example:"PID issuance 2026"
providerSecretstring
Write-only. Only for a referenced key of a csc key store, the new PIN of its CSC credential. No answer returns it.
At most 256 characters.
Example:"<yourPin>"

Response

application/json

The changed key.

keyIdstring
The key ID. The wallet makes it and it never changes. It is also jwk.kid, and the value that a credential definition, a presentation definition or a configuration gives as its signing key.
Example:"3f2a91c47b8d4e6fa0c5d7e18b924f30"
namestring | null
A free name, for example what the key signs. Set on create or with Update key. null when the key has no name.
At most 100 characters.
Example:"PID issuance 2026"
keyStoreobject
The key store that holds the key.
originenum<string> | null
How the key came to the organisation. created, the wallet created it in the key store. imported, Import key. referenced, the key was already in the key store of the provider, and the wallet signs with it there.
Available options:created,imported,referenced
Example:"created"
algorithmstring | null
The signature algorithm of the key, ES256.
Example:"ES256"
statusstring
Always active in an answer. A retired key (see Delete key) is not returned.
Example:"active"
jwkobject
The public key as a JWK. Public members only, never d.
hasCertificateChainboolean
true when the key has an X.509 certificate chain, so it can sign with cryptographicKeyFormat x509.
Example:false
certificateSourceenum<string> | null
Where the certificate chain comes from. uploaded, Upload certificate chain. imported, Import key with a certificate. test-ca, a test certificate of the built-in test CA. qtsp, the certificate of the CSC credential of a remote signing key store. null without a certificate chain.
Available options:uploaded,imported,test-ca,qtsp
testCertificateboolean
true when certificateSource is test-ca: the key has a test certificate, for development and testing only. Wallets and verifiers outside this platform do not trust it.
Example:false
certificatePresetstring | null
The certificate preset of the chain. For a test certificate, the preset of its request; for an uploaded chain, the preset of the newest CSR of the key. null when there is none.
certificateAssessmentobject
The certificate assessment of the key. Every key has one, also a key without a certificate chain.
qscdany
Whether the key store keeps the key in a qualified signature or seal creation device (QSCD), from the key store. false, or provider for a key of a remote signing key store, where the QTSP decides.
Example:false
trustobject | null
For a key of a key store of a provider with qualified true only, its qualified status against the EU trusted lists. null for every other key.
createdAtstring<date-time> | null
When the key was added (ISO 8601 date-time, UTC).
Example:"2026-10-20T10:00:00Z"
updatedAtstring<date-time> | null
When the key last changed (ISO 8601 date-time, UTC).
Example:"2026-10-20T10:00:00Z"