{
"openapi": "3.1.0",
"info": {
"title": "Securosys PrimusHSM - REST API | Swagger UI",
"description": "- [REST-API Documentation](https://docs.securosys.com/tsb/overview)\n- [Tutorials](https://docs.securosys.com/tsb/Tutorials/Encryption/EncryptDecrypt)\n- [Transaction Security Broker Documentation](https://docs.securosys.com/tsb/category/transaction-security-broker) & [Authorization App Documentation](https://docs.securosys.com/AuthorizationApp/overview)\n\n[Securosys End-User License Agreement (EULA)](https://www.securosys.com/eula) \n",
"contact": {
"name": "Securosys SA",
"url": "https://www.securosys.com/en/contactus",
"email": "info@securosys.com"
},
"license": {
"name": "Securosys License",
"url": "https://www.securosys.com/en/about/securosys-general-terms-and-conditions"
},
"version": "v2.9.0"
},
"servers": [
{
"url": "https://sbx-rest-api.cloudshsm.com",
"description": "Generated server url"
}
],
"tags": [
{
"name": "Requests",
"description": "Operations for sign/block/unblock/modify/decrypt/unwrap/decapsulation requests. The TsbEngine licence is necessary to execute these operations."
},
{
"name": "Certificate",
"description": "Access to Certificate store"
},
{
"name": "General helper",
"description": "General helper functions."
},
{
"name": "Service Information",
"description": "Information about the service"
},
{
"name": "Blockchain Helper",
"description": "Helper functions for the blockchain"
},
{
"name": "Synchronous Key Operations",
"description": "Synchronous operations that are directly forwarded to the HSM. For certain operations with SKA keys the signed approvals may be included in the request. The RestApi licence is necessary to execute these operations."
},
{
"name": "Approval Tasks",
"description": "Operations on the approval tasks"
},
{
"name": "Approver Management",
"description": "Access the Approver Management functionality for secure Approver-Key generation and streamlining SKA-Onboarding processes."
},
{
"name": "Keys",
"description": "Access to key store"
}
],
"paths": {
"/v1/approverManagement/create": {
"put": {
"tags": [
"Approver Management"
],
"summary": "Create Approver",
"description": "The Approver Manager creates an RSA or ML-DSA approver key-pair and certificate",
"operationId": "create",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApproverCreateDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ApproverCreateResponseDto"
}
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/xpub/import": {
"post": {
"tags": [
"Blockchain Helper"
],
"summary": "Import public key from an xpub",
"description": "Import public key and chaincode from an xpub (base58) as an EC public-key, secp256k1. \n\n- Bip32 - Xpub structure is specified by https://docs.rs/bitcoin/latest/bitcoin/bip32/struct.Xpub.html",
"operationId": "importXpub",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ImportXpubDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ImportXpubResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/xpub/export": {
"post": {
"tags": [
"Blockchain Helper"
],
"summary": "Export xpub from public key",
"description": "Export xpub based on a EC public-key (secp256k1) with chaincode, network, depth, parentFingerprint and childnumber. \n\nYou can derive the public-key directly by specifying a derivation-path in the 'label' like: key-name/1/2/3",
"operationId": "exportXpub",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ExportXpubDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ExportXpubResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/wrap": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Wrap key",
"operationId": "wrap",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedWrapKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/WrapKeyRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/verify": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Verify signature",
"operationId": "verifySignature",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedVerifySignatureRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/VerifySignatureRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/unwrap": {
"post": {
"tags": [
"Requests"
],
"summary": "Create unwrap request",
"operationId": "unwrap",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedUnwrapKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UnwrapKeyRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/unblock": {
"post": {
"tags": [
"Requests"
],
"summary": "Unblock key request",
"description": "Create an unblock request. Unblocking a key is only supported if the key has smart key attributes.",
"operationId": "unblock",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedUnblockKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UnblockKeyRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousUnwrap": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Unwrap a wrapped key",
"description": "Creates a synchronous unwrap request. For an SKA-protected key, signedApprovals must satisfy the key policy. Insufficient approvals are reported as HTTP 500 with application errorCode 701 in the JSON body.",
"operationId": "synchronousUnwrap",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSynchronousUnwrapKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "HSM error. Insufficient SKA approvals use errorCode 701 in this HTTP 500 response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
},
"examples": {
"approvalsInsufficient": {
"description": "approvalsInsufficient",
"value": {
"errorCode": 701,
"reason": "res.error.in.hsm",
"message": "The provided approvals are insufficient."
}
}
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousUnblock": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Unblock a key",
"description": "Create a synchronous unblock request.",
"operationId": "synchronousUnblock",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSynchronousUnblockKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousSign": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Sign a payload",
"description": "Creates a synchronous sign request. For an SKA-protected key, signedApprovals must satisfy the key policy. Insufficient approvals are reported as HTTP 500 with application errorCode 701 in the JSON body.",
"operationId": "synchronousSign",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSynchronousSignRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "HSM error. Insufficient SKA approvals use errorCode 701 in this HTTP 500 response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
},
"examples": {
"approvalsInsufficient": {
"description": "approvalsInsufficient",
"value": {
"errorCode": 701,
"reason": "res.error.in.hsm",
"message": "Error creating signature. The provided approvals are insufficient."
}
}
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SynchronousSignRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousModify": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Modify key policy",
"description": "Create a synchronous (ska) modify policy request. Modifying a key is only supported if the key has smart key attributes.",
"operationId": "synchronousModify",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSynchronousModifyKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousHmac": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Create keyed hash",
"operationId": "hmac",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedHmacRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/HmacRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousFileVerifyDecrypt": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Verify and decrypt a file",
"description": "The API client receives the structured file and begins by unwrapping the symmetric key using the asymmetric private key stored on the HSM. With the unwrapped symmetric key, the client decrypts the encrypted payload to retrieve the original content. Finally, the digital signature is verified against the decrypted file-content to ensure its authenticity and integrity.",
"operationId": "synchronousFileVerifyDecrypt",
"requestBody": {
"content": {
"multipart/form-data": {
"schema": {
"type": "object",
"properties": {
"SignedSynchronousFileVerifyDecryptRequestDto": {
"$ref": "#/components/schemas/SignedSynchronousFileVerifyDecryptRequestDto"
},
"file": {
"type": "string",
"format": "binary",
"description": "The file to be decrypted and verified."
}
},
"required": [
"SignedSynchronousFileVerifyDecryptRequestDto",
"file"
]
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/octet-stream": {
"schema": {
"type": "string",
"format": "binary"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousFileSignEncrypt": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Sign and encrypt a file",
"description": "The file content is first signed, then encrypted using a symmetric key. This symmetric key is subsequently wrapped with an asymmetric key. The encrypted payload, the wrapped symmetric key and the signature are then structured into a file that can be consumed by the API client.",
"operationId": "synchronousFileSignEncrypt",
"requestBody": {
"content": {
"multipart/form-data": {
"schema": {
"type": "object",
"properties": {
"SignedSynchronousFileSignEncryptRequestDto": {
"$ref": "#/components/schemas/SignedSynchronousFileSignEncryptRequestDto"
},
"file": {
"type": "string",
"format": "binary",
"description": "The file to be signed and encrypted."
}
},
"required": [
"SignedSynchronousFileSignEncryptRequestDto",
"file"
]
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/octet-stream": {
"schema": {
"type": "string",
"format": "binary"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousFileDecrypt": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Decrypt a file",
"description": "Returns the decrypted file as application/octet-stream.",
"operationId": "fileDecryption",
"requestBody": {
"content": {
"multipart/form-data": {
"schema": {
"type": "object",
"properties": {
"SignedFileDecryptRequestDto": {
"$ref": "#/components/schemas/SignedFileDecryptRequestDto"
},
"file": {
"type": "string",
"format": "binary"
}
},
"required": [
"SignedFileDecryptRequestDto",
"file"
]
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/octet-stream": {
"schema": {
"type": "string",
"format": "binary"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousDecrypt": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Decrypt a ciphertext",
"description": "Creates a synchronous decrypt request. For an SKA-protected key, signedApprovals must satisfy the key policy. Insufficient approvals are reported as HTTP 500 with application errorCode 701 in the JSON body.",
"operationId": "synchronousDecrypt",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSynchronousDecryptRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "HSM error. Insufficient SKA approvals use errorCode 701 in this HTTP 500 response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
},
"examples": {
"approvalsInsufficient": {
"description": "approvalsInsufficient",
"value": {
"errorCode": 701,
"reason": "res.error.in.hsm",
"message": "The provided approvals might be insufficient."
}
}
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SynchronousDecryptRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousDecapsulate": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Decapsulation using ML‑KEM",
"description": "Perform a key‑decapsulation using the ML‑KEM algorithm. The operation takes the encapsulated ciphertext (produced by ML‑KEM), performs with the private key the decapsulation, and returns the recovered shared secret.",
"operationId": "decapsulate",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSynchronousDecapsulationRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DecapsulationResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronousBlock": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Block a key",
"description": "Create a synchronous block request.",
"operationId": "synchronousBlock",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSynchronousBlockKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/synchronous/hash": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Create hash",
"description": "This API-Endpoint can be used to sign large payloads that exceed the current HSM limits of 20kb, v2.8 & 500kb, v3.0",
"operationId": "hash",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/HashRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/HashResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/sign": {
"post": {
"tags": [
"Requests"
],
"summary": "Create a sign request",
"operationId": "sign",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSignRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/modify": {
"post": {
"tags": [
"Requests"
],
"summary": "Modify key request",
"description": "Create a modify request. Modifying a key is only supported if the key has smart key attributes.",
"operationId": "modify",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedModifyKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ModifyKeyRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key": {
"get": {
"tags": [
"Keys"
],
"summary": "Get all keys",
"description": "Returns a list containing the names of all keys currently stored on the HSM",
"operationId": "enumerateKeys",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
},
"post": {
"tags": [
"Keys"
],
"summary": "Create a key",
"description": "Create a asymmetric or symmetric key.",
"operationId": "createKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CreateKeyDto"
},
"examples": {
"skaKeyWithPolicy": {
"summary": "SKA key with an approval policy",
"description": "skaKeyWithPolicy",
"value": {
"label": "keyname",
"password": "string",
"id": "string",
"algorithm": "EC",
"algorithmOid": "1.2.840.10045.2.1",
"curveOid": "1.3.132.0.10",
"keySize": 0,
"lmsTreeHeight": 0,
"addressFormat": {
"format": "BTC"
},
"customerNote": "string",
"startDate": "2026-05-11T08:08:08",
"endDate": "2026-12-31T18:30:00",
"attributes": {
"encrypt": true,
"decrypt": true,
"verify": true,
"sign": true,
"wrap": true,
"unwrap": true,
"derive": false,
"bip32": false,
"slip10": false,
"extractable": false,
"modifiable": true,
"destroyable": false,
"sensitive": true,
"copyable": false,
"rollover": false
},
"policy": {
"ruleUse": {
"tokens": [
{
"name": "string",
"timelock": 0,
"timeout": 0,
"groups": [
{
"name": "string",
"quorum": 0,
"approvals": [
{
"type": "certificate",
"name": "string",
"value": "string"
}
]
}
]
}
]
},
"ruleBlock": {
"tokens": [
{
"name": "string",
"timelock": 0,
"timeout": 0,
"groups": [
{
"name": "string",
"quorum": 0,
"approvals": [
{
"type": "certificate",
"name": "string",
"value": "string"
}
]
}
]
}
]
},
"ruleUnblock": {
"tokens": [
{
"name": "string",
"timelock": 0,
"timeout": 0,
"groups": [
{
"name": "string",
"quorum": 0,
"approvals": [
{
"type": "certificate",
"name": "string",
"value": "string"
}
]
}
]
}
]
},
"ruleModify": {
"tokens": [
{
"name": "string",
"timelock": 0,
"timeout": 0,
"groups": [
{
"name": "string",
"quorum": 0,
"approvals": [
{
"type": "certificate",
"name": "string",
"value": "string"
}
]
}
]
}
]
},
"keyStatus": {
"blocked": false
}
}
}
},
"skaKeyWithEmptyPolicy": {
"summary": "SKA-ready key without approval requirements",
"description": "skaKeyWithEmptyPolicy",
"value": {
"label": "keyname",
"password": "string",
"id": "string",
"algorithm": "EC",
"algorithmOid": "1.2.840.10045.2.1",
"curveOid": "1.3.132.0.10",
"keySize": 0,
"lmsTreeHeight": 0,
"addressFormat": {
"format": "BTC"
},
"customerNote": "string",
"startDate": "2026-05-11T08:08:08",
"endDate": "2026-12-31T18:30:00",
"attributes": {
"encrypt": true,
"decrypt": true,
"verify": true,
"sign": true,
"wrap": true,
"unwrap": true,
"derive": false,
"bip32": false,
"slip10": false,
"extractable": false,
"modifiable": true,
"destroyable": false,
"sensitive": true,
"copyable": false,
"rollover": false
},
"policy": {
"ruleUse": null,
"ruleBlock": null,
"ruleUnblock": null,
"ruleModify": null,
"keyStatus": {
"blocked": false
}
}
}
},
"nonSkaKey": {
"summary": "Non-SKA key with a null policy",
"description": "nonSkaKey",
"value": {
"label": "keyname",
"password": "string",
"id": "string",
"algorithm": "EC",
"algorithmOid": "1.2.840.10045.2.1",
"curveOid": "1.3.132.0.10",
"keySize": 0,
"lmsTreeHeight": 0,
"addressFormat": {
"format": "BTC"
},
"customerNote": "string",
"startDate": "2026-05-11T08:08:08",
"endDate": "2026-12-31T18:30:00",
"attributes": {
"encrypt": true,
"decrypt": true,
"verify": true,
"sign": true,
"wrap": true,
"unwrap": true,
"derive": false,
"bip32": false,
"slip10": false,
"extractable": false,
"modifiable": true,
"destroyable": false,
"sensitive": true,
"copyable": false,
"rollover": false
},
"policy": null
}
}
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedKeyAttributesDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/rotate": {
"post": {
"tags": [
"Keys"
],
"summary": "Rotate a key",
"description": "Rotates a symmetric key",
"operationId": "rotateKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RotateKeyWithPasswordDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedKeyAttributesDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/keyAttestation": {
"post": {
"tags": [
"Keys"
],
"summary": "Generate key attestation files",
"description": "Returns the attestation files of a key as a ZIP archive.",
"operationId": "getKeyAttestationAsFileDownload",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/KeyLabelWithPasswordDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/zip": {
"schema": {
"type": "string",
"format": "binary"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/import/plain": {
"post": {
"tags": [
"Keys"
],
"summary": "Import a key",
"description": "The private key must be a valid PKCS#8 key: openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp256k1 -outform PEM -out secp256k1_private_key.pem",
"operationId": "importPlainKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/KeyImportDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/export/plain": {
"post": {
"tags": [
"Keys"
],
"summary": "Export a key",
"description": "Get the public and private key or secret key exported from the HSM (extractable & sensitive must be 'true')",
"operationId": "exportKeyDto",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RequestKeyExportDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/KeyExportDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/deleteKey": {
"post": {
"tags": [
"Keys"
],
"summary": "Delete a key",
"description": "Deletes the key identified by the keyName.\n\nThe password is only used when TSB operating in infinite-keystore mode.\n",
"operationId": "deleteKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/KeyLabelWithPasswordDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/changePassword": {
"post": {
"tags": [
"Keys"
],
"summary": "Change key password",
"description": "Changes the password of a key.",
"operationId": "changeKeyPassword",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ChangeKeyPasswordDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/attributes": {
"post": {
"tags": [
"Keys"
],
"summary": "Get key attributes",
"description": "Returns the attributes of a key",
"operationId": "getKeyAttributesWithKeyPassword",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/KeyLabelWithPasswordDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedKeyAttributesDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/address": {
"post": {
"tags": [
"Keys"
],
"summary": "Get crypto address",
"description": "Returns the crypto currency address base (without checksum or network prefix) of a key in base64 format",
"operationId": "getKeyAddressWithKeyPassword",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/KeyLabelWithPasswordDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/KeyAddressDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/importedKey": {
"post": {
"tags": [
"Keys"
],
"summary": "Import a key from a seed",
"description": "Generate a key from a given seed.",
"operationId": "importKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ImportKeyDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedKeyAttributesDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/hsm/customLog": {
"post": {
"tags": [
"Service Information"
],
"summary": "Post custom HSM log message",
"description": "Writes a custom informational log message to the HSM log.",
"operationId": "postCustomLogMessage",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CustomLogMessageDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredUnwrapKeyApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get unwrap task",
"description": "Returns all pending unwrap tasks for a given approval client (identified by public key)",
"operationId": "filterUnwrapTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredUnblockKeyApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get unblock key task",
"description": "Returns all pending unblock key tasks for a given approval client (identified by public key)",
"operationId": "filterUnblockKeyTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredSignApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get sign task",
"description": "Returns all pending sign tasks for a given approval client (identified by public key)",
"operationId": "filterSignTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredSelfSignCertificateApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get self-signed task",
"description": "Returns all pending self-sign tasks for a given approval client (identified by public key)",
"operationId": "filterSelfSignTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredRequests": {
"post": {
"tags": [
"Requests"
],
"summary": "Get requests status",
"description": "Returns a list of all requests filtered by its status",
"operationId": "getRequestStatus",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RequestIdsByStatusRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RequestIdsByStatusDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredModifyKeyApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get modify key task",
"description": "Returns all pending modify key tasks for a given approval client (identified by public key)",
"operationId": "filterModifyKeyTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredDecryptApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get decrypt task",
"description": "Returns all pending decrypt tasks for a given approval client (identified by public key)",
"operationId": "filterDecryptTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredDecapsulationApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get ML-KEM decapsulation task",
"description": "Returns all pending ML-KEM decapsulation tasks for a given approval client (identified by public key)",
"operationId": "filterDecapsulationTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredCertificateSigningRequestApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get CSR task",
"description": "Returns all pending CSR sign tasks for a given approval client (identified by public key)",
"operationId": "filterCsrSignTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredCertificateApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get certificate task",
"description": "Returns all pending certificate sign tasks (including self-signed) for a given approval client (identified by public key)",
"operationId": "filterCertificateSignTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredBlockKeyApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get block key task",
"description": "Returns all pending block key tasks for a given approval client (identified by public key)",
"operationId": "filterBlockKeyTasks",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/filteredAllApprovalTask": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Get all tasks",
"description": "Returns all pending tasks for a given approval client (identified by public key). Each task uses the same detail-level field set as the corresponding type-specific endpoint; the operation type determines which signed*Request property is populated at level3 and above.",
"operationId": "filteredAllApprovalTask",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/FilteredTasksRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTasksResponseDto"
}
}
}
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/fileEncrypt": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Encrypt a file",
"description": "Returns the encrypted file as application/octet-stream. The key must be of type EC, use curveOid 1.3.132.0.34, and have its derive attribute set to true.",
"operationId": "fileEncryption",
"requestBody": {
"content": {
"multipart/form-data": {
"schema": {
"type": "object",
"properties": {
"SignedFileEncryptRequestDto": {
"$ref": "#/components/schemas/SignedFileEncryptRequestDto"
},
"file": {
"type": "string",
"format": "binary"
}
},
"required": [
"SignedFileEncryptRequestDto",
"file"
]
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/octet-stream": {
"schema": {
"type": "string",
"format": "binary"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/encrypt": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Encrypt a payload",
"operationId": "encrypt",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedEncryptRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/EncryptRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/encapsulate": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Encapsulation using ML‑KEM",
"description": "Generate an ephemeral key pair and perform a key‑encapsulation using the ML‑KEM algorithm. The operation takes the public key, generates and encapsulates a shared secret, and returns the ciphertext along with the secret.",
"operationId": "encapsulate",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/EncapsulationRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/EncapsulationResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/derivedKey": {
"post": {
"tags": [
"Keys"
],
"summary": "Derive a key",
"description": "Derive a key based on a BIP32 / SLIP10 master key (Attention: The derived key will be stored on the HSM memory).Use KeyOperations with derivation path to temporarily derive an ephemeral key from base key",
"operationId": "deriveKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DeriveKeyDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedKeyAttributesDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/decrypt": {
"post": {
"tags": [
"Requests"
],
"summary": "Create decrypt request",
"operationId": "decrypt",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedDecryptRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DecryptRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/decapsulate": {
"post": {
"tags": [
"Requests"
],
"summary": "Create ML-KEM decapsulation request",
"description": "Create an asynchronous ML-KEM decapsulation request.",
"operationId": "decapsulation",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedDecapsulationRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DecapsulationRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/dataObject": {
"post": {
"tags": [
"Keys"
],
"summary": "Create data object",
"description": "Save a data object on the HSM",
"operationId": "saveDataObject",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DataObjectDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/createRfcTimestamp": {
"post": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Create a RFC3161 timestamp",
"operationId": "createRfcTimestamp",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CreateRfcTimestampDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RfcTimestampDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/synchronous/sign": {
"post": {
"tags": [
"Certificate"
],
"summary": "Create certificate",
"description": "Signs a CSR with a key. Output is a valid x509 Certificate. (Rest-API License)",
"operationId": "signCertificate",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SynchronousSignCertificateRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CertificateResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/synchronous/selfsign": {
"post": {
"tags": [
"Certificate"
],
"summary": "Create self-signed certificate",
"description": "Creates and attaches a self-signed certificate to the keypair. For example, this can be used to create a Certificate Authority. (Rest-API License)",
"operationId": "selfSignCertificate",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SelfSignCertificateRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CertificateResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/synchronous/rolloverSelfsign": {
"post": {
"tags": [
"Certificate"
],
"summary": "Rollover self-signed certificate",
"description": "Rollover and attaches a self-signed certificate to the keypair. For example, this can be used to create a Certificate Authority. (Rest-API License)",
"operationId": "rolloverSelfSignCertificate",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SynchronousRolloverSelfSignCertificateRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CertificateResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/synchronous/rolloverCsr": {
"post": {
"tags": [
"Certificate"
],
"summary": "Rollover CSR",
"description": "Rollover certificate signing request (CSR) for provided key.",
"operationId": "rolloverCsr",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SynchronousRolloverCertificateSigningRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RolloverCsrResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/synchronous/request": {
"post": {
"tags": [
"Certificate"
],
"summary": "Create a CSR",
"description": "Creates a certificate signing request (CSR) (as Json) to be signed by a Root or Intermediate-CA. (Rest-API License)",
"operationId": "signCsr",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SynchronousCertificateRequestRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CertificateRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/synchronous/request/download": {
"post": {
"tags": [
"Certificate"
],
"summary": "Create CSR files",
"description": "Creates a PEM-encoded certificate signing request (CSR) as a file download to be signed by a Root or Intermediate-CA. (Rest-API License)",
"operationId": "signCsrForFileDownload",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SynchronousCertificateRequestRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/octet-stream": {
"schema": {
"type": "string",
"format": "binary",
"description": "PEM-encoded certificate signing request."
