Skip to main content

Update secure vault

PUT 
/v2/config/digital-wallet/openid/key-management

Updates the secure vaults that hold the cryptographic keys for OID4VCI and OpenID4VP operations. Send the full configuration. The iGrant.io vault must stay enabled. If you enable the Hashicorp vault, you must give the username, the password, the address and the namespace. If you enable the QTSP vault, you must give the CSC URL, the client ID, the client secret and the user ID.

The service forwards only the enabled flag of a vault that has enabled: false, so it erases the stored credentials of that vault. To keep the credentials of a vault, keep the vault enabled.

The response status code of this operation is 201, not 200.

Request​

Header Parameters

    X-SandboxOrgId stringrequired

    Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet.

    The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org instead.

    X-SubwalletId is the deprecated name of this header. The service continues to accept it, but X-SandboxOrgId wins if you send both headers.

    The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400.

    Example: 6889e1a4c5b2f30001a3d710

Body

required

New secure vault configuration for the organisation.

    hashicorpVault objectrequired

    Hashicorp Vault configuration for external key storage.

    enabled booleanrequired

    Set to true to enable the Hashicorp vault.

    vaultUsername string

    User name for Hashicorp Vault authentication. Required when enabled is true.

    vaultPassword string

    Password for Hashicorp Vault authentication. Required when enabled is true.

    vaultAddress string

    Base address of the Hashicorp Vault server. Required when enabled is true.

    vaultNamespace string

    Namespace in Hashicorp Vault. Required when enabled is true.

    igrantioVault objectrequired

    iGrant.io managed vault configuration. This vault is always active and you cannot disable it.

    enabled booleanrequired

    Set to true to enable the iGrant.io vault. The request fails if you send false.

    qtsp objectrequired

    Qualified Trust Service Provider (QTSP) configuration for remote qualified electronic signatures through the Cloud Signature Consortium (CSC) API.

    enabled booleanrequired

    Set to true to enable the QTSP vault.

    cscUrl string

    Base URL of the CSC service. Required when enabled is true.

    clientId string

    Client ID for QTSP authentication. Required when enabled is true.

    clientSecret string

    Client secret for QTSP authentication. Required when enabled is true.

    userID string

    User ID registered with the QTSP. Required when enabled is true.

    cscApiVersion string

    Possible values: [v1, v2]

    CSC API version to use. Use v1 for CSC 1.0.4.0 and v2 for CSC 2.2.0.0. The service uses v1 when you do not send this field.

    dbBackedVault object

    Database backed vault configuration. This vault keeps the keys in the wallet database.

    enabled booleanrequired

    Set to true to enable the database backed vault.

Responses​

Secure vault updated successfully.

Response Headers
    Schema
      secureVault integer[]nullable

      Possible values: [1, 2, 3, 4]

      IDs of the vaults that are now enabled for the organisation. The value is null when no vault is enabled.

    Loading...
    Last updated on