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/sign": {
"post": {
"tags": [
"Certificate"
],
"summary": "Create certificate (SKA)",
"description": "Signs a CSR with a ska-key to generate a valid x509 certificate. (TsbEngine License)",
"operationId": "signCertificateWithSkaKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSignCertificateRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/selfsign": {
"post": {
"tags": [
"Certificate"
],
"summary": "Create self-signed certificate (SKA)",
"description": "Creates and attaches a self-signed certificate to the keypair. For example, this can be used to create a Certificate Authority. (TsbEngine License)",
"operationId": "selfSignCertificateWithSkaKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedSelfSignCertificateRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/rolloverSelfsign": {
"post": {
"tags": [
"Certificate"
],
"summary": "Rollover self-signed certificate (SKA)",
"description": "Rollover and attaches a self-signed certificate to the keypair. For example, this can be used to create a Certificate Authority. (TsbEngine License)",
"operationId": "rolloverSelfSignCertificateWithSkaKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedRolloverSelfSignCertificateRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/rolloverImportCert": {
"post": {
"tags": [
"Certificate"
],
"summary": "Rollover and import new certificate",
"description": "Rollover and import new certificate for provided key.",
"operationId": "rolloverImportCert",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RolloverImportCertificateRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/rolloverCsr": {
"post": {
"tags": [
"Certificate"
],
"summary": "Rollover CSR (SKA)",
"description": "Rollover certificate signing request (CSR) for provided ska-key.",
"operationId": "rolloverCsrWithSkaKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedRolloverCertificateSigningRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/request": {
"post": {
"tags": [
"Certificate"
],
"summary": "Create a CSR (SKA)",
"description": "Creates a request for certificate signing request (CSR) to be signed by a Root or Intermediate-CA. (TsbEngine License)",
"operationId": "signCsrWithSkaKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedCertificateRequestRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/list": {
"post": {
"tags": [
"Certificate"
],
"summary": "List all certificates",
"description": "List all certificates in the keystore, in human-readable format.",
"operationId": "listCertificates",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CertificateListDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CertificateListResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/import/plain": {
"post": {
"tags": [
"Certificate"
],
"summary": "Import a certificate.",
"description": "Import a certificate to a given key. The certificate must be base64 encoded.",
"operationId": "importPlainCertificate",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CertificateImportDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/byok/import": {
"post": {
"tags": [
"General helper"
],
"summary": "Import BYOK material",
"description": "Imports BYOK material for supported providers.",
"operationId": "byokImport",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ByokImportRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ByokImportResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/byok/export": {
"post": {
"tags": [
"General helper"
],
"summary": "Export BYOK material",
"description": "Exports key material for provider-specific BYOK formats.",
"operationId": "byokExport",
"requestBody": {
"content": {
"multipart/form-data": {
"schema": {
"type": "object",
"properties": {
"ByokExportRequestDto": {
"$ref": "#/components/schemas/ByokExportRequestDto"
},
"wrappingKeyFile": {
"type": "string",
"format": "binary",
"description": "Provider wrapping public key file (DER/PEM)."
}
},
"required": [
"ByokExportRequestDto",
"wrappingKeyFile"
]
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ByokExportResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/block": {
"post": {
"tags": [
"Requests"
],
"summary": "Block key request",
"description": "Create a block request. Blocking a key is only supported if the key has smart key attributes.",
"operationId": "block",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedBlockKeyRequestDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"201": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/BlockKeyRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/approverManagement/restoreFromBackup": {
"post": {
"tags": [
"Approver Management"
],
"summary": "Restore approver",
"description": "The Approver Manager restores the approver by name. Important: The approver remembers the backup password.",
"operationId": "restoreFromBackup",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApproverRestoreWithPasswordKnownDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApproverRestoreWithPasswordKnownResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/approverManagement/restoreFromBackup/forgotPassword": {
"post": {
"tags": [
"Approver Management"
],
"summary": "Reset approver pw",
"description": "The Approver Manager restores the approver by name and a new backup password if the old backupPassword has been forgotten.",
"operationId": "restoreFromBackupForgotPkcs12Password",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApproverRestoreWithPasswordUnknownDto"
}
}
}
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UnwrapKeyRequestResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/approverManagement/renewOneTimeCode": {
"post": {
"tags": [
"Approver Management"
],
"summary": "Renew OneTimeCode",
"description": "The Approver Manager renews the one time code.",
"operationId": "renewOneTimeCode",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApproverRenewOneTimePasswordDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/approver/onboard": {
"post": {
"tags": [
"Approver Management"
],
"summary": "Onboard approver",
"description": "The approver who fetches a pkcs12-container which has (private-key, public-key & certificate) included. The `transportPassword` is the pkcs12 password.",
"operationId": "onboard",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApproverOnboardDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApproverOnboardResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/approval": {
"post": {
"tags": [
"Approval Tasks"
],
"summary": "Send an approval",
"description": "Send an approval for an existing approval task",
"operationId": "approveTask",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SendApprovalDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/task": {
"patch": {
"tags": [
"Approval Tasks"
],
"summary": "Delete single task",
"description": "Send a delete request for an existing approval task.
If a key policy is defined consisting to be approved by 2 out of 3 people, one of the three people can reject his task and the Sign request is still possible.
\nThe endpoint GET v1/request/{id} indicate whether a request (Sign, Decrypt...) is still possible (status == PENDING), you may want to watch out for the three properties (approvedBy, notYetApprovedBy, rejectedBy).",
"operationId": "deleteTask",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DeleteTaskRequestDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/changeAttributes": {
"patch": {
"tags": [
"Keys"
],
"summary": "Modify key",
"description": "Modifies exactly one key attribute per request. The only exception is that startDate and endDate may be supplied together as one validity-period change. A request containing multiple other changes is rejected with application errorCode 600.",
"operationId": "modifyKey",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ModifyKeyDto"
}
}
},
"required": true
},
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SignedKeyAttributesDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/versionInfo": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get REST-API version",
"description": "Returns information of the currently deployed service version",
"operationId": "getVersionInfo",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/systemTime/{payload}": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get System time",
"description": "Returns the current system time information about the first connected HSM, including a SHA256withECDSA signature with optional payload (base64) and the timestamp of the Host TSB is operating in.",
"operationId": "getSystemTime",
"parameters": [
{
"name": "payload",
"in": "path",
"description": "Optional base64-encoded payload path segment",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SystemTimeInformationDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/systemTime": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get System time",
"description": "Returns the current system time information about the first connected HSM, including a SHA256withECDSA signature with optional payload (base64) and the timestamp of the Host TSB is operating in.",
"operationId": "getSystemTime_1",
"parameters": [],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SystemTimeInformationDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/request/{id}": {
"get": {
"tags": [
"Requests"
],
"summary": "Get request by id",
"description": "Returns the status of a request",
"operationId": "getRequestStatus_1",
"parameters": [
{
"name": "id",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RequestStatusDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
},
"delete": {
"tags": [
"Requests"
],
"summary": "Cancel request by id",
"description": "Cancel a request by the id generated during request creation. All associated tasks are deleted.",
"operationId": "cancelRequest",
"parameters": [
{
"name": "id",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/licenseInfo": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get license",
"description": "Returns information about the flags activated for the license of the client",
"operationId": "getLicenseInfo",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/LicenseInformationDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/keystore/statistics": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get key store statistics",
"operationId": "getKeyStoreStatistics",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/KeyStoreStatisticsDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/{keyName}/publicKey": {
"get": {
"tags": [
"Keys"
],
"summary": "Get public key",
"description": "Returns the public key",
"operationId": "getPublicKey",
"parameters": [
{
"name": "keyName",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetPublicKeyResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/modified": {
"get": {
"tags": [
"Keys"
],
"summary": "Get modified keys",
"description": "Returns a list containing the names of all HSM keys modified within the provided time window. The time window is expressed in milliseconds and counted backwards from the current TSB host time.",
"operationId": "enumerateModifiedKeys",
"parameters": [
{
"name": "time",
"in": "query",
"description": "Time window in milliseconds.",
"required": true,
"schema": {
"type": "integer",
"format": "int64"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/hsmInfo": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get HSM Firmware version",
"description": "Returns information about the HSM that the REST API is connected to.",
"operationId": "getHsmInfo",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/hsm/statistics": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get HSM latency statistics",
"description": "Returns active PrimusDevice.getDeviceInfo() latency statistics for HSM calls.",
"operationId": "getHsmStatistics",
"parameters": [
{
"name": "deviceInfoIterations",
"in": "query",
"description": "Number of PrimusDevice.getDeviceInfo() calls to actively measure.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"default": 10
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/HsmStatisticsDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/hsm/log": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get HSM logs",
"operationId": "getHsmLog",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/HsmLogDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/hsm/log/{time}": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get HSM logs by time",
"description": "Returns the HSM log from a specific time. The time must be in milliseconds (unix time)",
"operationId": "getHsmLogFromTime",
"parameters": [
{
"name": "time",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/HsmLogDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/health": {
"get": {
"tags": [
"Service Information"
],
"summary": "Get TSB health",
"description": "Returns TSB function and database connectivity health. This endpoint is used for scaling the TSB with orchestrators / load balancers.",
"operationId": "getHealth",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/HealthInformationDto"
}
}
}
},
"503": {
"description": "Service unavailable",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/HealthInformationDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/generateRandom/{length}": {
"get": {
"tags": [
"Synchronous Key Operations"
],
"summary": "Get random bytes",
"description": "Returns random bytes with the provided length as an base64 encoded string",
"operationId": "generateRandom",
"parameters": [
{
"name": "length",
"in": "path",
"required": true,
"schema": {
"type": "integer",
"format": "int32"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GenerateRandomDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/dataObject/{dataObjectName}": {
"get": {
"tags": [
"Keys"
],
"summary": "Get data object",
"description": "Retrieve a data object saved on the HSM",
"operationId": "retrieveDataObject",
"parameters": [
{
"name": "dataObjectName",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DataObjectDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
},
"delete": {
"tags": [
"Keys"
],
"summary": "Delete data object",
"description": "Deletes the data object identified by the dataObjectName from the HSM",
"operationId": "deleteDataObject",
"parameters": [
{
"name": "dataObjectName",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/certificate/{keyName}": {
"get": {
"tags": [
"Certificate"
],
"summary": "Get certificate",
"description": "Returns the certificate of a key with certificate detail level 4. The rawCertificate field contains a PEM-encoded X.509 certificate.",
"operationId": "getCertificate",
"parameters": [
{
"name": "keyName",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CertificateDetailLevel4"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
},
"delete": {
"tags": [
"Certificate"
],
"summary": "Delete certificate",
"description": "Deletes the certificate identified by the keyName from the HSM",
"operationId": "deleteCertificate",
"parameters": [
{
"name": "keyName",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/attestation/certificate": {
"get": {
"tags": [
"Keys"
],
"summary": "Get attestation certificate",
"description": "Returns certificate of attestation key as an base64 encoded string",
"operationId": "getAttestationCertificate",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AttestationCertificateDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/approverManagement/onboarding/status": {
"get": {
"tags": [
"Approver Management"
],
"summary": "Get approver status",
"description": "Returns a list of onboarded approvers and a list of pending onboardings",
"operationId": "onboardingStatus",
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApproverOnboardingStatusResponseDto"
}
}
}
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/key/{keyName}": {
"delete": {
"tags": [
"Keys"
],
"summary": "Delete a key",
"description": "Deletes the key identified by 'keyName' from the HSM.\nThis endpoint is **deprecated**.\n\nIf 'keyName' contains reserved HTTP characters (as defined in RFC 3986 — e.g., ; / ? : @ & = + $ , #),\nuse **POST /key/deleteKey** instead, since reserved characters may cause issues with URL parsing.\n",
"operationId": "deleteKey_1",
"parameters": [
{
"name": "keyName",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"deprecated": true,
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
},
"/v1/approverManagement/delete/{approverName}": {
"delete": {
"tags": [
"Approver Management"
],
"summary": "Delete approver",
"description": "Deletes the certificate and backup identified by the approver name.",
"operationId": "delete",
"parameters": [
{
"name": "approverName",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"400": {
"description": "Client Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"403": {
"description": "Request refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"404": {
"description": "Resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"500": {
"description": "Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"501": {
"description": "Implementation Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReasonBasedExceptionDto"
}
}
}
},
"200": {
"description": "Successful Operation"
}
},
"security": [
{
"bearerAuth": []
},
{
"XApiKeyAuth": []
}
]
}
}
},
"components": {
"schemas": {
"ReasonBasedExceptionDto": {
"type": "object",
"description": "Response for a specific error when an operation can not be completed successfully.",
"properties": {
"errorCode": {
"type": "integer",
"format": "int32",
"description": "Application-level error code carried in the JSON response body; it is not the HTTP status code."
},
"reason": {
"type": "string",
"description": "The reason for the error."
},
"message": {
"type": "string",
"description": "The message containing why the error was returned by the application."
}
}
},
"ApproverCreateDto": {
"type": "object",
"description": "Creating an approver key-pair, based on approver name (key-name) and backup password.",
"properties": {
"approverName": {
"type": "string",
"description": "The name of the approver e.g. the e-mail address",
"minLength": 1
},
"algorithm": {
"type": "string",
"description": "The algorithm with which the approver key should be created. ML-DSA values include the parameter set.",
"enum": [
"RSA",
"ML-DSA-44",
"ML-DSA-65",
"ML-DSA-87"
],
"example": "RSA",
"minLength": 1,
"pattern": "^(?:RSA|ML-DSA-(?:44|65|87))$"
},
"keySize": {
"type": "integer",
"format": "int32",
"description": "The length of the key. Only applicable for RSA.",
"example": 2048
},
"issuingCaKeyName": {
"type": "string",
"description": "Existing Issuing CA key name. If set, approver certificate will be CA-signed instead of self-signed."
},
"issuingCaKeyPassword": {
"type": "string",
"description": "The password of the issuing ca key.",
"example": "string"
},
"approvalKeyName": {
"type": "string",
"description": "Existing approver key name. If set, instead of generating the approval key, existing approver keypair and certificate will be used."
},
"approvalKeyPassword": {
"type": "string",
"description": "The password of the existing approval key.",
"example": "string"
},
"backupPassword": {
"type": "array",
"description": "The password of the P12 container, used for backup and restore. Password must be at least 8 characters long, contain upper and lower case letters and a digit.",
"items": {
"type": "string"
},
"minItems": 1
},
"validity": {
"type": "integer",
"format": "int32",
"description": "The days from today after which the certificate is not valid. e.g. 3650 //valid for 10 years.",
"example": 3650
},
"qrCode": {
"type": "boolean",
"description": "If true, a QR code will be generated and returned instead of OTP.",
"example": false
}
},
"required": [
"algorithm",
"approverName",
"backupPassword"
]
},
"ApproverCreateResponseDto": {
"type": "object",
"description": "Response containing the OneTimeCode or QR Code image.",
"properties": {
"oneTimeCode": {
"type": "array",
"description": "The OneTimeCode used for authentication of the onboarding process",
"items": {
"type": "string",
"pattern": "^.{1}$"
}
},
"qrCodeImage": {
"type": "string",
"format": "base64",
"description": "Base64-encoded PNG QR Code image with encrypted data."
}
}
},
"ImportXpubDto": {
"type": "object",
"description": "Request body for importing an XPUB (extended public-key) with chaincode.",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of associated public-key.",
"minLength": 1
},
"xpub": {
"type": "string",
"default": "xpub661MyMwAqRbcFPsThmBgvXxDexELiPi6kQxfBb3piHRY3Mem2N1i1ZZCHECVaJJ1oALTVHFk4LinJLqC61ySRZNTLfoY92RRUuJpcffA8Ci",
"description": "The extended public key (xpub, base58) to be imported into the HSM as public key with chaincode.",
"minLength": 1
}
},
"required": [
"label",
"xpub"
]
},
"ImportXpubResponseDto": {
"type": "object",
"description": "The base58 encoded Xpub.",
"properties": {
"publicKey": {
"type": "string",
"format": "base64",
"description": "The base64 DER encoded public-key of a xpub structure",
"minLength": 1
},
"compressedPublicKey": {
"type": "string",
"format": "base64",
"description": "The compressed DER encoded public-key (base64) of a xpub structure",
"minLength": 1
},
"chainCode": {
"type": "string",
"description": "The base64 encoded chaincode",
"minLength": 1
}
},
"required": [
"chainCode",
"compressedPublicKey",
"publicKey"
]
},
"ExportXpubDto": {
"type": "object",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the public-key, for derivation specify a derivation-path like: key-name/1/2/3",
"minLength": 1
},
"network": {
"type": "string",
"default": "0x0488b21e",
"description": "The network kind this key is to be used on, 0x0488b21e (Bitcoin Mainnet public key), 0x043587cf (Bitcoin Testnet public key)"
},
"password": {
"type": "string",
"description": "The password of the key.",
"example": "string"
}
},
"required": [
"label"
]
},
"ExportXpubResponseDto": {
"type": "object",
"properties": {
"xpub": {
"type": "string",
"format": "base58",
"description": "The base58 encoded xpub of a DER encoded public key with network_kind, depth, parent_finderprint, child_number, chain_code",
"minLength": 1
},
"publicKey": {
"type": "string",
"format": "base64",
"description": "The base64 encoded public-key (DER)",
"minLength": 1
},
"compressedPublicKey": {
"type": "string",
"format": "base64",
"description": "The compressed base64 encoded public-key (DER)",
"minLength": 1
},
"parentFingerprint": {
"type": "string",
"format": "hex",
"description": "The hex encoded first four bytes (fingerprint) of the hashed parents public-key. The first 4-bytes of the hex(RIPEMD160(SHA256(compressed public-key, 33-bytes))). // 0 is the master key."
},
"depth": {
"type": "integer",
"format": "int32",
"default": 0,
"description": "How many derivations this key is from the master (which is 0)"
},
"childNumber": {
"type": "integer",
"format": "int32",
"default": 0,
"description": "Child number of the key used to derive from parent (0 for master)"
},
"chainCode": {
"type": "string",
"description": "The base64 encoded chaincode of the public-key",
"minLength": 1
}
},
"required": [
"chainCode",
"compressedPublicKey",
"publicKey",
"xpub"
]
},
"SignatureDto": {
"type": "object",
"description": "Contains the signature and information how the signature was calculated.",
"properties": {
"signature": {
"type": "string",
"format": "base64",
"description": "Signature for a JSON object (base64 encoded).
Format of the signature is depending on the algorithm used and as returned when using a JDK's native Signature.sign() method.
Example (EC key):
echo \"MEUCIDOsDySFOWOcMKulHmR3uB8YCF7oX+vQ4dU8ooYC1OCvAiEApwMbu7nF19woZhO/KCIRV1api8oa/QCV2M2pcINAnEQ=\" | base64 -D | openssl asn1parse -inform DER
0:d=0 hl=2 l= 69 cons: SEQUENCE
\"\n 2:d=1 hl=2 l= 32 prim: INTEGER :33AC0F248539639C30ABA51E6477B81F18085EE85FEBD0E1D53CA28602D4E0AF
36:d=1 hl=2 l= 33 prim: INTEGER :A7031BBBB9C5D7DC286613BF2822115756A98BCA1AFD0095D8CDA97083409C44",
"minLength": 1
},
"digestAlgorithm": {
"type": "string",
"default": "SHA-256",
"description": "The message digest algorithm that was used for computing the request signature.",
"enum": [
"SHA-256",
"SHA-224",
"SHA-384",
"SHA-512",
"SHA3-224",
"SHA3-256",
"SHA3-384",
"SHA3-512"
],
"example": "SHA-256",
"minLength": 1
},
"publicKey": {
"type": "string",
"format": "base64",
"description": "The public key (base64 encoded) that belongs to the private key used to calculate the signature."
},
"allowedRequestCertificate": {
"type": "string",
"description": "The PEM encoded certificate in the format (-----BEGIN CERTIFICATE-----\nMII....\n-----END CERTIFICATE-----), that is onboarded in the 'allowedRequestSignatureCertificates' that belongs to the private key used to calculate the signature. If the certificate is not specified in the list, the request will be rejected."
}
},
"required": [
"digestAlgorithm",
"signature"
]
},
"SignedWrapKeyRequestDto": {
"type": "object",
"description": "Contains an wrap key request and optionally the requests signature.",
"properties": {
"wrapKeyRequest": {
"$ref": "#/components/schemas/WrapKeyRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"wrapKeyRequest"
]
},
"WrapKeyRequestDto": {
"type": "object",
"description": "Wrap key request.",
"properties": {
"keyToBeWrapped": {
"type": "string",
"default": "keyname",
"description": "Name of the key that shall be wrapped",
"minLength": 1
},
"keyToBeWrappedPassword": {
"type": "string",
"description": "Password of the key that shall be wrapped.",
"example": "string"
},
"wrapKeyName": {
"type": "string",
"description": "Name of the key with which the key shall be wrapped.",
"minLength": 1
},
"wrapKeyPassword": {
"type": "string",
"description": "Password of the wrap key.",
"example": "string"
},
"wrapMethod": {
"$ref": "#/components/schemas/WrapMethod",
"description": "The wrap method to be used. The chosen method has to be compatible with the types of the referenced keys"
}
},
"required": [
"keyToBeWrapped",
"wrapKeyName",
"wrapMethod"
]
},
"WrapMethod": {
"type": "string",
"enum": [
"AES_WRAP",
"AES_WRAP_DSA",
"AES_WRAP_EC",
"AES_WRAP_ED",
"AES_WRAP_RSA",
"AES_WRAP_BLS",
"AES_WRAP_PAD",
"AES_WRAP_PAD_DSA",
"AES_WRAP_PAD_EC",
"AES_WRAP_PAD_ED",
"AES_WRAP_PAD_RSA",
"AES_WRAP_PAD_BLS",
"RSA_WRAP_PAD",
"RSA_WRAP_OAEP"
]
},
"WrapKeyRequestResponseDto": {
"type": "object",
"description": "Response for an wrap key request.",
"properties": {
"wrappedKey": {
"type": "string",
"format": "base64",
"description": "The wrapped key (base64 encoded)."
}
}
},
"PayloadType": {
"type": "string",
"enum": [
"UNSPECIFIED",
"ISO_20022",
"PDF",
"BTC",
"ETH",
"HEX"
]
},
"SignatureAlgorithm": {
"type": "string",
"enum": [
"SHA224_WITH_RSA_PSS",
"SHA256_WITH_RSA_PSS",
"SHA384_WITH_RSA_PSS",
"SHA512_WITH_RSA_PSS",
"NONE_WITH_DSA",
"SHA224_WITH_DSA",
"SHA256_WITH_DSA",
"SHA384_WITH_DSA",
"SHA512_WITH_DSA",
"NONE_WITH_RSA",
"NONE_WITH_RSA_PSS",
"SHA224_WITH_RSA",
"SHA256_WITH_RSA",
"SHA384_WITH_RSA",
"SHA512_WITH_RSA",
"NONESHA224_WITH_RSA",
"NONESHA256_WITH_RSA",
"NONESHA384_WITH_RSA",
"NONESHA512_WITH_RSA",
"NONESHA224_WITH_RSA_PSS",
"NONESHA256_WITH_RSA_PSS",
"NONESHA384_WITH_RSA_PSS",
"NONESHA512_WITH_RSA_PSS",
"NONE_WITH_ECDSA",
"SHA1_WITH_ECDSA",
"SHA224_WITH_ECDSA",
"SHA256_WITH_ECDSA",
"DOUBLE_SHA256_WITH_ECDSA",
"SHA384_WITH_ECDSA",
"SHA512_WITH_ECDSA",
"SHA3224_WITH_ECDSA",
"SHA3256_WITH_ECDSA",
"SHA3384_WITH_ECDSA",
"SHA3512_WITH_ECDSA",
"SHA256_WITH_ECDSA_DETERMINISTIC",
"EDDSA",
"KECCAK224_WITH_ECDSA",
"KECCAK256_WITH_ECDSA",
"KECCAK384_WITH_ECDSA",
"KECCAK512_WITH_ECDSA",
"ISS_KERL",
"SHA1_WITH_RSA",
"SHA1_WITH_DSA",
"NONESHA1_WITH_RSA",
"SHA1_WITH_RSA_PSS",
"BLS",
"LMS",
"XMSS-SHA256_10_256",
"XMSS-SHAKE256_10_256",
"HMAC_SHA256",
"NONE_WITH_EC_SCHNORR_BIP0340",
"ML_DSA",
"ML_DSA_M",
"SLH_DSA",
"SHA2_224_WITH_ML_DSA",
"SHA2_256_WITH_ML_DSA",
"SHA2_384_WITH_ML_DSA",
"SHA2_512_WITH_ML_DSA",
"SHA3_224_WITH_ML_DSA",
"SHA3_256_WITH_ML_DSA",
"SHA3_384_WITH_ML_DSA",
"SHA3_512_WITH_ML_DSA",
"SHAKE_128_WITH_ML_DSA",
"SHAKE_256_WITH_ML_DSA",
"SHA2_224_WITH_SLH_DSA",
"SHA2_256_WITH_SLH_DSA",
"SHA2_384_WITH_SLH_DSA",
"SHA2_512_WITH_SLH_DSA",
"SHA3_224_WITH_SLH_DSA",
"SHA3_256_WITH_SLH_DSA",
"SHA3_384_WITH_SLH_DSA",
"SHA3_512_WITH_SLH_DSA",
"SHAKE_128_WITH_SLH_DSA",
"SHAKE_256_WITH_SLH_DSA"
]
},
"SignedVerifySignatureRequestDto": {
"type": "object",
"description": "Contains a verify signature request and optionally the requests signature.",
"properties": {
"verifySignatureRequest": {
"$ref": "#/components/schemas/VerifySignatureRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"verifySignatureRequest"
]
},
"VerifySignatureRequestDto": {
"type": "object",
"description": "Verify signature request.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the payload was signed. For signature verification of a derived key, append the full derivation path to the key name, e.g. MyKey/1/2/3.",
"minLength": 1
},
"signKeyObject": {
"type": "string",
"format": "base64",
"description": "External key object with which the request shall be verified. Subscription for External Keystore required."
},
"masterKeyPassword": {
"type": "string",
"description": "The password of the master key, if the master key has a password set.",
"example": "string"
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/SignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The signature algorithm that was used to sign the payload.",
"example": "SHA256_WITH_RSA"
},
"payload": {
"type": "string",
"format": "base64",
"description": "Payload (base64 encoded) for which the signature was created.",
"minLength": 1
},
"payloadType": {
"$ref": "#/components/schemas/PayloadType",
"default": "UNSPECIFIED",
"description": "The type of the payload used to decode the payload, default is base64."
},
"context": {
"type": "string",
"format": "base64",
"description": "(Optional) Base64 encoded context bytes for ML-DSA & SLH-DSA, which is included in the message hash computation, provides domain seperation, binds signature to a specific use case (e.g., different protocols or applications, prevents cross-protocol attacks."
},
"taprootTweakData": {
"type": "string",
"format": "base64",
"description": "(Optional) NONE_WITH_EC_SCHNORR_BIP0340 only, specify 'taprootTweakData' (base64, 32 raw bytes), used in signing with key-path, if specified 'merkleRootData' must be empty."
},
"merkleRootData": {
"type": "string",
"format": "base64",
"description": "(Optional) NONE_WITH_EC_SCHNORR_BIP0340 only, specify 'merkleRootData', used in signing with script-path (multi-sig), if specified 'taprootTweakData' must be empty."
},
"signature": {
"type": "string",
"format": "base64",
"description": "The signature to be verified.",
"minLength": 1
}
},
"required": [
"payload",
"signKeyName",
"signature",
"signatureAlgorithm"
]
},
"VerifySignatureRequestResponseDto": {
"type": "object",
"description": "Response for a verify signature request.",
"properties": {
"signatureValid": {
"type": "boolean",
"description": "Response if the signature is valid or not."
}
}
},
"CreateKeyAttributes": {
"type": "object",
"description": "The attributes of the key that should be created. The decrypt, sign, and unwrap fields are mandatory and must be set to either true or false. For asymmetric keys, at least one of these three operations must be true. Other boolean fields are optional or use their documented defaults.",
"properties": {
"encrypt": {
"type": "boolean",
"description": "If true the key can be used to encrypt data. This attribute is only supported for symmetric keys."
},
"decrypt": {
"type": "boolean",
"description": "Mandatory. If true the key can be used to decrypt data.",
"example": false
},
"verify": {
"type": "boolean",
"description": "This attribute is only supported for symmetric keys."
},
"sign": {
"type": "boolean",
"description": "Mandatory. If true the key can sign.",
"example": true
},
"wrap": {
"type": "boolean",
"description": "If true the key can be used to wrap another key. This attribute is only supported for symmetric keys."
},
"unwrap": {
"type": "boolean",
"description": "Mandatory. If true the key can be used to unwrap keys.",
"example": false
},
"derive": {
"type": "boolean",
"default": false,
"description": "If true it is possible to derive from this key."
},
"bip32": {
"type": "boolean",
"default": false,
"description": "If true the key derivation is done using BIP32 / SLIP10. This option can only be true if the key's algorithm is EC or ED and the derive attribute is true."
},
"slip10": {
"type": "boolean",
"default": false,
"description": "If true the key derivation is done using SLIP-0010. This option can only be true if the key's algorithm is EC or ED and the derive attribute is true."
},
"extractable": {
"type": "boolean",
"default": false,
"description": "If true the key is extractable. This option can only be true for keys without smart key attributes."
},
"modifiable": {
"type": "boolean",
"default": true,
"description": "If true the key can be modified. The 'modifiable' attribute applies exclusively to the key attribute and not to SKA-Policy."
},
"destroyable": {
"type": "boolean",
"default": false,
"description": "If true the key can be deleted."
},
"sensitive": {
"type": "boolean",
"description": "If true the key is sensitive. To export a key sensitive must be false"
},
"copyable": {
"type": "boolean",
"default": false,
"description": "If true the encrypted key can be stored in an external memory"
},
"rollover": {
"type": "boolean",
"default": false,
"description": "If true the key can be used for rollover."
}
},
"required": [
"decrypt",
"sign",
"unwrap"
]
},
"SignedUnwrapKeyRequestDto": {
"type": "object",
"description": "Contains an unwrap request and optionally the requests signature.",
"properties": {
"unwrapKeyRequest": {
"$ref": "#/components/schemas/UnwrapKeyRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"unwrapKeyRequest"
]
},
"UnwrapKeyRequestDto": {
"type": "object",
"description": "Unwrap key request.",
"properties": {
"wrappedKey": {
"type": "string",
"format": "base64",
"description": "The key (base64 encoded) that shall be unwrapped",
"minLength": 1
},
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key with which the unwrapped key shall be saved on the HSM",
"minLength": 1
},
"attributes": {
"$ref": "#/components/schemas/CreateKeyAttributes"
},
"unwrapKeyName": {
"type": "string",
"description": "Name of the key with which the key shall be unwrapped.",
"minLength": 1
},
"unwrapKeyPassword": {
"type": "string",
"description": "Password of the unwrap key.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"wrapMethod": {
"$ref": "#/components/schemas/WrapMethod",
"description": "The wrap method to be used. The chosen method has to be compatible with the types of the referenced keys"
}
},
"required": [
"attributes",
"label",
"unwrapKeyName",
"wrapMethod",
"wrappedKey"
]
},
"UnwrapKeyRequestResponseDto": {
"type": "object",
"description": "Response for an unwrap request.",
"properties": {
"unwrapRequestId": {
"type": "string",
"description": "The id that has been assigned to the unwrap request."
}
}
},
"SignedUnblockKeyRequestDto": {
"type": "object",
"description": "Contains an unblock key request and optionally the requests signature.",
"properties": {
"unblockRequest": {
"$ref": "#/components/schemas/UnblockKeyRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"unblockRequest"
]
},
"UnblockKeyRequestDto": {
"type": "object",
"description": "Unblock key request.",
"properties": {
"unblockKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key which shall be unblocked.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the unblock key.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
}
},
"required": [
"unblockKeyName"
]
},
"UnblockKeyRequestResponseDto": {
"type": "object",
"description": "Response for an unblock key request",
"properties": {
"unblockKeyRequestId": {
"type": "string",
"description": "The id that has been assigned to the unblock key request"
}
}
},
"Approval": {
"type": "object",
"description": "Contains information about the approval client that can send an approval (EC, RSA, ED).",
"properties": {
"type": {
"$ref": "#/components/schemas/ApprovalType",
"description": "The type of the approval."
},
"name": {
"type": "string",
"description": "The name of the approval. Only supported if type is 'public_key' or 'onboarded_approver_certificate'. If type is 'certificate' the common name in the certificate is used as name."
},
"value": {
"type": "string",
"description": "Either the public key if the type of the approval is public_key or a certificate (base64 encoded) if the type is certificate, leave empty or remove if type 'onboarded_approver_certificate' is used."
}
},
"required": [
"type"
]
},
"ApprovalType": {
"type": "string",
"enum": [
"certificate",
"public_key",
"onboarded_approver_certificate"
]
},
"Group": {
"type": "object",
"description": "Contains a list of approvals. Approval clients in this list can approve the request to reach the quorum of the group.",
"properties": {
"name": {
"type": "string",
"description": "The name of the group."
},
"quorum": {
"type": "integer",
"format": "int32",
"description": "The quorum of the group."
},
"approvals": {
"type": "array",
"description": "The list of approval clients that can send an approval.",
"items": {
"$ref": "#/components/schemas/Approval"
}
}
},
"required": [
"approvals",
"quorum"
]
},
"KeyStatus": {
"type": "object",
"description": "The status of a key.",
"properties": {
"blocked": {
"type": "boolean",
"description": "If true the key is blocked.",
"example": false
}
},
"required": [
"blocked"
]
},
"PolicyDto": {
"type": [
"object",
"null"
],
"description": "The smart-key-attribute (SKA) policy of an asymmetric key (EC, ED, RSA, and similar). It contains rules for key use, block, unblock, and policy modification. SKA capability is fixed at creation: omitting policy or setting it to null creates a non-SKA key and a policy cannot be attached later. To create an SKA-ready key without approval requirements, provide a non-null policy with keyStatus.blocked=false and all four rule fields null. The HSM normalizes each null rule to a trivially fulfillable Token1, allowing a real policy to be attached later with synchronousModify. A rule object whose tokens value is null or [] is not equivalent and may be rejected as unfulfillable. Keys created with a policy cannot be exported.",
"properties": {
"ruleUse": {
"$ref": "#/components/schemas/Rule"
},
"ruleBlock": {
"$ref": "#/components/schemas/Rule"
},
"ruleUnblock": {
"$ref": "#/components/schemas/Rule"
},
"ruleModify": {
"$ref": "#/components/schemas/Rule"
},
"keyStatus": {
"$ref": "#/components/schemas/KeyStatus"
}
},
"required": [
"keyStatus"
]
},
"Rule": {
"type": [
"object",
"null"
],
"description": "A rule contains multiple tokens. If all groups in a token reach their quorum of approvals the rule is fulfilled and the associated operation is performed on the HSM. A null rule is normalized by the HSM to a trivially fulfillable rule.",
"properties": {
"tokens": {
"type": "array",
"description": "The non-empty list of tokens in the rule. To express a trivially fulfillable rule, set the entire rule field to null instead of using null or an empty token list.",
"items": {
"$ref": "#/components/schemas/Token"
}
}
}
},
"SignedSynchronousUnwrapKeyRequestDto": {
"type": "object",
"description": "Contains an unwrap request and optionally the requests signature.",
"properties": {
"unwrapKeyRequest": {
"$ref": "#/components/schemas/SynchronousUnwrapKeyRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"unwrapKeyRequest"
]
},
"SynchronousUnwrapKeyRequestDto": {
"type": "object",
"description": "Synchronous unwrap key request.",
"properties": {
"wrappedKey": {
"type": "string",
"format": "base64",
"description": "The key (base64 encoded) that shall be unwrapped",
"minLength": 1
},
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key with which the unwrapped key shall be saved on the HSM",
"minLength": 1
},
"attributes": {
"$ref": "#/components/schemas/CreateKeyAttributes"
},
"unwrapKeyName": {
"type": "string",
"description": "Name of the key with which the key shall be unwrapped.",
"minLength": 1
},
"unwrapKeyPassword": {
"type": "string",
"description": "Password of the unwrap key.",
"example": "string"
},
"wrapMethod": {
"$ref": "#/components/schemas/WrapMethod",
"description": "The wrap method to be used. The chosen method has to be compatible with the types of the referenced keys"
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string",
"format": "base64",
"description": "Signed approvals that are used to synchronously unwrap with a SKA key. A single signed approval is a base64 encoded value that consists of the following components:\n1. The header containing the total size.\n2. The approvalToBeSigned which is the approval token that was signed by the approval client.\n3. The DER encoded signature of the token done by the approval client.\n4. The DER encoded public key of the approval client."
}
},
"policy": {
"$ref": "#/components/schemas/PolicyDto"
}
},
"required": [
"attributes",
"label",
"unwrapKeyName",
"wrapMethod",
"wrappedKey"
]
},
"Token": {
"type": "object",
"description": "Contains multiple groups of approvals. A token is only valid for a specified time window. The time windows can be disabled by setting timelock and timeout to 0 which makes the token immediately active and never expiring.",
"properties": {
"name": {
"type": "string",
"description": "The name of the token."
},
"timelock": {
"type": "integer",
"format": "int32",
"description": "The amount of time in seconds after which the token is valid starting from the creation time of the request. The value must be a multiple of 60 as the seconds must represent full minutes. When the timelock is set to 0 the token is immediately active."
},
"timeout": {
"type": "integer",
"format": "int32",
"description": "The amount of time in seconds after which the token is no longer valid starting from the creation time of the request. The value must be a multiple of 60 as the seconds must represent full minutes. When the timeout is set to 0 the token is forever valid."
},
"groups": {
"type": [
"array",
"null"
],
"description": "The list of groups in the token.",
"items": {
"$ref": "#/components/schemas/Group"
}
}
},
"required": [
"timelock",
"timeout"
]
},
"SignedSynchronousUnblockKeyRequestDto": {
"type": "object",
"description": "Contains a synchronous unblock key request and optionally the requests signature.",
"properties": {
"unblockRequest": {
"$ref": "#/components/schemas/SynchronousUnblockKeyRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"unblockRequest"
]
},
"SynchronousUnblockKeyRequestDto": {
"type": "object",
"description": "Synchronous unblock key request for SKA and non-SKA keys.",
"properties": {
"unblockKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key which shall be unblocked.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the unblock key.",
"example": "string"
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string",
"format": "base64",
"description": "Signed approvals that are used to synchronously unblock with a SKA key. A single signed approval is a base64 encoded value that consists of the following components:\n1. The header containing the total size.\n2. The approvalToBeSigned which is the approval token that was signed by the approval client.\n3. The DER encoded signature of the token done by the approval client.\n4. The DER encoded public key of the approval client."
}
}
},
"required": [
"unblockKeyName"
]
},
"SignedSynchronousSignRequestDto": {
"type": "object",
"description": "Contains a synchronous sign request and optionally the requests signature. Character '/' is used for key-derivation and should be avoided using in keyName, encode the keyname contains '/'.",
"properties": {
"signRequest": {
"$ref": "#/components/schemas/SynchronousSignRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"signRequest"
]
},
"SynchronousSignRequestDto": {
"type": "object",
"description": "Synchronous sign request.",
"properties": {
"payload": {
"type": "string",
"format": "base64, hex",
"description": "Payload that shall be signed.",
"minLength": 1
},
"payloadType": {
"$ref": "#/components/schemas/PayloadType",
"default": "UNSPECIFIED",
"description": "The type of the payload used to decode the payload, default is base64."
},
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the request shall be signed. Note: to create a sign request for a BIP32 / SLIP10 derived key, make sure you have already created a master key that is BIP32 / SLIP10 capable. Then use the master key name and add the derivation path (e.g. \"TESTKEY/0'/1'/2\").",
"minLength": 1
},
"signKeyObject": {
"type": "string",
"format": "base64",
"description": "External key object with which the request shall be signed. Subscription for External Keystore required."
},
"keyPassword": {
"type": "string",
"description": "Password of the sign key. If a derived key should be used for signing the key password of the master key must be specified.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"deprecated": true,
"description": "Legacy field retained for compatibility. A synchronous request does not create an approval task, so this metadata is not displayed to an approval client."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"deprecated": true,
"description": "Legacy field retained for compatibility and unused by synchronous signing."
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/SignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The cryptographic signature algorithm to use. This is independent of signatureType, which controls the result encoding. The chosen algorithm has to be compatible with the key referenced by signKeyName. Use the exact documented enum token (for example SHA256_WITH_RSA); Java provider-style names such as SHA256withRSA are rejected.",
"example": "SHA256_WITH_RSA"
},
"signatureType": {
"type": "string",
"description": "The output encoding of the signature result. This is independent of signatureAlgorithm, which selects the cryptographic algorithm (default is DER).
DER: ASN.1 DER-encoded signature (default for algorithms that support DER encoding).
ETH: Base64 of a 130-character ASCII hexadecimal string representing the 65-byte R||S||V value; it is not base64 of the 65 raw bytes.
RAW: Unencoded signature bytes for EC and EdDSA keys. For ECDSA, this is the concatenated R and S values (R||S). EdDSA/Ed25519 signatures are natively raw; select RAW to make that encoding explicit.
All results are base64-encoded.",
"enum": [
"ETH",
"DER",
"RAW"
],
"example": "DER"
},
"context": {
"type": "string",
"format": "base64",
"description": "(Optional) Base64 encoded context bytes for ML-DSA & SLH-DSA, which is included in the message hash computation, provides domain seperation, binds signature to a specific use case (e.g., different protocols or applications, prevents cross-protocol attacks."
},
"auxiliaryRandomData": {
"type": "string",
"format": "base64",
"description": "(Optional) NONE_WITH_EC_SCHNORR_BIP0340 only, specify 'auxiliaryRandomData' (base64, 32 raw bytes), if not specified, the HSM generates random aux_data"
},
"taprootTweakData": {
"type": "string",
"format": "base64",
"description": "(Optional) NONE_WITH_EC_SCHNORR_BIP0340 only, specify 'taprootTweakData' (base64, 32 raw bytes), used in signing with key-path, if specified 'merkleRootData' must be empty."
},
"merkleRootData": {
"type": "string",
"format": "base64",
"description": "(Optional) NONE_WITH_EC_SCHNORR_BIP0340 only, specify 'merkleRootData', used in signing with script-path (multi-sig), if specified 'taprootTweakData' must be empty."
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string",
"format": "base64",
"description": "Signed approvals that are used to synchronously sign with a SKA key. A single signed approval is a base64 encoded value that consists of the following components:\n1. The header containing the total size.\n2. The approvalToBeSigned which is the approval token that was signed by the approval client.\n3. The DER encoded signature of the token done by the approval client.\n4. The DER encoded public key of the approval client."
}
}
},
"required": [
"payload",
"signKeyName",
"signatureAlgorithm"
]
},
"SynchronousSignRequestResponseDto": {
"type": "object",
"description": "Response to a synchronous sign request.",
"properties": {
"signature": {
"type": "string",
"format": "base64",
"description": "The base64-encoded signature using the output encoding selected by signatureType. For ETH, this is base64 of a 130-character ASCII hexadecimal R||S||V value, not base64 of the 65 raw bytes."
},
"publicNonce": {
"type": "string",
"description": "In BIP-0340, the Public Nonce (denoted as point R) is a component of Schnorr signatures that ensures security by introducing randomness into the signing process"
}
}
},
"ModifyPolicyDto": {
"type": "object",
"description": "The new policy that shall be applied to an existing SKA key. Contains the rules for key use, block, unblock, and policy modification. A null rule is normalized by the HSM to a trivially fulfillable rule, so the associated operation needs no approvals. Do not represent an empty rule with tokens:null or tokens:[]; such a rule may be rejected as unfulfillable. A policy can be modified only when the key was created as an SKA key; a non-SKA key cannot gain SKA capability later.",
"properties": {
"ruleUse": {
"$ref": "#/components/schemas/Rule"
},
"ruleBlock": {
"$ref": "#/components/schemas/Rule"
},
"ruleUnblock": {
"$ref": "#/components/schemas/Rule"
},
"ruleModify": {
"$ref": "#/components/schemas/Rule"
}
}
},
"SignedSynchronousModifyKeyRequestDto": {
"type": "object",
"description": "Contains a synchronous modify key request and optionally the requests signature.",
"properties": {
"modifyRequest": {
"$ref": "#/components/schemas/SynchronousModifyKeyRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"modifyRequest"
]
},
"SynchronousModifyKeyRequestDto": {
"type": "object",
"description": "Synchronous modify key request. Only supports SKA keys.",
"properties": {
"modifyKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key which shall be modified.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the modify key.",
"example": "string"
},
"policy": {
"$ref": "#/components/schemas/ModifyPolicyDto"
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string",
"format": "base64",
"description": "Signed approvals that are used to synchronously modify with an SKA key. A single signed approval is a base64 encoded value that consists of the following components:\n1. The header containing the total size.\n2. The approvalToBeSigned which is the approval token that was signed by the approval client.\n3. The DER encoded signature of the token done by the approval client.\n4. The DER encoded public key of the approval client."
}
}
},
"required": [
"modifyKeyName",
"policy"
]
},
"HmacRequestDto": {
"type": "object",
"description": "HMAC request.",
"properties": {
"keyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the payload shall be hashed.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the hmac key.",
"example": "string"
},
"payload": {
"type": "string",
"format": "base64",
"description": "Payload (base64 encoded) that shall be hashed.",
"minLength": 1
}
},
"required": [
"keyName",
"payload"
]
},
"SignedHmacRequestDto": {
"type": "object",
"description": "Contains an HMAC request and optionally the requests signature.",
"properties": {
"hmacRequest": {
"$ref": "#/components/schemas/HmacRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"hmacRequest"
]
},
"HmacRequestResponseDto": {
"type": "object",
"description": "Response for an hmac request.",
"properties": {
"keyedHash": {
"type": "string",
"description": "The base64-encoded keyed-hash."
}
}
},
"FileVerifyDecryptRequestDto": {
"type": "object",
"description": "Request DTO for verifying the digital signature and decrypting an encrypted file. Contains the key identifiers and password required to perform decryption and signature verification.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "Identifier for the signature verification key. This value specifies the public key that corresponds to the private key used for signing the file.",
"minLength": 1
},
"encryptionKeyName": {
"type": "string",
"default": "keyname",
"description": "Identifier for the encryption key used to decrypt the file. This key can be either symmetric (e.g., AES) or, if the encryption key is wrapped, asymmetric (e.g., RSA)."
},
"encryptKeyPassword": {
"type": "string",
"description": "Password for the encryption key.",
"example": "string"
}
},
"required": [
"signKeyName"
]
},
"SignedSynchronousFileVerifyDecryptRequestDto": {
"type": "object",
"description": "Request metadata and decryption parameters.",
"properties": {
"fileVerifyDecryptRequestDto": {
"$ref": "#/components/schemas/FileVerifyDecryptRequestDto"
}
},
"required": [
"fileVerifyDecryptRequestDto"
]
},
"CipherAlgorithm": {
"type": "string",
"enum": [
"RSA_PADDING_OAEP_WITH_SHA512",
"RSA",
"RSA_PADDING_OAEP_WITH_SHA224",
"RSA_PADDING_OAEP_WITH_SHA256",
"RSA_PADDING_OAEP_WITH_SHA1",
"RSA_PADDING_OAEP",
"RSA_PADDING_OAEP_WITH_SHA384",
"RSA_PADDING_PKCS",
"RSA_NO_PADDING",
"AES_GCM",
"AES_CTR",
"AES_ECB",
"AES_CBC_NO_PADDING",
"AES",
"CHACHA20",
"CHACHA20_AEAD",
"CAMELLIA",
"CAMELLIA_CBC_NO_PADDING",
"CAMELLIA_ECB",
"ARIA",
"ARIA_ECB",
"SEED",
"SEED_ECB",
"TDEA_CBC",
"TDEA_ECB",
"TDEA_CBC_NO_PADDING"
]
},
"EncryptionKeyWrappingRequestDto": {
"type": "object",
"properties": {
"wrapKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the key shall be wrapped."
},
"wrapMethod": {
"$ref": "#/components/schemas/WrapMethod",
"default": "RSA_WRAP_OAEP",
"description": "The wrap method to be used. The chosen method has to be compatible with the types of the referenced keys (RSA_WRAP_PAD, RSA_WRAP_OAEP)"
},
"wrapKeyPassword": {
"type": "string",
"description": "Password of the wrapping key.",
"example": "string"
}
}
},
"FileSignEncryptRequestDto": {
"type": "object",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The identifier of the key used for digital signing. This key must be available on the signing server and corresponds to the private key used to create the signature.",
"minLength": 1
},
"signKeyPassword": {
"type": "string",
"description": "Password for the signing key.",
"example": "string"
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/SignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The signature algorithm to be used for signing the file. This algorithm must be compatible with the key referenced by the 'signKeyName' parameter.",
"example": "SHA256_WITH_RSA"
},
"encryptionKeyName": {
"type": "string",
"default": "keyname",
"description": "The identifier of the symmetric encryption key (e.g., AES) used for encrypting the file."
},
"encryptKeyPassword": {
"type": "string",
"description": "Password for the encryption key.",
"example": "string"
},
"cipherAlgorithm": {
"$ref": "#/components/schemas/CipherAlgorithm",
"default": "AES_GCM",
"description": "The cipher algorithm to be used for file encryption."
},
"encryptionKeyWrappingRequestDto": {
"$ref": "#/components/schemas/EncryptionKeyWrappingRequestDto",
"description": "(Optional) Wrapping instructions for the encryption key. Used if the symmetric encryption key is wrapped with an RSA or EC key."
},
"additionalAuthenticationData": {
"type": "string",
"format": "base64",
"description": "Additional authentication data (AAD) used with encryption algorithms that support AAD (e.g., AES-GCM). This value must be provided as a Base64-encoded string."
},
"tagLength": {
"type": "integer",
"format": "int",
"description": "The length (in bits) of the Message Authentication Code (MAC) used in AES-GCM encryption. This tag authenticates the integrity of the data and the sender. Supported tag lengths: 0, 64, 96, 104, 112, 120, 128."
}
},
"required": [
"cipherAlgorithm",
"encryptionKeyName",
"signKeyName",
"signatureAlgorithm"
]
},
"SignedSynchronousFileSignEncryptRequestDto": {
"type": "object",
"description": "Request metadata and encryption parameters.",
"properties": {
"fileSignAndEncryptRequestDto": {
"$ref": "#/components/schemas/FileSignEncryptRequestDto",
"description": "Request DTO that contains the signing and encryption parameters."
}
},
"required": [
"fileSignAndEncryptRequestDto"
]
},
"SignedFileDecryptRequestDto": {
"type": "object",
"description": "Contains a file decrypt request.",
"properties": {
"fileDecryptRequest": {
"$ref": "#/components/schemas/SynchronousFileDecryptRequestDto"
}
},
"required": [
"fileDecryptRequest"
]
},
"SynchronousFileDecryptRequestDto": {
"type": "object",
"description": "File decrypt request. Only supported by EC keys.",
"properties": {
"decryptKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the payload shall be decrypted.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the decrypt key.",
"example": "string"
}
},
"required": [
"decryptKeyName"
]
},
"SignedSynchronousDecryptRequestDto": {
"type": "object",
"description": "Contains a synchronous decrypt request and optionally the requests signature.",
"properties": {
"decryptRequest": {
"$ref": "#/components/schemas/SynchronousDecryptRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"decryptRequest"
]
},
"SynchronousDecryptRequestDto": {
"type": "object",
"description": "Synchronous decrypt request. Only supported by RSA keys.",
"properties": {
"encryptedPayload": {
"type": "string",
"format": "base64",
"description": "Encrypted payload (base64 encoded) that shall be decrypted.",
"minLength": 1
},
"decryptKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the payload shall be decrypted.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the decrypt key.",
"example": "string"
},
"cipherAlgorithm": {
"$ref": "#/components/schemas/CipherAlgorithm",
"description": "The cipher algorithm to be used."
},
"initializationVector": {
"type": "string",
"description": "The initialization vector (base64 encoded) used to encrypt the payload. Can be empty if the cipher algorithm used does not require an initialization vector."
},
"additionalAuthenticationData": {
"type": "string",
"format": "base64",
"description": "Additional authentication data (aad) used when decrypting payload. Can be empty if none were used when encrypting the payload"
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string",
"format": "base64",
"description": "Signed approvals that are used to synchronously decrypt with a SKA key. A single signed approval is a base64 encoded value that consists of the following components:\n1. The header containing the total size.\n2. The approvalToBeSigned which is the approval token that was signed by the approval client.\n3. The DER encoded signature of the token done by the approval client.\n4. The DER encoded public key of the approval client."
}
},
"tagLength": {
"type": "integer",
"format": "int",
"description": "The MAC (Message Authentication Tag) is a fixed-length value that is included in the ciphertext and used to authenticatethe integrity of the data and the authenticity of the sender. \nSupported tag_length: 0, 64, 96, 104, 112, 120, 128"
},
"derivationValue": {
"type": "integer",
"format": "int64",
"description": "(optional) If the key supports rollover, the derivation index (salt) for the kdf, if not specified it takes the latest derivation index."
}
},
"required": [
"cipherAlgorithm",
"decryptKeyName",
"encryptedPayload"
]
},
"SynchronousDecryptRequestResponseDto": {
"type": "object",
"description": "Response to a synchronous decrypt request.",
"properties": {
"payload": {
"type": "string",
"description": "The payload that has been decrypted."
}
}
},
"SignedSynchronousDecapsulationRequestDto": {
"type": "object",
"description": "Contains a synchronous decapsulation request and optionally the requests signature.",
"properties": {
"decapsulationRequest": {
"$ref": "#/components/schemas/SynchronousDecapsulateRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"decapsulationRequest"
]
},
"SynchronousDecapsulateRequestDto": {
"type": "object",
"description": "Synchronous decapsulation request.",
"properties": {
"decapsulationKeyName": {
"type": "string",
"description": "Name of the key to be used for the decapsulation process.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the decapsulation key.",
"example": "string"
},
"ciphertext": {
"type": "string",
"format": "base64",
"description": "The encapsulated key.",
"minLength": 1
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string",
"format": "base64",
"description": "Signed approvals that are used to synchronously decapsulate with a SKA key. A single signed approval is a base64 encoded value that consists of the following components:\n1. The header containing the total size.\n2. The approvalToBeSigned which is the approval token that was signed by the approval client.\n3. The DER encoded signature of the token done by the approval client.\n4. The DER encoded public key of the approval client."
}
}
},
"required": [
"ciphertext",
"decapsulationKeyName"
]
},
"DecapsulationResponseDto": {
"type": "object",
"description": "Response payload for a key-decapsulation operation.",
"properties": {
"sharedSecret": {
"type": "string",
"description": "Base64‑encoded shared secret."
}
}
},
"SignedSynchronousBlockKeyRequestDto": {
"type": "object",
"description": "Contains a synchronous block key request and optionally the requests signature.",
"properties": {
"blockRequest": {
"$ref": "#/components/schemas/SynchronousBlockKeyRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"blockRequest"
]
},
"SynchronousBlockKeyRequestDto": {
"type": "object",
"description": "Synchronous block key request for SKA and non-SKA keys.",
"properties": {
"blockKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key which shall be blocked.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the block key.",
"example": "string"
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string",
"format": "base64",
"description": "Signed approvals that are used to synchronously block with a SKA key. A single signed approval is a base64 encoded value that consists of the following components:\n1. The header containing the total size.\n2. The approvalToBeSigned which is the approval token that was signed by the approval client.\n3. The DER encoded signature of the token done by the approval client.\n4. The DER encoded public key of the approval client."
}
}
},
"required": [
"blockKeyName"
]
},
"HashAlgorithm": {
"type": "string",
"enum": [
"SHA1",
"SHA256",
"SHA3_256",
"SHA3_512"
]
},
"HashRequestDto": {
"type": "object",
"description": "Hash request",
"properties": {
"payload": {
"type": "string",
"description": "The payload that shall be hashed.",
"minLength": 1
},
"algorithm": {
"$ref": "#/components/schemas/HashAlgorithm",
"description": "The hash algorithm."
}
},
"required": [
"algorithm",
"payload"
]
},
"HashResponseDto": {
"type": "object",
"description": "Hash response",
"properties": {
"hash": {
"type": "string",
"description": "The hash output (base64)",
"minLength": 1
}
},
"required": [
"hash"
]
},
"SignRequestDto": {
"type": "object",
"description": "Sign request.",
"properties": {
"payload": {
"type": "string",
"format": "base64",
"description": "Payload that shall be signed.",
"minLength": 1
},
"payloadType": {
"$ref": "#/components/schemas/PayloadType",
"default": "UNSPECIFIED",
"description": "The type of the payload."
},
"signKeyName": {
"type": "string",
"description": "Name of the key with which the request shall be signed. Note: to create a sign request for a BIP32 / SLIP10 derived key, make sure you have already created a master key that is BIP32 / SLIP10 capable. Then use the master key name and add the derivation path (e.g. \"TESTKEY/0'/1'/2\").",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the sign key. If a derived key should be used for signing the key password of the master key must be specified.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/SignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The cryptographic signature algorithm to use. This is independent of signatureType, which controls the result encoding. The chosen algorithm has to be compatible with the key referenced by signKeyName. Use the exact documented enum token (for example SHA256_WITH_RSA); Java provider-style names such as SHA256withRSA are rejected.",
"example": "SHA256_WITH_RSA"
},
"signatureType": {
"type": "string",
"description": "The output encoding of the signature result. This is independent of signatureAlgorithm, which selects the cryptographic algorithm (default is DER).
DER: ASN.1 DER-encoded signature (default for algorithms that support DER encoding).
ETH: Base64 of a 130-character ASCII hexadecimal string representing the 65-byte R||S||V value; it is not base64 of the 65 raw bytes.
RAW: Unencoded signature bytes for EC and EdDSA keys. For ECDSA, this is the concatenated R and S values (R||S). EdDSA/Ed25519 signatures are natively raw; select RAW to make that encoding explicit.
All results are base64-encoded.",
"enum": [
"ETH",
"DER",
"RAW"
],
"example": "DER"
},
"context": {
"type": "string",
"format": "base64",
"description": "(Optional) Base64 encoded context bytes for ML-DSA & SLH-DSA, which is included in the message hash computation, provides domain seperation, binds signature to a specific use case (e.g., different protocols or applications, prevents cross-protocol attacks."
},
"auxiliaryRandomData": {
"type": "string",
"format": "base64",
"description": "(Optional) NONE_WITH_EC_SCHNORR_BIP0340 only, specify 'auxiliaryRandomData' (base64, 32 raw bytes), if not specified, the HSM generates random aux_data"
},
"taprootTweakData": {
"type": "string",
"format": "base64",
"description": "(Optional) NONE_WITH_EC_SCHNORR_BIP0340 only, specify 'taprootTweakData' (base64, 32 raw bytes), used in signing with key-path, if specified 'merkleRootData' must be empty."
},
"merkleRootData": {
"type": "string",
"format": "base64",
"description": "(Optional) NONE_WITH_EC_SCHNORR_BIP0340 only, specify 'merkleRootData', used in signing with script-path (multi-sig), if specified 'taprootTweakData' must be empty."
}
},
"required": [
"payload",
"signKeyName",
"signatureAlgorithm"
]
},
"SignedSignRequestDto": {
"type": "object",
"description": "Contains a sign request and optionally the requests signature.",
"properties": {
"signRequest": {
"$ref": "#/components/schemas/SignRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"signRequest"
]
},
"SignRequestResponseDto": {
"type": "object",
"description": "Response for a sign request.",
"properties": {
"signRequestId": {
"type": "string",
"description": "The id that has been assigned to the signing request."
}
}
},
"ModifyKeyRequestDto": {
"type": "object",
"description": "Modify key request",
"properties": {
"modifyKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key which shall be modified.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the modify key.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"policy": {
"$ref": "#/components/schemas/ModifyPolicyDto"
}
},
"required": [
"modifyKeyName",
"policy"
]
},
"SignedModifyKeyRequestDto": {
"type": "object",
"description": "Contains a modify key request and optionally the requests signature.",
"properties": {
"modifyRequest": {
"$ref": "#/components/schemas/ModifyKeyRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"modifyRequest"
]
},
"ModifyKeyRequestResponseDto": {
"type": "object",
"description": "Response for a modify key request.",
"properties": {
"modifyKeyRequestId": {
"type": "string",
"description": "The id that has been assigned to the modify key request."
}
}
},
"AddressFormatDto": {
"type": "object",
"description": "Contains the crypto currency for which an address should be created. An address can only be created for keys with smart key attributes.",
"properties": {
"format": {
"type": "string",
"description": "The crypto currency for which an address should be created.",
"enum": [
"BTC",
"ETH",
"XLM",
"XRP",
"IOTA"
],
"minLength": 1
}
},
"required": [
"format"
]
},
"CreateKeyDto": {
"type": "object",
"description": "Create key request.",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key.",
"minLength": 1
},
"password": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"id": {
"type": "string",
"description": "The id of the key, used if working with keys generated on TSB and used with PKCS#11 provider"
},
"algorithm": {
"type": "string",
"description": "The algorithm with which the key should be created. Either the algorithm or the algorithm_oid must be set.",
"enum": [
"HMACSHA256",
"EC",
"ED",
"RSA",
"DSA",
"ISS",
"BLS",
"AES",
"ChaCha20",
"Camellia",
"ARIA",
"SEED",
"TDEA",
"ML-DSA-44",
"ML-DSA-65",
"ML-DSA-87",
"SLH-DSA-SHA2-128s",
"SLH-DSA-SHA2-128f",
"SLH-DSA-SHA2-192s",
"SLH-DSA-SHA2-192f",
"SLH-DSA-SHA2-256s",
"SLH-DSA-SHA2-256f",
"SLH-DSA-SHAKE-128s",
"SLH-DSA-SHAKE-128f",
"SLH-DSA-SHAKE-192s",
"SLH-DSA-SHAKE-192f",
"SLH-DSA-SHAKE-256s",
"SLH-DSA-SHAKE-256f",
"ML-KEM-512",
"ML-KEM-768",
"ML-KEM-1024",
"LMS",
"XMSS-SHA256_10_256",
"XMSS-SHAKE256_10_256"
],
"example": "EC"
},
"algorithmOid": {
"type": "string",
"description": "The oid of the algorithm with which the key should be created. Either the algorithm or the algorithm_oid must be set.",
"example": "1.2.840.10045.2.1"
},
"curveOid": {
"type": "string",
"description": "The oid of the curve used for the EC or ED algorithm. Mandatory if chosen algorithm is set to EC or ED. secp224k1: 1.3.132.0.32\nsecp224r1: 1.3.132.0.33\nsecp256k1: 1.3.132.0.10\nsecp256r1 (also known as P-256 or prime256v1): 1.2.840.10045.3.1.7\nsecp384r1 (also known as P-384): 1.3.132.0.34\nsecp521r1 (also known as P-521): 1.3.132.0.35\nx962p239v1: 1.2.840.10045.3.1.1\nx962p239v2: 1.2.840.10045.3.1.2\nx962p239v3: 1.2.840.10045.3.1.3\nbrainpool224r1: 1.3.36.3.3.2.8.1.1.1\nbrainpool256r1: 1.3.36.3.3.2.8.1.1.7\nbrainpool320r1: 1.3.36.3.3.2.8.1.1.9\nbrainpool384r1: 1.3.36.3.3.2.8.1.1.11\nbrainpool512r1: 1.3.36.3.3.2.8.1.1.13\nfrp256v1: 1.2.250.1.223.101.256.1\nEd25519: 1.3.101.112",
"example": "1.3.132.0.10"
},
"keySize": {
"type": "integer",
"format": "int32",
"description": "The length of the key. Only applicable for RSA , DSA and ISS. For ISS this attribute sets the security level (1, 2 or 3)."
},
"lmsTreeHeight": {
"type": "integer",
"format": "int32",
"description": "The LMS tree height. Only applicable for LMS. Allowed values: 5, 10, 15"
},
"addressFormat": {
"$ref": "#/components/schemas/AddressFormatDto"
},
"customerNote": {
"type": "string",
"description": "Customer note stored in free field."
},
"startDate": {
"type": [
"string",
"null"
],
"description": "The first date or UTC time on which the key is valid. Accepts ISO-8601 date format yyyy-MM-dd or date-time format yyyy-MM-dd'T'HH:mm:ss.",
"example": "2026-05-11T08:08:08",
"pattern": "^\\d{4}-\\d{2}-\\d{2}(?:T\\d{2}:\\d{2}:\\d{2})?$"
},
"endDate": {
"type": [
"string",
"null"
],
"description": "The last date or UTC time on which the key is valid. Accepts ISO-8601 date format yyyy-MM-dd or date-time format yyyy-MM-dd'T'HH:mm:ss.",
"example": "2026-12-31T18:30:00",
"pattern": "^\\d{4}-\\d{2}-\\d{2}(?:T\\d{2}:\\d{2}:\\d{2})?$"
},
"attributes": {
"$ref": "#/components/schemas/CreateKeyAttributes"
},
"policy": {
"$ref": "#/components/schemas/PolicyDto",
"description": "Optional SKA policy. Only Asymmetric keys can have a policy (EC, ED, RSA,...). It contains the rules to use this key for signing a payload in a sign request, the rules to block and unblock this key, and the rules to modify the policy of this key. Omit or set to null to create a permanently non-SKA key. If the policy is empty the key does not use smart key attributes and it is not possible to add them later. To create an SKA-ready key with no initial approval requirements, provide keyStatus.blocked=false and set ruleUse, ruleBlock, ruleUnblock, and ruleModify to null; do not use empty token lists. If a policy is used with the key, the key cannot be exported."
}
},
"required": [
"attributes",
"label"
]
},
"AddressTruncatedDto": {
"type": [
"object",
"null"
],
"description": "The generated crypto currency address.",
"properties": {
"address": {
"type": "string",
"description": "The address generated for the specified crypto currency."
},
"format": {
"type": "string",
"description": "The crypto currency for which an address was created.",
"example": "BTC"
}
}
},
"Attributes": {
"type": "object",
"description": "The attributes of a key.",
"properties": {
"decrypt": {
"type": "boolean",
"description": "If true the key can be used to decrypt data."
},
"sign": {
"type": "boolean",
"description": "If true the key can sign."
},
"ekaSign": {
"type": [
"boolean",
"null"
]
},
"unwrap": {
"type": "boolean",
"description": "If true the key can be used to unwrap keys."
},
"derive": {
"type": "boolean",
"description": "If true it is possible to derive from this key."
},
"sensitive": {
"type": "boolean",
"description": "If true the key is sensitive."
},
"alwaysSensitive": {
"type": "boolean",
"description": "Is true if the key was always sensitive since its creation."
},
"extractable": {
"type": "boolean",
"description": "If true the key is extractable. Keys with smart key attributes are never extractable."
},
"neverExtractable": {
"type": "boolean",
"description": "Is true if the key was never extractable since its creation."
},
"modifiable": {
"type": "boolean",
"description": "If true the key can be modified."
},
"copyable": {
"type": "boolean",
"description": "If true the encrypted key is stored in an external memory"
},
"destroyable": {
"type": "boolean",
"description": "If true the key can be deleted."
},
"rollover": {
"type": "boolean",
"description": "If true the key can be used with the key-rollover endpoints."
}
}
},
"CertificateIdentifier": {
"type": "object",
"properties": {
"Issuer": {
"type": "string"
},
"SerialNumber": {
"type": "string"
}
}
},
"CertificateIssuer": {
"type": "object",
"properties": {
"CertificateIssuerDistinguishedName": {
"type": "string"
}
}
},
"CertificateSubject": {
"type": "object",
"properties": {
"CertificateSubjectDistinguishedName": {
"type": "string"
}
}
},
"DerivedKeyAttributesDto": {
"type": [
"object",
"null"
],
"description": "Response containing information about the derived key.",
"properties": {
"derivationType": {
"type": [
"string",
"null"
],
"description": "The chaincode",
"example": "BIP32 / SLIP10 / KdfSp80056aSha256 (AES)"
},
"derivationValue": {
"type": [
"string",
"null"
],
"description": "The derivation value, If the key supports rollover, it is the derivation index (salt) for the kdf function used to generate the symmetric key.",
"example": "273C08290FA1734D77C5C1D9BDA9B123F5DA38C060AE5D64D5BE987377E71E63"
}
}
},
"Digest": {
"type": "object",
"properties": {
"HashingAlgorithm": {
"type": "string"
},
"DigestValue": {
"type": "string"
},
"KeyFormatType": {
"type": "string"
}
}
},
"KeyAttributesDto": {
"type": "object",
"description": "Response containing information about the key.",
"properties": {
"label": {
"type": "string",
"description": "The name of the key."
},
"id": {
"type": [
"string",
"null"
],
"description": "The id of the key."
},
"uuid": {
"type": [
"string",
"null"
],
"description": "The id of the external key."
},
"algorithm": {
"type": "string",
"description": "The algorithm with which the key was created.",
"example": "EC"
},
"algorithmOid": {
"type": "string",
"description": "The oid of the algorithm with which the key was created.",
"example": "1.2.840.10045.2.1"
},
"curveOid": {
"type": [
"string",
"null"
],
"description": "The oid of the curve used for the EC algorithm (only set if the algorithm is EC).",
"example": "1.3.132.0.34"
},
"derivedAttributes": {
"description": "The derived key attributes",
"oneOf": [
{
"$ref": "#/components/schemas/DerivedKeyAttributesDto"
},
{
"type": "null"
}
]
},
"keySize": {
"type": "integer",
"format": "int32",
"description": "The length of the key. Only set if the algorithm is RSA, DSA or ISS. For ISS this attribute represents the security level."
},
"keyCheckValue": {
"type": [
"string",
"null"
],
"description": "Hex-encoded key check value from the key attestation.",
"example": "B499D5"
},
"keyUsageCount": {
"type": "integer",
"format": "int32",
"description": "The number of times a key is used in cryptographic operations."
},
"createTime": {
"type": "string",
"description": "The time at which the key was created on the HSM."
},
"attestTime": {
"type": "string",
"description": "The time at which the key was attested on the HSM."
},
"publicKey": {
"type": [
"string",
"null"
],
"description": "The public key from the created private key.\nThe public key is base64(DER/ASN.1) encoded, as supported by e.g. OpenSSL, Java and many other languages/tools.\nDecode using OpenSSL:\necho -n $EXAMPLE | base64 -D | openssl asn1parse -inform DER -dump"
},
"customerNote": {
"type": [
"string",
"null"
],
"description": "Customer note stored in free field."
},
"addressTruncated": {
"$ref": "#/components/schemas/AddressTruncatedDto"
},
"attributes": {
"$ref": "#/components/schemas/Attributes"
},
"kmip": {
"$ref": "#/components/schemas/Kmip"
},
"policy": {
"$ref": "#/components/schemas/PolicyDto"
}
}
},
"Kmip": {
"type": "object",
"description": "The kmip key attributes.",
"properties": {
"dataObjectType": {
"type": "string",
"description": "The data object type identifier of the following kmip attributes."
},
"nameAttributes": {
"$ref": "#/components/schemas/NameAttributes"
}
}
},
"NameAttributes": {
"type": "object",
"properties": {
"Attributes": {
"$ref": "#/components/schemas/NamedAttribute"
}
}
},
"NamedAttribute": {
"type": "object",
"properties": {
"ObjectType": {
"type": "string"
},
"State": {
"type": "string"
},
"UniqueIdentifier": {
"type": "string"
},
"ShortUniqueIdentifier": {
"type": "string"
},
"Fresh": {
"type": "boolean"
},
"InitialDate": {
"type": "string"
},
"LastChangeDate": {
"type": "string"
},
"OriginalCreationDate": {
"type": "string"
},
"ActivationDate": {
"type": "string"
},
"LeaseTime": {
"type": "integer",
"format": "int32"
},
"ObjectGroup": {
"type": "string",
"description": "Object group returned by the HSM."
},
"ObjectClass": {
"type": "string"
},
"CryptographicAlgorithm": {
"type": "string"
},
"CryptographicLength": {
"type": "string"
},
"CryptographicUsageMask": {
"type": "string"
},
"KeyFormatType": {
"type": "string"
},
"Sensitive": {
"type": "boolean"
},
"AlwaysSensitive": {
"type": "boolean"
},
"Extractable": {
"type": "boolean"
},
"NeverExtractable": {
"type": "boolean"
},
"ProtectionStorageMask": {
"type": "string"
},
"Digest": {
"$ref": "#/components/schemas/Digest"
},
"RandomNumberGenerator": {
"$ref": "#/components/schemas/RandomNumberGenerator"
},
"CertificateType": {
"type": "string"
},
"CertificateLength": {
"type": "string"
},
"CertificateIdentifier": {
"$ref": "#/components/schemas/CertificateIdentifier"
},
"CertificateIssuer": {
"$ref": "#/components/schemas/CertificateIssuer"
},
"CertificateSubject": {
"$ref": "#/components/schemas/CertificateSubject"
},
"CertificateIssuerC": {
"type": "string"
},
"CertificateIssuerCN": {
"type": "string"
},
"CertificateIssuerEmail": {
"type": "string"
},
"CertificateIssuerL": {
"type": "string"
},
"CertificateIssuerO": {
"type": "string"
},
"CertificateIssuerOU": {
"type": "string"
},
"CertificateIssuerST": {
"type": "string"
},
"CertificateSubjectC": {
"type": "string"
},
"CertificateSubjectCN": {
"type": "string"
},
"CertificateSubjectEmail": {
"type": "string"
},
"CertificateSubjectL": {
"type": "string"
},
"CertificateSubjectO": {
"type": "string"
},
"CertificateSubjectOU": {
"type": "string"
},
"CertificateSubjectST": {
"type": "string"
},
"DigitalSignatureAlgorithm": {
"type": "string"
},
"X.509CertificateIdentifier": {
"$ref": "#/components/schemas/X509CertificateIdentifier"
},
"X.509CertificateIssuer": {
"$ref": "#/components/schemas/X509CertificateIssuer"
},
"X.509CertificateSubject": {
"$ref": "#/components/schemas/X509CertificateSubject"
},
"Vendor": {
"type": "string",
"description": "Vendor-specific attribute value returned by the HSM."
}
}
},
"RandomNumberGenerator": {
"type": "object",
"properties": {
"RNGAlgorithm": {
"type": "string"
},
"CryptographicAlgorithm": {
"type": "string"
},
"CryptographicLength": {
"type": "string"
}
}
},
"SignedKeyAttributesDto": {
"type": "object",
"description": "Response containing the signed key attributes.",
"properties": {
"xml": {
"type": "string",
"description": "The xml representation of the key attributes."
},
"json": {
"$ref": "#/components/schemas/KeyAttributesDto"
},
"xmlSignature": {
"type": "string",
"description": "The signature of the xml."
},
"attestationKeyName": {
"type": "string",
"description": "The name of the attestation key used to sign the attributes."
}
}
},
"X509CertificateIdentifier": {
"type": "object",
"properties": {
"IssuerDistinguishedName": {
"type": "string"
},
"CertificateSerialNumber": {
"type": "string"
}
}
},
"X509CertificateIssuer": {
"type": "object",
"properties": {
"IssuerDistinguishedName": {
"type": "string"
}
}
},
"X509CertificateSubject": {
"type": "object",
"properties": {
"SubjectDistinguishedName": {
"type": "string"
}
}
},
"RotateKeyWithPasswordDto": {
"type": "object",
"description": "Rotate key Label with password.",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key to be rotated.",
"minLength": 1
},
"password": {
"type": "string",
"description": "The password of the key.",
"example": "string"
}
},
"required": [
"label"
]
},
"KeyLabelWithPasswordDto": {
"type": "object",
"description": "Key Label with password.",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key. For derived keys (persisted in the HSM or only temporarily derived), append the full derivation path to the key name, e.g. MyKey/1/2/3.",
"minLength": 1
},
"password": {
"type": "string",
"description": "The password of the key.",
"example": "string"
}
},
"required": [
"label"
]
},
"KeyImportDto": {
"type": "object",
"description": "Key import request. For a symmetric key the privateKey and publicKey must be empty. For an asymmetric key the secretKey must be empty",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key.",
"minLength": 1
},
"algorithm": {
"type": "string",
"description": "The key algorithm."
},
"addressFormat": {
"$ref": "#/components/schemas/AddressFormatDto"
},
"privateKey": {
"type": "string",
"format": "base64",
"description": "The private key to be imported. The key must be encoded in the DER format including information like the algorithm or the curve OID."
},
"publicKey": {
"type": "string",
"format": "base64",
"description": "The public key to be imported. The key must be encoded in the DER format including information like the algorithm or the curve OID."
},
"secretKey": {
"type": "string",
"format": "base64",
"description": "The secret key to be imported"
},
"certificate": {
"type": "string",
"format": "base64",
"description": "Certificate that should be set to the imported key"
},
"derivationValue": {
"type": [
"string",
"null"
],
"description": "(optional) BIP32/SLIP10 derivation value (chaincode) for EC/ED CKD key import. Supports base64 (32 bytes) and hex (64 chars)."
},
"pkcs12": {
"type": "string",
"format": "base64",
"description": "The pkcs12 container to import the private key and certificate. (base64)"
},
"pkcs12KeyName": {
"type": "string",
"description": "The alias of the key in the PKCS#12 container."
},
"pkcs12KeyPassword": {
"type": "string",
"description": "The password of the key inside the PKCS#12 container.",
"example": "string"
},
"pkcs12KeystorePassword": {
"type": "array",
"description": "The password of the PKCS#12 container.",
"items": {
"type": "string",
"pattern": "^.{1}$"
}
},
"attributes": {
"$ref": "#/components/schemas/CreateKeyAttributes"
},
"policy": {
"$ref": "#/components/schemas/PolicyDto"
}
},
"required": [
"attributes",
"label"
]
},
"ExportType": {
"type": "string",
"enum": [
"PLAIN",
"PKCS12",
"JKS"
]
},
"RequestKeyExportDto": {
"type": "object",
"description": "Key Label with password and export type. (extractable must be 'true' & sensitive must be 'false')",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key. For derived keys (persisted in the HSM or only temporarily derived), append the full derivation path to the key name, e.g. MyKey/1/2/3.",
"minLength": 1
},
"password": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"type": {
"description": "The format how the key shall be exported. PKCS12 keystore [crt + key], JKS truststore [crt], ",
"oneOf": [
{
"$ref": "#/components/schemas/ExportType"
},
{
"type": "null"
}
]
},
"pkcs12ContainerPassword": {
"type": "array",
"description": "The password of the PKCS#12 container.",
"items": {
"type": "string",
"pattern": "^.{1}$"
}
}
},
"required": [
"label"
]
},
"KeyExportDto": {
"type": "object",
"description": "Key export response",
"properties": {
"privateKey": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The exported private key. Is only available if the export is from an asymmetric key."
},
"publicKey": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The exported public key. Is only available if the export is from an asymmetric key."
},
"secretKey": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The exported secret key. Is only available if the export is from a symmetric key."
},
"pkcs12container": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The pkcs12 formated key (symmetric or asymmetric) protected by the pkcs12 key-password."
}
}
},
"ChangeKeyPasswordDto": {
"type": "object",
"description": "Change Key password. (The following key-attribute must be set: \"modifiable\": true)",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key.",
"minLength": 1
},
"password": {
"type": "string",
"description": "The old password of the key.",
"example": "string"
},
"newPassword": {
"type": "string",
"description": "The new password of the key.",
"example": "string"
}
},
"required": [
"label"
]
},
"KeyAddressDto": {
"type": "object",
"properties": {
"address": {
"type": "string",
"format": "base64",
"description": "The crypto currency address generated for the specified key (base64 encoded)."
}
}
},
"ImportKeyDto": {
"type": "object",
"description": "Import key request.",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key.",
"minLength": 1
},
"password": {
"type": "string",
"description": "(Optional) The password of the key.",
"example": "string"
},
"algorithm": {
"type": "string",
"description": "The algorithm with which the key should be created. Either the algorithm or the algorithm_oid must be set.",
"enum": [
"EC",
"ED",
"ML-DSA-44",
"ML-DSA-65",
"ML-DSA-87",
"SLH-DSA-SHA2-128s",
"SLH-DSA-SHA2-128f",
"SLH-DSA-SHA2-192s",
"SLH-DSA-SHA2-192f",
"SLH-DSA-SHA2-256s",
"SLH-DSA-SHA2-256f",
"SLH-DSA-SHAKE-128s",
"SLH-DSA-SHAKE-128f",
"SLH-DSA-SHAKE-192s",
"SLH-DSA-SHAKE-192f",
"SLH-DSA-SHAKE-256s",
"SLH-DSA-SHAKE-256f"
],
"example": "EC"
},
"seed": {
"type": "string",
"format": "base64",
"description": "Seed from which the key is imported must be base64 encoded. Bits can be represented by a mnemonic phrase to write down. EC, ED: 'seed' must be 128, 256 or 512 bits long, SLH-DSA-SHAx-128: 'seed' must be 48 (3x16) bytes long, SLH-DSA-SHAx-192: 'seed' must be 72 (3x24) bytes long, SLH-DSA-SHAx-256: 'seed' must be 96 (3x32) bytes long. "
},
"addressFormat": {
"$ref": "#/components/schemas/AddressFormatDto"
},
"curveOid": {
"type": "string",
"description": "The oid of the curve required with use for the EC or ED algorithm.",
"example": "1.3.132.0.10"
},
"attributes": {
"$ref": "#/components/schemas/CreateKeyAttributes"
},
"policy": {
"$ref": "#/components/schemas/PolicyDto"
}
},
"required": [
"attributes",
"label"
]
},
"CustomLogMessageDto": {
"type": "object",
"description": "Custom HSM log message request.",
"properties": {
"customLogMessage": {
"type": "string",
"description": "Custom log message to write to the HSM log.",
"example": "custom log message",
"minLength": 1
}
},
"required": [
"customLogMessage"
]
},
"FilteredTasksRequestDto": {
"type": "object",
"description": "Request to filter the tasks.",
"properties": {
"timestamp": {
"type": "string",
"format": "date-time",
"description": "The ISO-8601 formatted timestamp that has been signed by the approval client.",
"minLength": 1
},
"timestampSignature": {
"type": "string",
"format": "base64",
"description": "Signature(base64 encoded) for the timestamp (ISO-8601) that was done using the key of the approver. Format of the signature is depending on the algorithm used and as returned when using a JDK's native Signature.sign() method.
Example (EC key):
echo \"MEUCIDOsDySFOWOcMKulHmR3uB8YCF7oX+vQ4dU8ooYC1OCvAiEApwMbu7nF19woZhO/KCIRV1api8oa/QCV2M2pcINAnEQ=\" | base64 -D | openssl asn1parse -inform DER
0:d=0 hl=2 l= 69 cons: SEQUENCE
2:d=1 hl=2 l= 32 prim: INTEGER :33AC0F248539639C30ABA51E6477B81F18085EE85FEBD0E1D53CA28602D4E0AF
36:d=1 hl=2 l= 33 prim: INTEGER :A7031BBBB9C5D7DC286613BF2822115756A98BCA1AFD0095D8CDA97083409C44",
"minLength": 1
},
"timestampSigningCertificate": {
"type": "string",
"format": "base64",
"description": "Certificate used for the timestampSignature. Use when tasks for all approvers or a specific approver shall be fetched, but without access to the approver's private key. To load all tasks neither the approverPublicKey nor the approverCertificate may be set. If either one is set only the tasks for this specific approver is loaded."
},
"approverPublicKey": {
"type": "string",
"format": "base64",
"description": "Public key of the approver (base64 encoded). Either the approverPublicKey or the approverCertificate has to be provided if the timestampSigningCertificate is not set."
},
"approverCertificate": {
"type": "string",
"format": "base64",
"description": "Certificate of the approver in DER format (base64 encoded). Either the approverPublicKey or the approverCertificate has to be provided if the timestampSigningCertificate is not set."
},
"timestampDigestAlgorithm": {
"type": "string",
"default": "SHA-256",
"description": "The message digest algorithm that was used for computing the timestamp signature. For pure ML-DSA or SLH-DSA signatures, provide ML-DSA or SLH-DSA respectively.",
"enum": [
"SHA-256",
"SHA-224",
"SHA-384",
"SHA-512",
"SHA3-224",
"SHA3-256",
"SHA3-384",
"SHA3-512",
"ML-DSA",
"SLH-DSA"
],
"example": "SHA-256",
"minLength": 1
},
"id": {
"type": "string",
"description": "If specified filters for a specific task id"
},
"requestId": {
"type": "string",
"description": "If specified filters for a specific request id by approver Public Key. Request ID is ignored if task ID is set."
},
"detailLevel": {
"type": "string",
"default": "level1",
"description": "Controls the cumulative fields returned for each task:
level1 = id, approvalToBeSigned, approverPublicKey;
level2 = level1 plus payload, payloadType, metaData, metaDataSignature;
level3 = level2 plus requestBase64 and the operation-specific full signed request;
level4 = level3 plus timestamp and timestamp signature fields;
level5 = level4 plus keyAttributes and keyAttributesSignature;
level6 = level5 plus requestStatus.
The field set is cumulative, but which level2 values are populated depends on the operation: payloadType is sign-only, payload is null for operations without an operand, and metaData fields are null when not supplied.
Choosing a level: use level1 only for inexpensive polling for task presence. Level2 is the minimum for an approval decision based on intent and operand. Level3 is the minimum for verifying that intent against the complete original request.
Levels level1 through level4 can be fetched without a live HSM connection. Levels level5 and level6 may query the HSM for key attributes and must not be used for HSM-independent or multi-tenant task retrieval. They add an HSM round-trip and a substantially larger response, so polling clients should remain at level4 or below and fetch level5 or level6 only for a selected task.",
"enum": [
"level1",
"level2",
"level3",
"level4",
"level5",
"level6"
]
},
"paging": {
"$ref": "#/components/schemas/PagingDto"
}
},
"required": [
"timestamp",
"timestampDigestAlgorithm",
"timestampSignature"
]
},
"PagingDto": {
"type": "object",
"description": "Metadata for enabling result paging",
"properties": {
"pageNumber": {
"type": "integer",
"format": "int32",
"description": "The number of the page of results to be returned.",
"minimum": 0
},
"pageSize": {
"type": "integer",
"format": "int32",
"description": "The number of results to be returned per page",
"minimum": 1
},
"sortOrder": {
"$ref": "#/components/schemas/SortOrder",
"description": "Sort order of the results.
Note: initial value for LAST_FETCHED_DATE is the creation date of the task.
LAST_FETCHED_DATE is updated every time a task is returned to the client using the appropriate REST service.
Note: LAST_FETCHED_DATE is not updated when TSB runs on the HSM-Clone. Updating it would require the master to be up and running in order to fetch tasks."
}
},
"required": [
"sortOrder"
]
},
"SortOrder": {
"type": "string",
"enum": [
"NOT_BEFORE_UTC_ASC",
"NOT_BEFORE_UTC_DESC",
"NOT_AFTER_UTC_ASC",
"NOT_AFTER_UTC_DESC",
"NOT_BEFORE_ASC",
"NOT_BEFORE_DESC",
"NOT_AFTER_ASC",
"NOT_AFTER_DESC"
]
},
"AirGappedModifyRequestDto": {
"type": "object",
"properties": {
"modifyKeyName": {
"type": "string"
},
"keyPassword": {
"type": "array",
"items": {
"type": "string"
}
},
"policy": {
"$ref": "#/components/schemas/ModifyPolicyDto"
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"AirGappedSignRequestDto": {
"type": "object",
"properties": {
"payload": {
"type": "string"
},
"payloadType": {
"type": "string"
},
"signKeyName": {
"type": "string"
},
"keyPassword": {
"type": "array",
"items": {
"type": "string"
}
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/SignatureAlgorithm"
},
"signedApprovals": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"BlockKeyRequestDto": {
"type": "object",
"description": "Block key request.",
"properties": {
"blockKeyName": {
"type": "string",
"description": "Name of the key which shall be blocked.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the block key.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
}
},
"required": [
"blockKeyName"
]
},
"CertificateAttributesDto": {
"type": "object",
"description": "The standard attributes of X.500 series the key that should be created. At least one operation (decrypt, sign, unwrap) must be allowed (true).",
"properties": {
"commonName": {
"type": "string",
"description": "Common Name (e.g. server FQDN or YOUR name) []"
},
"country": {
"type": "string",
"description": "Country Name (2 letter code) [CH]"
},
"stateOrProvinceName": {
"type": "string",
"description": "State or Province Name (full name) [Some-State]"
},
"locality": {
"type": "string",
"description": "Locality Name (eg, city) []"
},
"organizationName": {
"type": "string",
"description": "Organization Name (eg, company) [Securosys SA]"
},
"organizationIdentifier": {
"type": "string",
"description": "Organization Identifier []"
},
"organizationUnitName": {
"type": "string",
"description": "Organizational Unit Name (eg, section) []"
},
"email": {
"type": "string",
"description": "Email Address []"
},
"title": {
"type": "string",
"description": "Title []"
},
"surname": {
"type": "string",
"description": "Surname []"
},
"givenName": {
"type": "string",
"description": "Given name []"
},
"initials": {
"type": "string",
"description": "initials []"
},
"pseudonym": {
"type": "string",
"description": "Pseudonym []"
},
"generationQualifier": {
"type": "string",
"description": "Generation qualifier [Jr., 3rd, or IV]"
}
}
},
"CopyExtensions": {
"type": "string",
"enum": [
"NO_COPY",
"COPY"
]
},
"CsrSignRequestDto": {
"type": "object",
"description": "CSR request with Smart Key Attributes.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The name of the key used to sign the certificate request.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/KeytoolSignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The signature algorithm to be used. The chosen algorithm has to be compatible with the type of the key referenced by the signKeyName.",
"example": "SHA256_WITH_RSA"
},
"standardCertificateAttributes": {
"$ref": "#/components/schemas/CertificateAttributesDto",
"description": "The standard certificate request attributes for X.500 series"
},
"keyUsage": {
"type": "array",
"description": "The key usage extension defines the purpose (for example, encipherment, signature, or certificate signing) of the key contained in the certificate. If the public key is used for entity authentication, then the certificate extension should have the key usage Digital signature.",
"items": {
"$ref": "#/components/schemas/KeyUsage"
}
},
"extendedKeyUsage": {
"type": "array",
"description": "This extension indicates one or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension. In general, this extension will appear only in end entity certificates.",
"items": {
"$ref": "#/components/schemas/ExtendedKeyUsage"
}
},
"subjectAlternativeNames": {
"type": "array",
"description": "The Subject Alternative Name (SAN) is an extension to the X.509 standard that allows a single certificate to secure multiple hostnames, IP addresses, or other identifiers. It is used by clients to verify that the presented certificate is valid for the server they are connecting to. Sample: SAN=dns:my-primary-host.example.com,dns:*.api.example.com,dns:localhost,ip:192.168.1.10,ip:127.0.0.1,ip:::1,uri:https://service.example.com/endpoint,email:admin@example.com,rid:1.2.3.4",
"items": {
"$ref": "#/components/schemas/SubjectAlternativeName"
}
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
}
},
"required": [
"signKeyName",
"signatureAlgorithm",
"standardCertificateAttributes"
]
},
"DecapsulateRequestDto": {
"type": "object",
"description": "Decapsulation request.",
"properties": {
"decapsulationKeyName": {
"type": "string",
"description": "Name of the key to be used for the decapsulation process.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the decapsulation key.",
"example": "string"
},
"ciphertext": {
"type": "string",
"format": "base64",
"description": "The encapsulated key.",
"minLength": 1
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
}
},
"required": [
"ciphertext",
"decapsulationKeyName"
]
},
"DecryptRequestDto": {
"type": "object",
"description": "Decrypt request. Only supported by RSA keys.",
"properties": {
"encryptedPayload": {
"type": "string",
"format": "base64",
"description": "Encrypted payload (base64 encoded) that shall be decrypted.",
"minLength": 1
},
"decryptKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the payload shall be decrypted.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the decrypt key.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"cipherAlgorithm": {
"$ref": "#/components/schemas/CipherAlgorithm",
"description": "The cipher algorithm to be used."
},
"initializationVector": {
"type": "string",
"description": "The initialization vector (base64 encoded) used to encrypt the payload. Can be empty if the cipher algorithm used does not require an initialization vector."
},
"additionalAuthenticationData": {
"type": "string",
"format": "base64",
"description": "Additional authentication data (aad, base64) used when decrypting payload. Can be empty if none were used when encrypting the payload"
},
"tagLength": {
"type": "integer",
"format": "int",
"description": "The MAC (Message Authentication Tag) is a fixed-length value that is INCLUDED in the ciphertext and used to authenticatethe integrity of the data and the authenticity of the sender. Supported tag_length: 0, 64, 96, 104, 112, 120, 128"
}
},
"required": [
"cipherAlgorithm",
"decryptKeyName",
"encryptedPayload"
]
},
"ExtendedKeyUsage": {
"type": "string",
"enum": [
"ANY_EXTENDED_KEY_USAGE",
"SERVER_AUTH",
"CLIENT_AUTH",
"CODE_SIGNING",
"EMAIL_PROTECTION",
"TIME_STAMPING",
"OCSP_SIGNING"
]
},
"GetTasksResponseDto": {
"type": "object",
"description": "Response containing the requested tasks with the specified detail level.",
"properties": {
"tasks": {
"type": "array",
"items": {
"description": "The requested tasks.",
"oneOf": [
{
"$ref": "#/components/schemas/TaskLevel1"
},
{
"$ref": "#/components/schemas/TaskLevel2"
},
{
"$ref": "#/components/schemas/TaskLevel3"
},
{
"$ref": "#/components/schemas/TaskLevel4"
},
{
"$ref": "#/components/schemas/TaskLevel5"
},
{
"$ref": "#/components/schemas/TaskLevel6"
}
],
"properties": {
"detailLevel": {
"type": "string",
"enum": [
"level1",
"level2",
"level3",
"level4",
"level5",
"level6"
]
}
},
"required": [
"detailLevel"
]
}
}
}
},
"KeyUsage": {
"type": "string",
"enum": [
"DIGITAL_SIGNATURE",
"CONTENT_COMMITMENT",
"KEY_ENCIPHERMENT",
"DATA_ENCIPHERMENT",
"KEY_AGREEMENT",
"KEY_CERT_SIGN",
"CRL_SIGN",
"ENCIPHER_ONLY",
"DECIPHER_ONLY"
]
},
"KeytoolSignatureAlgorithm": {
"type": "string",
"enum": [
"SHA224_WITH_RSA",
"SHA256_WITH_RSA",
"SHA384_WITH_RSA",
"SHA512_WITH_RSA",
"SHA256_WITH_ECDSA",
"SHA384_WITH_ECDSA",
"SHA512_WITH_ECDSA",
"EDDSA",
"ML_DSA_44",
"ML_DSA_65",
"ML_DSA_87"
]
},
"OfflineHsmDto": {
"type": "object",
"properties": {
"signRequest": {
"$ref": "#/components/schemas/AirGappedSignRequestDto",
"description": "Air-gapped signing request input. Exactly one of signRequest and modifyRequest is present."
},
"modifyRequest": {
"$ref": "#/components/schemas/AirGappedModifyRequestDto",
"description": "Air-gapped key-modification request input. Exactly one of signRequest and modifyRequest is present."
}
}
},
"RequestStatus": {
"type": "string",
"enum": [
"PENDING",
"APPROVED",
"EXECUTED",
"FAILED",
"EXPIRED",
"REJECTED",
"CANCELLED"
]
},
"RequestStatusDto": {
"type": "object",
"description": "Response containing information about the status of a request.",
"properties": {
"id": {
"type": "string",
"description": "The id of the request."
},
"status": {
"$ref": "#/components/schemas/RequestStatus",
"description": "The current status of the request."
},
"executionTime": {
"type": [
"string",
"null"
],
"description": "Date and time when the request is sent to the hsm in ISO-8601 format."
},
"approvedBy": {
"type": "array",
"items": {
"type": "string",
"description": "Public keys of approvers that have approved the request."
}
},
"notYetApprovedBy": {
"type": "array",
"items": {
"type": "string",
"description": "Public keys of approvers that have not yet approved the request but still could approve."
}
},
"rejectedBy": {
"type": "array",
"items": {
"type": "string",
"description": "Public keys from approvers that have rejected to approve the request (i.e. they deleted the task related to this request."
}
},
"result": {
"type": [
"string",
"null"
],
"description": "The operation-specific result after the request has been executed on the HSM. Sign requests return the base64-encoded signature and decrypt requests return the base64-encoded decrypted payload. For a sign request with signatureType ETH, the value is base64 of a 130-character ASCII hexadecimal R||S||V value, not base64 of the 65 raw bytes. Certificate request operations return a PEM-encoded CSR, while certificate sign and self-sign operations return a PEM-encoded X.509 certificate. Requests without a result, and requests that have not executed yet, leave this field empty."
},
"inputOfflineHsm": {
"description": "Input for a synchronous sign request in an air-gapped TSB workflow. This property is populated only for that offline-HSM flow and is omitted from ordinary connected-HSM responses.",
"oneOf": [
{
"$ref": "#/components/schemas/OfflineHsmDto"
},
{
"type": "null"
}
]
}
}
},
"SANType": {
"type": "string",
"enum": [
"DNS",
"IP",
"URI",
"EMAIL",
"OTHERNAME"
]
},
"SelfSignCertificateRequestDto": {
"type": "object",
"description": "Self-Signed Certificate request with Smart Key Attributes.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The name of the key",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"validity": {
"type": "integer",
"format": "int32",
"description": "The days from today after which the certificate is not valid. e.g. 365 //valid for 1 year."
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/KeytoolSignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The signature algorithm to be used. The chosen algorithm has to be compatible with the type of the key referenced by the signKeyName.",
"example": "SHA256_WITH_RSA"
},
"standardCertificateAttributes": {
"$ref": "#/components/schemas/CertificateAttributesDto",
"description": "The standard certificate request attributes for X.500 series"
},
"commonName": {
"type": [
"string",
"null"
],
"deprecated": true,
"description": "Deprecated legacy Subject CN. Used only when standardCertificateAttributes is absent; when both are supplied, standardCertificateAttributes.commonName takes precedence."
},
"keyUsage": {
"type": "array",
"description": "The key usage extension defines the purpose (for example, encipherment, signature, or certificate signing) of the key contained in the certificate. If the public key is used for entity authentication, then the certificate extension should have the key usage Digital signature.",
"items": {
"$ref": "#/components/schemas/KeyUsage"
}
},
"extendedKeyUsage": {
"type": "array",
"description": "This extension indicates one or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension. In general, this extension will appear only in end entity certificates.",
"items": {
"$ref": "#/components/schemas/ExtendedKeyUsage"
}
},
"subjectAlternativeNames": {
"type": "array",
"description": "The Subject Alternative Name (SAN) is an extension to the X.509 standard that allows a single certificate to secure multiple hostnames, IP addresses, or other identifiers. It is used by clients to verify that the presented certificate is valid for the server they are connecting to. Sample: SAN=dns:my-primary-host.example.com,dns:*.api.example.com,dns:localhost,ip:192.168.1.10,ip:127.0.0.1,ip:::1,uri:https://service.example.com/endpoint,email:admin@example.com,rid:1.2.3.4",
"items": {
"$ref": "#/components/schemas/SubjectAlternativeName"
}
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"certificateAuthority": {
"type": "boolean"
}
},
"required": [
"signKeyName",
"signatureAlgorithm",
"validity"
]
},
"SignCertificateRequestDto": {
"type": "object",
"description": "Certificate request with Smart Key Attributes.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The name of the key",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/KeytoolSignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The signature algorithm to be used. The chosen algorithm has to be compatible with the type of the key referenced by the signKeyName.",
"example": "SHA256_WITH_RSA"
},
"standardCertificateAttributes": {
"$ref": "#/components/schemas/CertificateAttributesDto",
"description": "The standard certificate request attributes for X.500 series"
},
"validity": {
"type": "integer",
"format": "int32",
"description": "The days from today after which the certificate is not valid. e.g. 365 //valid for 1 year."
},
"copyExtensions": {
"$ref": "#/components/schemas/CopyExtensions",
"default": "no_copy",
"description": "The copyExtensions option should be used with caution. If care is not taken then it can be a security risk. COPY copies extensions without basicConstraints, this because for example if a certificate request contains a basicConstraints extension with CA:TRUE and the user does not spot this when the certificate is displayed then this will hand the requester a valid CA certificate. NO_COPY request does not copy the extensions from the CSR."
},
"certificateSigningRequest": {
"type": "string",
"format": "pem",
"description": "The PEM-encoded certificate signing request (CSR), including its BEGIN and END markers."
},
"keyUsage": {
"type": "array",
"description": "KeyUsage is set if copyExtensions = NO_COPY.The key usage extension defines the purpose (for example, encipherment, signature, or certificate signing) of the key contained in the certificate. If the public key is used for entity authentication, then the certificate extension should have the key usage Digital signature.",
"items": {
"$ref": "#/components/schemas/KeyUsage"
}
},
"extendedKeyUsage": {
"type": "array",
"description": "ExtendedKeyUsage is set if copyExtensions = NO_COPY. This extension indicates one or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension. In general, this extension will appear only in end entity certificates.",
"items": {
"$ref": "#/components/schemas/ExtendedKeyUsage"
}
},
"subjectAlternativeNames": {
"type": "array",
"description": "Subject Alternative Name (SAN) is set if copyExtensions = NO_COPY.The Subject Alternative Name (SAN) is an extension to the X.509 standard that allows a single certificate to secure multiple hostnames, IP addresses, or other identifiers. It is used by clients to verify that the presented certificate is valid for the server they are connecting to. Sample: SAN=dns:my-primary-host.example.com,dns:*.api.example.com,dns:localhost,ip:192.168.1.10,ip:127.0.0.1,ip:::1,uri:https://service.example.com/endpoint,email:admin@example.com,rid:1.2.3.4",
"items": {
"$ref": "#/components/schemas/SubjectAlternativeName"
}
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"certificateAuthority": {
"type": "boolean"
}
},
"required": [
"certificateSigningRequest",
"signKeyName",
"signatureAlgorithm",
"validity"
]
},
"SignedBlockKeyRequestDto": {
"type": "object",
"description": "Contains a block key request and optionally the requests signature.",
"properties": {
"blockRequest": {
"$ref": "#/components/schemas/BlockKeyRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"blockRequest"
]
},
"SignedCertificateRequestRequestDto": {
"type": "object",
"description": "Create a signed CSR request (asynchronous). After the request was approved the CSR can be obtained with GET /v1/request/{id}",
"properties": {
"csrSignRequest": {
"$ref": "#/components/schemas/CsrSignRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"csrSignRequest"
]
},
"SignedDecapsulationRequestDto": {
"type": "object",
"description": "Contains a decapsulation request and optionally the requests signature.",
"properties": {
"decapsulationRequest": {
"$ref": "#/components/schemas/DecapsulateRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"decapsulationRequest"
]
},
"SignedDecryptRequestDto": {
"type": "object",
"description": "Contains a decrypt request and optionally the requests signature.",
"properties": {
"decryptRequest": {
"$ref": "#/components/schemas/DecryptRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"decryptRequest"
]
},
"SignedSelfSignCertificateRequestDto": {
"type": "object",
"description": "Generate a self-signed x509 certificate (asynchronous). After the request was approved the x509 can be obtained with GET /v1/request/{id}",
"properties": {
"selfSignCertificateRequest": {
"$ref": "#/components/schemas/SelfSignCertificateRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"selfSignCertificateRequest"
]
},
"SignedSignCertificateRequestDto": {
"type": "object",
"description": "Generate a valid x509 certificate (asynchronous). After the request was approved the x509 can be obtained with GET /v1/request/{id}",
"properties": {
"signCertificateRequest": {
"$ref": "#/components/schemas/SignCertificateRequestDto"
},
"requestSignature": {
"description": "Optional signature over the request. Null when the caller did not submit one.",
"oneOf": [
{
"$ref": "#/components/schemas/SignatureDto"
},
{
"type": "null"
}
]
}
},
"required": [
"signCertificateRequest"
]
},
"SubjectAlternativeName": {
"type": "object",
"description": "Subject Alternative Name Object",
"properties": {
"sanType": {
"$ref": "#/components/schemas/SANType"
},
"sanValue": {
"type": "string"
}
}
},
"TaskLevel": {
"type": "object",
"description": "Abstract base for approval task detail levels. Runtime responses always use one of level1 through level6.",
"discriminator": {
"propertyName": "detailLevel",
"mapping": {
"level1": "#/components/schemas/TaskLevel1",
"level2": "#/components/schemas/TaskLevel2",
"level3": "#/components/schemas/TaskLevel3",
"level4": "#/components/schemas/TaskLevel4",
"level5": "#/components/schemas/TaskLevel5",
"level6": "#/components/schemas/TaskLevel6"
}
},
"properties": {
"id": {
"type": "string",
"description": "Id of the task."
},
"detailLevel": {
"type": "string"
}
},
"required": [
"detailLevel",
"id"
]
},
"TaskLevel1": {
"allOf": [
{
"$ref": "#/components/schemas/TaskLevel"
},
{
"type": "object",
"properties": {
"approvalToBeSigned": {
"type": "string",
"format": "base64",
"description": "Already prepared ready to sign serialization of the approval token. The approvalToBeSigned is a binary structure with the following format.
Example:
Base64: /AAAADsABAABAAAAAhApAFRFU1RLRVkyMDIwLTAzLTE2XzEwLTQxLTA2LjM4NDY2MDA0MzcxMDAwAAAAVBBEAEAAAABXEBYAQXBwcm92ZVNpZ25UYXNrUGF5bG9hZAAABwEIALRJb14AAAAAAhASAHRlc3QtdGltZXN0YW1wLWtleQAAVhBbADBZMAwGCCqGSM49BAMCBQADSQAwRgIhAKLnz8NtSThbVkSMjj8Zwl45vmyQ4bL/XMbLxV0RYa5mAiEAudcZnBwJ8SAXvTpcgvbP4wPbID8/Ia+vmcoRqAlXjlkAVxAWAEFwcHJvdmVTaWduVGFza1BheWxvYWQAAA==
Hex: FC0000003B0004000100000002102900544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000541044004000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B6579000056105B003059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E590057101600417070726F76655369676E5461736B5061796C6F61640000
FC000000
length: 252byte
3B00
type: 59d = EkaOperation
0400
length: = 4byte
01000000
data: Operation Type: \"OPERATION\", could also be \"BLOCK\", \"UNBLOCK\" or \"MODIFY\"
0210
type: 4098d = LabelUtf8String
2900
length: 41byte
544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000
data: label of the key = \"TESTKEY2020-03-16_10-41-06.38466004371000\" (incl. padding for 4byte alignment)
5410
type: 4180d = EkaTimeStamp
4400
length: 68byte
4000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B65790000
data: timestamp (see CertificateDetailLevel4 for details)
5610
type: 4182d = DerSignature
5B00
length: 91byte
3059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E5900
data: signature of the timestamp (see CertificateDetailLevel4 for details)
5710
type: 4183d = EkaSignPayload (could also be EkaModifyPayload)
1600
length: 22bytes
417070726F76655369676E5461736B5061796C6F61640000
data: the payload to be signed"
},
"approverPublicKey": {
"type": "string",
"description": "The public key of the approver for whom the task was created."
}
}
}
],
"description": "Detail level 1: id, approvalToBeSigned, and approverPublicKey.",
"properties": {
"detailLevel": {
"type": "string",
"enum": [
"level1"
]
}
},
"required": [
"approvalToBeSigned",
"approverPublicKey",
"detailLevel",
"id"
]
},
"TaskLevel2": {
"allOf": [
{
"$ref": "#/components/schemas/TaskLevel"
},
{
"type": "object",
"properties": {
"approvalToBeSigned": {
"type": "string",
"format": "base64",
"description": "Already prepared ready to sign serialization of the approval token. The approvalToBeSigned is a binary structure with the following format.
Example:
Base64: /AAAADsABAABAAAAAhApAFRFU1RLRVkyMDIwLTAzLTE2XzEwLTQxLTA2LjM4NDY2MDA0MzcxMDAwAAAAVBBEAEAAAABXEBYAQXBwcm92ZVNpZ25UYXNrUGF5bG9hZAAABwEIALRJb14AAAAAAhASAHRlc3QtdGltZXN0YW1wLWtleQAAVhBbADBZMAwGCCqGSM49BAMCBQADSQAwRgIhAKLnz8NtSThbVkSMjj8Zwl45vmyQ4bL/XMbLxV0RYa5mAiEAudcZnBwJ8SAXvTpcgvbP4wPbID8/Ia+vmcoRqAlXjlkAVxAWAEFwcHJvdmVTaWduVGFza1BheWxvYWQAAA==
Hex: FC0000003B0004000100000002102900544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000541044004000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B6579000056105B003059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E590057101600417070726F76655369676E5461736B5061796C6F61640000
FC000000
length: 252byte
3B00
type: 59d = EkaOperation
0400
length: = 4byte
01000000
data: Operation Type: \"OPERATION\", could also be \"BLOCK\", \"UNBLOCK\" or \"MODIFY\"
0210
type: 4098d = LabelUtf8String
2900
length: 41byte
544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000
data: label of the key = \"TESTKEY2020-03-16_10-41-06.38466004371000\" (incl. padding for 4byte alignment)
5410
type: 4180d = EkaTimeStamp
4400
length: 68byte
4000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B65790000
data: timestamp (see CertificateDetailLevel4 for details)
5610
type: 4182d = DerSignature
5B00
length: 91byte
3059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E5900
data: signature of the timestamp (see CertificateDetailLevel4 for details)
5710
type: 4183d = EkaSignPayload (could also be EkaModifyPayload)
1600
length: 22bytes
417070726F76655369676E5461736B5061796C6F61640000
data: the payload to be signed"
},
"approverPublicKey": {
"type": "string",
"description": "The public key of the approver for whom the task was created."
},
"metaData": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"payload": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The operand of the requested operation, base64 encoded. Its content depends on the task type: message to sign (sign), ciphertext to decrypt (decrypt), TLV-encoded policy (modify), DER TBSCertificate (self-sign), or DER CertificationRequestInfo (CSR). Null for operations without an operand, such as block and unblock."
},
"payloadType": {
"description": "The type of the payload for sign tasks. Null for other task types.",
"oneOf": [
{
"$ref": "#/components/schemas/PayloadType"
},
{
"type": "null"
}
]
}
}
}
],
"description": "Detail level 2: the level 1 field set plus payload, payloadType, metaData, and metaDataSignature. These properties are present in the response, but whether they contain a value depends on the operation; see each field description.",
"properties": {
"detailLevel": {
"type": "string",
"enum": [
"level2"
]
}
},
"required": [
"approvalToBeSigned",
"approverPublicKey",
"detailLevel",
"id",
"metaData",
"metaDataSignature",
"payload",
"payloadType"
]
},
"TaskLevel3": {
"allOf": [
{
"$ref": "#/components/schemas/TaskLevel"
},
{
"type": "object",
"properties": {
"approvalToBeSigned": {
"type": "string",
"format": "base64",
"description": "Already prepared ready to sign serialization of the approval token. The approvalToBeSigned is a binary structure with the following format.
Example:
Base64: /AAAADsABAABAAAAAhApAFRFU1RLRVkyMDIwLTAzLTE2XzEwLTQxLTA2LjM4NDY2MDA0MzcxMDAwAAAAVBBEAEAAAABXEBYAQXBwcm92ZVNpZ25UYXNrUGF5bG9hZAAABwEIALRJb14AAAAAAhASAHRlc3QtdGltZXN0YW1wLWtleQAAVhBbADBZMAwGCCqGSM49BAMCBQADSQAwRgIhAKLnz8NtSThbVkSMjj8Zwl45vmyQ4bL/XMbLxV0RYa5mAiEAudcZnBwJ8SAXvTpcgvbP4wPbID8/Ia+vmcoRqAlXjlkAVxAWAEFwcHJvdmVTaWduVGFza1BheWxvYWQAAA==
Hex: FC0000003B0004000100000002102900544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000541044004000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B6579000056105B003059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E590057101600417070726F76655369676E5461736B5061796C6F61640000
FC000000
length: 252byte
3B00
type: 59d = EkaOperation
0400
length: = 4byte
01000000
data: Operation Type: \"OPERATION\", could also be \"BLOCK\", \"UNBLOCK\" or \"MODIFY\"
0210
type: 4098d = LabelUtf8String
2900
length: 41byte
544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000
data: label of the key = \"TESTKEY2020-03-16_10-41-06.38466004371000\" (incl. padding for 4byte alignment)
5410
type: 4180d = EkaTimeStamp
4400
length: 68byte
4000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B65790000
data: timestamp (see CertificateDetailLevel4 for details)
5610
type: 4182d = DerSignature
5B00
length: 91byte
3059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E5900
data: signature of the timestamp (see CertificateDetailLevel4 for details)
5710
type: 4183d = EkaSignPayload (could also be EkaModifyPayload)
1600
length: 22bytes
417070726F76655369676E5461736B5061796C6F61640000
data: the payload to be signed"
},
"approverPublicKey": {
"type": "string",
"description": "The public key of the approver for whom the task was created."
},
"metaData": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"payload": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The operand of the requested operation, base64 encoded. Its content depends on the task type: message to sign (sign), ciphertext to decrypt (decrypt), TLV-encoded policy (modify), DER TBSCertificate (self-sign), or DER CertificationRequestInfo (CSR). Null for operations without an operand, such as block and unblock."
},
"payloadType": {
"description": "The type of the payload for sign tasks. Null for other task types.",
"oneOf": [
{
"$ref": "#/components/schemas/PayloadType"
},
{
"type": "null"
}
]
},
"requestBase64": {
"type": "string",
"format": "base64",
"description": "The original request as sent by the caller, base64 encoded. To be used for signature verification."
},
"signedSignRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSignRequestDto"
},
{
"type": "null"
}
]
},
"signedModifyKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedModifyKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedBlockKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedBlockKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedUnblockKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedUnblockKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedDecryptRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedDecryptRequestDto"
},
{
"type": "null"
}
]
},
"signedUnwrapKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedUnwrapKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedDecapsulationRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedDecapsulationRequestDto"
},
{
"type": "null"
}
]
},
"signedCertificateRequestRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedCertificateRequestRequestDto"
},
{
"type": "null"
}
]
},
"signedSignCertificateRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSignCertificateRequestDto"
},
{
"type": "null"
}
]
},
"signedSelfSignCertificateRequestDto": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSelfSignCertificateRequestDto"
},
{
"type": "null"
}
]
}
}
}
],
"description": "Detail level 3: level 2 fields plus requestBase64 and the operation-specific full signed request. Exactly one signed*Request property is populated; all sibling operation properties are null.",
"properties": {
"detailLevel": {
"type": "string",
"enum": [
"level3"
]
}
},
"required": [
"approvalToBeSigned",
"approverPublicKey",
"detailLevel",
"id",
"metaData",
"metaDataSignature",
"payload",
"payloadType",
"requestBase64",
"signedBlockKeyRequest",
"signedCertificateRequestRequest",
"signedDecapsulationRequest",
"signedDecryptRequest",
"signedModifyKeyRequest",
"signedSelfSignCertificateRequestDto",
"signedSignCertificateRequest",
"signedSignRequest",
"signedUnblockKeyRequest",
"signedUnwrapKeyRequest"
]
},
"TaskLevel4": {
"allOf": [
{
"$ref": "#/components/schemas/TaskLevel"
},
{
"type": "object",
"properties": {
"approvalToBeSigned": {
"type": "string",
"format": "base64",
"description": "Already prepared ready to sign serialization of the approval token. The approvalToBeSigned is a binary structure with the following format.
Example:
Base64: /AAAADsABAABAAAAAhApAFRFU1RLRVkyMDIwLTAzLTE2XzEwLTQxLTA2LjM4NDY2MDA0MzcxMDAwAAAAVBBEAEAAAABXEBYAQXBwcm92ZVNpZ25UYXNrUGF5bG9hZAAABwEIALRJb14AAAAAAhASAHRlc3QtdGltZXN0YW1wLWtleQAAVhBbADBZMAwGCCqGSM49BAMCBQADSQAwRgIhAKLnz8NtSThbVkSMjj8Zwl45vmyQ4bL/XMbLxV0RYa5mAiEAudcZnBwJ8SAXvTpcgvbP4wPbID8/Ia+vmcoRqAlXjlkAVxAWAEFwcHJvdmVTaWduVGFza1BheWxvYWQAAA==
Hex: FC0000003B0004000100000002102900544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000541044004000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B6579000056105B003059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E590057101600417070726F76655369676E5461736B5061796C6F61640000
FC000000
length: 252byte
3B00
type: 59d = EkaOperation
0400
length: = 4byte
01000000
data: Operation Type: \"OPERATION\", could also be \"BLOCK\", \"UNBLOCK\" or \"MODIFY\"
0210
type: 4098d = LabelUtf8String
2900
length: 41byte
544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000
data: label of the key = \"TESTKEY2020-03-16_10-41-06.38466004371000\" (incl. padding for 4byte alignment)
5410
type: 4180d = EkaTimeStamp
4400
length: 68byte
4000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B65790000
data: timestamp (see CertificateDetailLevel4 for details)
5610
type: 4182d = DerSignature
5B00
length: 91byte
3059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E5900
data: signature of the timestamp (see CertificateDetailLevel4 for details)
5710
type: 4183d = EkaSignPayload (could also be EkaModifyPayload)
1600
length: 22bytes
417070726F76655369676E5461736B5061796C6F61640000
data: the payload to be signed"
},
"approverPublicKey": {
"type": "string",
"description": "The public key of the approver for whom the task was created."
},
"metaData": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"payload": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The operand of the requested operation, base64 encoded. Its content depends on the task type: message to sign (sign), ciphertext to decrypt (decrypt), TLV-encoded policy (modify), DER TBSCertificate (self-sign), or DER CertificationRequestInfo (CSR). Null for operations without an operand, such as block and unblock."
},
"payloadType": {
"description": "The type of the payload for sign tasks. Null for other task types.",
"oneOf": [
{
"$ref": "#/components/schemas/PayloadType"
},
{
"type": "null"
}
]
},
"requestBase64": {
"type": "string",
"format": "base64",
"description": "The original request as sent by the caller, base64 encoded. To be used for signature verification."
},
"signedSignRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSignRequestDto"
},
{
"type": "null"
}
]
},
"signedModifyKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedModifyKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedBlockKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedBlockKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedUnblockKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedUnblockKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedDecryptRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedDecryptRequestDto"
},
{
"type": "null"
}
]
},
"signedUnwrapKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedUnwrapKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedDecapsulationRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedDecapsulationRequestDto"
},
{
"type": "null"
}
]
},
"signedCertificateRequestRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedCertificateRequestRequestDto"
},
{
"type": "null"
}
]
},
"signedSignCertificateRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSignCertificateRequestDto"
},
{
"type": "null"
}
]
},
"signedSelfSignCertificateRequestDto": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSelfSignCertificateRequestDto"
},
{
"type": "null"
}
]
},
"timestamp": {
"type": "string",
"format": "base64",
"description": "Timestamp as provided by the HSM. For timestamps a TLV (type length value) format is used. See the following example on how to decode a timestamp provided by the HSM. Please note that little endian encoding is used and padding is 4 byte.
Example:
64 00 00 00
length 100 byte
57 10
type 0x1057=EkaUsagePayload (could also be 0x1058 EkaModifyPayload)
16 00
length=22 byte
54 68 69 73 49 73 4A 75 73 74 41 50 61 79 6C 6F 61 64 54 65 73 74
payload
00 00
padding
0701
type 0x0107=Seconds since epoch
0800
length 8 byte
82 CE 5F 5E 00 00 00 00
seconds since epoch
0210
type 0x1002=LABEL_UTF8
3500
length 53 byte
696E746567726974794B65794E616D652D35656431303438662D353864372D346237302D386166342D643363333735666239636337
label = 'integrityKeyName-5ed1048f-58d7-4b70-8af4-d3c375fb9cc7'
000000
padding"
},
"timestampSignature": {
"type": "string",
"format": "base64",
"description": "Signature of the timestamp as provided by the HSM (using integrity key). Signature is DER encoded and can directly be used in e.g. the Java signature verifier.
Example (ECDSA):
echo \"MEYCIQCx7KRl7jrxsiNfMQ19ltO0/0sbFsQY1fMvJ7SXfCrDnwIhAOgGm3Un8QQA9vreOB62/lo+Dgs5EoZzWhcjZ4/6OQyN\" | base64 -D | openssl asn1parse -inform DER -i
0:d=0 hl=2 l= 70 cons: SEQUENCE
2:d=1 hl=2 l= 33 prim: INTEGER :B1ECA465EE3AF1B2235F310D7D96D3B4FF4B1B16C418D5F32F27B4977C2AC39F
37:d=1 hl=2 l= 33 prim: INTEGER :E8069B7527F10400F6FADE381EB6FE5A3E0E0B391286735A1723678FFA390C8D"
},
"timestampSignatureAlgorithm": {
"$ref": "#/components/schemas/SignatureAlgorithm",
"description": "The algorithm that was used to sign the timestamp"
},
"timestampSignatureWithAlgorithm": {
"type": "string",
"format": "base64",
"description": "DER encoded signature of the timestamp including the algorithm used. This representation is expected as part of the approval token signed by the approver. It is a combination of 'timestampSignature' and 'timestampSignatureAlgorithm' and provided for convenience.
Example (ECDSA)
echo \"MFkwDAYIKoZIzj0EAwIFAANJADBGAiEAseykZe468bIjXzENfZbTtP9LGxbEGNXzLye0l3wqw58CIQDoBpt1J/EEAPb63jgetv5aPg4LORKGc1oXI2eP+jkMjQ==\" | base64 -D | openssl asn1parse -inform DER -i
0:d=0 hl=2 l= 89 cons: SEQUENCE
2:d=1 hl=2 l= 12 cons: SEQUENCE
4:d=2 hl=2 l= 8 prim: OBJECT :ecdsa-with-SHA256
14:d=2 hl=2 l= 0 prim: NULL
16:d=1 hl=2 l= 73 prim: BIT STRING"
}
}
}
],
"description": "Detail level 4: level 3 fields plus timestamp, timestampSignature, timestampSignatureAlgorithm, and timestampSignatureWithAlgorithm.",
"properties": {
"detailLevel": {
"type": "string",
"enum": [
"level4"
]
}
},
"required": [
"approvalToBeSigned",
"approverPublicKey",
"detailLevel",
"id",
"metaData",
"metaDataSignature",
"payload",
"payloadType",
"requestBase64",
"signedBlockKeyRequest",
"signedCertificateRequestRequest",
"signedDecapsulationRequest",
"signedDecryptRequest",
"signedModifyKeyRequest",
"signedSelfSignCertificateRequestDto",
"signedSignCertificateRequest",
"signedSignRequest",
"signedUnblockKeyRequest",
"signedUnwrapKeyRequest",
"timestamp",
"timestampSignature",
"timestampSignatureAlgorithm",
"timestampSignatureWithAlgorithm"
]
},
"TaskLevel5": {
"allOf": [
{
"$ref": "#/components/schemas/TaskLevel"
},
{
"type": "object",
"properties": {
"approvalToBeSigned": {
"type": "string",
"format": "base64",
"description": "Already prepared ready to sign serialization of the approval token. The approvalToBeSigned is a binary structure with the following format.
Example:
Base64: /AAAADsABAABAAAAAhApAFRFU1RLRVkyMDIwLTAzLTE2XzEwLTQxLTA2LjM4NDY2MDA0MzcxMDAwAAAAVBBEAEAAAABXEBYAQXBwcm92ZVNpZ25UYXNrUGF5bG9hZAAABwEIALRJb14AAAAAAhASAHRlc3QtdGltZXN0YW1wLWtleQAAVhBbADBZMAwGCCqGSM49BAMCBQADSQAwRgIhAKLnz8NtSThbVkSMjj8Zwl45vmyQ4bL/XMbLxV0RYa5mAiEAudcZnBwJ8SAXvTpcgvbP4wPbID8/Ia+vmcoRqAlXjlkAVxAWAEFwcHJvdmVTaWduVGFza1BheWxvYWQAAA==
Hex: FC0000003B0004000100000002102900544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000541044004000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B6579000056105B003059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E590057101600417070726F76655369676E5461736B5061796C6F61640000
FC000000
length: 252byte
3B00
type: 59d = EkaOperation
0400
length: = 4byte
01000000
data: Operation Type: \"OPERATION\", could also be \"BLOCK\", \"UNBLOCK\" or \"MODIFY\"
0210
type: 4098d = LabelUtf8String
2900
length: 41byte
544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000
data: label of the key = \"TESTKEY2020-03-16_10-41-06.38466004371000\" (incl. padding for 4byte alignment)
5410
type: 4180d = EkaTimeStamp
4400
length: 68byte
4000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B65790000
data: timestamp (see CertificateDetailLevel4 for details)
5610
type: 4182d = DerSignature
5B00
length: 91byte
3059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E5900
data: signature of the timestamp (see CertificateDetailLevel4 for details)
5710
type: 4183d = EkaSignPayload (could also be EkaModifyPayload)
1600
length: 22bytes
417070726F76655369676E5461736B5061796C6F61640000
data: the payload to be signed"
},
"approverPublicKey": {
"type": "string",
"description": "The public key of the approver for whom the task was created."
},
"metaData": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"payload": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The operand of the requested operation, base64 encoded. Its content depends on the task type: message to sign (sign), ciphertext to decrypt (decrypt), TLV-encoded policy (modify), DER TBSCertificate (self-sign), or DER CertificationRequestInfo (CSR). Null for operations without an operand, such as block and unblock."
},
"payloadType": {
"description": "The type of the payload for sign tasks. Null for other task types.",
"oneOf": [
{
"$ref": "#/components/schemas/PayloadType"
},
{
"type": "null"
}
]
},
"requestBase64": {
"type": "string",
"format": "base64",
"description": "The original request as sent by the caller, base64 encoded. To be used for signature verification."
},
"signedSignRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSignRequestDto"
},
{
"type": "null"
}
]
},
"signedModifyKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedModifyKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedBlockKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedBlockKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedUnblockKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedUnblockKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedDecryptRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedDecryptRequestDto"
},
{
"type": "null"
}
]
},
"signedUnwrapKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedUnwrapKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedDecapsulationRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedDecapsulationRequestDto"
},
{
"type": "null"
}
]
},
"signedCertificateRequestRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedCertificateRequestRequestDto"
},
{
"type": "null"
}
]
},
"signedSignCertificateRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSignCertificateRequestDto"
},
{
"type": "null"
}
]
},
"signedSelfSignCertificateRequestDto": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSelfSignCertificateRequestDto"
},
{
"type": "null"
}
]
},
"timestamp": {
"type": "string",
"format": "base64",
"description": "Timestamp as provided by the HSM. For timestamps a TLV (type length value) format is used. See the following example on how to decode a timestamp provided by the HSM. Please note that little endian encoding is used and padding is 4 byte.
Example:
64 00 00 00
length 100 byte
57 10
type 0x1057=EkaUsagePayload (could also be 0x1058 EkaModifyPayload)
16 00
length=22 byte
54 68 69 73 49 73 4A 75 73 74 41 50 61 79 6C 6F 61 64 54 65 73 74
payload
00 00
padding
0701
type 0x0107=Seconds since epoch
0800
length 8 byte
82 CE 5F 5E 00 00 00 00
seconds since epoch
0210
type 0x1002=LABEL_UTF8
3500
length 53 byte
696E746567726974794B65794E616D652D35656431303438662D353864372D346237302D386166342D643363333735666239636337
label = 'integrityKeyName-5ed1048f-58d7-4b70-8af4-d3c375fb9cc7'
000000
padding"
},
"timestampSignature": {
"type": "string",
"format": "base64",
"description": "Signature of the timestamp as provided by the HSM (using integrity key). Signature is DER encoded and can directly be used in e.g. the Java signature verifier.
Example (ECDSA):
echo \"MEYCIQCx7KRl7jrxsiNfMQ19ltO0/0sbFsQY1fMvJ7SXfCrDnwIhAOgGm3Un8QQA9vreOB62/lo+Dgs5EoZzWhcjZ4/6OQyN\" | base64 -D | openssl asn1parse -inform DER -i
0:d=0 hl=2 l= 70 cons: SEQUENCE
2:d=1 hl=2 l= 33 prim: INTEGER :B1ECA465EE3AF1B2235F310D7D96D3B4FF4B1B16C418D5F32F27B4977C2AC39F
37:d=1 hl=2 l= 33 prim: INTEGER :E8069B7527F10400F6FADE381EB6FE5A3E0E0B391286735A1723678FFA390C8D"
},
"timestampSignatureAlgorithm": {
"$ref": "#/components/schemas/SignatureAlgorithm",
"description": "The algorithm that was used to sign the timestamp"
},
"timestampSignatureWithAlgorithm": {
"type": "string",
"format": "base64",
"description": "DER encoded signature of the timestamp including the algorithm used. This representation is expected as part of the approval token signed by the approver. It is a combination of 'timestampSignature' and 'timestampSignatureAlgorithm' and provided for convenience.
Example (ECDSA)
echo \"MFkwDAYIKoZIzj0EAwIFAANJADBGAiEAseykZe468bIjXzENfZbTtP9LGxbEGNXzLye0l3wqw58CIQDoBpt1J/EEAPb63jgetv5aPg4LORKGc1oXI2eP+jkMjQ==\" | base64 -D | openssl asn1parse -inform DER -i
0:d=0 hl=2 l= 89 cons: SEQUENCE
2:d=1 hl=2 l= 12 cons: SEQUENCE
4:d=2 hl=2 l= 8 prim: OBJECT :ecdsa-with-SHA256
14:d=2 hl=2 l= 0 prim: NULL
16:d=1 hl=2 l= 73 prim: BIT STRING"
},
"keyAttributes": {
"type": "string",
"format": "xml",
"description": "The key attributes for the operation key as plain XML text. This value is not base64 encoded."
},
"keyAttributesSignature": {
"type": "string",
"format": "base64",
"description": "Signature for the key attributes as provided by the HSM (base64 encoded)."
}
}
}
],
"description": "Detail level 5: level 4 fields plus keyAttributes and keyAttributesSignature. Fetching these fields may query the HSM and must not be used for HSM-independent or multi-tenant task retrieval. Use levels level1 through level4 in those modes.",
"properties": {
"detailLevel": {
"type": "string",
"enum": [
"level5"
]
}
},
"required": [
"approvalToBeSigned",
"approverPublicKey",
"detailLevel",
"id",
"keyAttributes",
"keyAttributesSignature",
"metaData",
"metaDataSignature",
"payload",
"payloadType",
"requestBase64",
"signedBlockKeyRequest",
"signedCertificateRequestRequest",
"signedDecapsulationRequest",
"signedDecryptRequest",
"signedModifyKeyRequest",
"signedSelfSignCertificateRequestDto",
"signedSignCertificateRequest",
"signedSignRequest",
"signedUnblockKeyRequest",
"signedUnwrapKeyRequest",
"timestamp",
"timestampSignature",
"timestampSignatureAlgorithm",
"timestampSignatureWithAlgorithm"
]
},
"TaskLevel6": {
"allOf": [
{
"$ref": "#/components/schemas/TaskLevel"
},
{
"type": "object",
"properties": {
"approvalToBeSigned": {
"type": "string",
"format": "base64",
"description": "Already prepared ready to sign serialization of the approval token. The approvalToBeSigned is a binary structure with the following format.
Example:
Base64: /AAAADsABAABAAAAAhApAFRFU1RLRVkyMDIwLTAzLTE2XzEwLTQxLTA2LjM4NDY2MDA0MzcxMDAwAAAAVBBEAEAAAABXEBYAQXBwcm92ZVNpZ25UYXNrUGF5bG9hZAAABwEIALRJb14AAAAAAhASAHRlc3QtdGltZXN0YW1wLWtleQAAVhBbADBZMAwGCCqGSM49BAMCBQADSQAwRgIhAKLnz8NtSThbVkSMjj8Zwl45vmyQ4bL/XMbLxV0RYa5mAiEAudcZnBwJ8SAXvTpcgvbP4wPbID8/Ia+vmcoRqAlXjlkAVxAWAEFwcHJvdmVTaWduVGFza1BheWxvYWQAAA==
Hex: FC0000003B0004000100000002102900544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000541044004000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B6579000056105B003059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E590057101600417070726F76655369676E5461736B5061796C6F61640000
FC000000
length: 252byte
3B00
type: 59d = EkaOperation
0400
length: = 4byte
01000000
data: Operation Type: \"OPERATION\", could also be \"BLOCK\", \"UNBLOCK\" or \"MODIFY\"
0210
type: 4098d = LabelUtf8String
2900
length: 41byte
544553544B4559323032302D30332D31365F31302D34312D30362E3338343636303034333731303030000000
data: label of the key = \"TESTKEY2020-03-16_10-41-06.38466004371000\" (incl. padding for 4byte alignment)
5410
type: 4180d = EkaTimeStamp
4400
length: 68byte
4000000057101600417070726F76655369676E5461736B5061796C6F6164000007010800B4496F5E0000000002101200746573742D74696D657374616D702D6B65790000
data: timestamp (see CertificateDetailLevel4 for details)
5610
type: 4182d = DerSignature
5B00
length: 91byte
3059300C06082A8648CE3D04030205000349003046022100A2E7CFC36D49385B56448C8E3F19C25E39BE6C90E1B2FF5CC6CBC55D1161AE66022100B9D7199C1C09F12017BD3A5C82F6CFE303DB203F3F21AFAF99CA11A809578E5900
data: signature of the timestamp (see CertificateDetailLevel4 for details)
5710
type: 4183d = EkaSignPayload (could also be EkaModifyPayload)
1600
length: 22bytes
417070726F76655369676E5461736B5061796C6F61640000
data: the payload to be signed"
},
"approverPublicKey": {
"type": "string",
"description": "The public key of the approver for whom the task was created."
},
"metaData": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
},
"payload": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The operand of the requested operation, base64 encoded. Its content depends on the task type: message to sign (sign), ciphertext to decrypt (decrypt), TLV-encoded policy (modify), DER TBSCertificate (self-sign), or DER CertificationRequestInfo (CSR). Null for operations without an operand, such as block and unblock."
},
"payloadType": {
"description": "The type of the payload for sign tasks. Null for other task types.",
"oneOf": [
{
"$ref": "#/components/schemas/PayloadType"
},
{
"type": "null"
}
]
},
"requestBase64": {
"type": "string",
"format": "base64",
"description": "The original request as sent by the caller, base64 encoded. To be used for signature verification."
},
"signedSignRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSignRequestDto"
},
{
"type": "null"
}
]
},
"signedModifyKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedModifyKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedBlockKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedBlockKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedUnblockKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedUnblockKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedDecryptRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedDecryptRequestDto"
},
{
"type": "null"
}
]
},
"signedUnwrapKeyRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedUnwrapKeyRequestDto"
},
{
"type": "null"
}
]
},
"signedDecapsulationRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedDecapsulationRequestDto"
},
{
"type": "null"
}
]
},
"signedCertificateRequestRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedCertificateRequestRequestDto"
},
{
"type": "null"
}
]
},
"signedSignCertificateRequest": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSignCertificateRequestDto"
},
{
"type": "null"
}
]
},
"signedSelfSignCertificateRequestDto": {
"oneOf": [
{
"$ref": "#/components/schemas/SignedSelfSignCertificateRequestDto"
},
{
"type": "null"
}
]
},
"timestamp": {
"type": "string",
"format": "base64",
"description": "Timestamp as provided by the HSM. For timestamps a TLV (type length value) format is used. See the following example on how to decode a timestamp provided by the HSM. Please note that little endian encoding is used and padding is 4 byte.
Example:
64 00 00 00
length 100 byte
57 10
type 0x1057=EkaUsagePayload (could also be 0x1058 EkaModifyPayload)
16 00
length=22 byte
54 68 69 73 49 73 4A 75 73 74 41 50 61 79 6C 6F 61 64 54 65 73 74
payload
00 00
padding
0701
type 0x0107=Seconds since epoch
0800
length 8 byte
82 CE 5F 5E 00 00 00 00
seconds since epoch
0210
type 0x1002=LABEL_UTF8
3500
length 53 byte
696E746567726974794B65794E616D652D35656431303438662D353864372D346237302D386166342D643363333735666239636337
label = 'integrityKeyName-5ed1048f-58d7-4b70-8af4-d3c375fb9cc7'
000000
padding"
},
"timestampSignature": {
"type": "string",
"format": "base64",
"description": "Signature of the timestamp as provided by the HSM (using integrity key). Signature is DER encoded and can directly be used in e.g. the Java signature verifier.
Example (ECDSA):
echo \"MEYCIQCx7KRl7jrxsiNfMQ19ltO0/0sbFsQY1fMvJ7SXfCrDnwIhAOgGm3Un8QQA9vreOB62/lo+Dgs5EoZzWhcjZ4/6OQyN\" | base64 -D | openssl asn1parse -inform DER -i
0:d=0 hl=2 l= 70 cons: SEQUENCE
2:d=1 hl=2 l= 33 prim: INTEGER :B1ECA465EE3AF1B2235F310D7D96D3B4FF4B1B16C418D5F32F27B4977C2AC39F
37:d=1 hl=2 l= 33 prim: INTEGER :E8069B7527F10400F6FADE381EB6FE5A3E0E0B391286735A1723678FFA390C8D"
},
"timestampSignatureAlgorithm": {
"$ref": "#/components/schemas/SignatureAlgorithm",
"description": "The algorithm that was used to sign the timestamp"
},
"timestampSignatureWithAlgorithm": {
"type": "string",
"format": "base64",
"description": "DER encoded signature of the timestamp including the algorithm used. This representation is expected as part of the approval token signed by the approver. It is a combination of 'timestampSignature' and 'timestampSignatureAlgorithm' and provided for convenience.
Example (ECDSA)
echo \"MFkwDAYIKoZIzj0EAwIFAANJADBGAiEAseykZe468bIjXzENfZbTtP9LGxbEGNXzLye0l3wqw58CIQDoBpt1J/EEAPb63jgetv5aPg4LORKGc1oXI2eP+jkMjQ==\" | base64 -D | openssl asn1parse -inform DER -i
0:d=0 hl=2 l= 89 cons: SEQUENCE
2:d=1 hl=2 l= 12 cons: SEQUENCE
4:d=2 hl=2 l= 8 prim: OBJECT :ecdsa-with-SHA256
14:d=2 hl=2 l= 0 prim: NULL
16:d=1 hl=2 l= 73 prim: BIT STRING"
},
"keyAttributes": {
"type": "string",
"format": "xml",
"description": "The key attributes for the operation key as plain XML text. This value is not base64 encoded."
},
"keyAttributesSignature": {
"type": "string",
"format": "base64",
"description": "Signature for the key attributes as provided by the HSM (base64 encoded)."
},
"requestStatus": {
"$ref": "#/components/schemas/RequestStatusDto"
}
}
}
],
"description": "Detail level 6: level 5 fields plus requestStatus. Because it includes level 5 key attributes, it may query the HSM and must not be used for HSM-independent or multi-tenant task retrieval. Use levels level1 through level4 in those modes.",
"properties": {
"detailLevel": {
"type": "string",
"enum": [
"level6"
]
}
},
"required": [
"approvalToBeSigned",
"approverPublicKey",
"detailLevel",
"id",
"keyAttributes",
"keyAttributesSignature",
"metaData",
"metaDataSignature",
"payload",
"payloadType",
"requestBase64",
"requestStatus",
"signedBlockKeyRequest",
"signedCertificateRequestRequest",
"signedDecapsulationRequest",
"signedDecryptRequest",
"signedModifyKeyRequest",
"signedSelfSignCertificateRequestDto",
"signedSignCertificateRequest",
"signedSignRequest",
"signedUnblockKeyRequest",
"signedUnwrapKeyRequest",
"timestamp",
"timestampSignature",
"timestampSignatureAlgorithm",
"timestampSignatureWithAlgorithm"
]
},
"RequestIdsByStatusRequestDto": {
"type": "object",
"description": "Filter Requests by Status",
"properties": {
"requestStatusList": {
"type": "array",
"items": {
"$ref": "#/components/schemas/RequestStatus",
"default": "PENDING",
"description": "The requests to be filtered by Request Status"
}
}
}
},
"RequestByStatusDto": {
"type": "object",
"description": "Response containing information about the status of a request.",
"properties": {
"id": {
"type": "string",
"description": "The id of the request."
},
"status": {
"$ref": "#/components/schemas/RequestStatus",
"description": "The current status of the request."
}
}
},
"RequestIdsByStatusDto": {
"type": "object",
"description": "Response containing information about the filtered request status.",
"properties": {
"requests": {
"type": "array",
"items": {
"$ref": "#/components/schemas/RequestByStatusDto",
"description": "The pending requests"
}
}
}
},
"FileEncryptRequestDto": {
"type": "object",
"description": "File Encrypt request. Only supported by EC keys with curveOid: 1.3.132.0.34 and key-attribute: derive.",
"properties": {
"encryptKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the file shall be encrypted.",
"minLength": 1
}
},
"required": [
"encryptKeyName"
]
},
"SignedFileEncryptRequestDto": {
"type": "object",
"description": "Contains a file encryption request.",
"properties": {
"fileEncryptRequest": {
"$ref": "#/components/schemas/FileEncryptRequestDto"
}
},
"required": [
"fileEncryptRequest"
]
},
"EncryptRequestDto": {
"type": "object",
"description": "Encrypt request.",
"properties": {
"payload": {
"type": "string",
"format": "base64",
"description": "Payload (base64 encoded) that shall be encrypted.",
"minLength": 1
},
"encryptKeyName": {
"type": "string",
"default": "keyname",
"description": "Name of the key with which the payload shall be encrypted.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Password of the encrypt key. This is only necessary if the key algorithm is symmetric.",
"example": "string"
},
"cipherAlgorithm": {
"$ref": "#/components/schemas/CipherAlgorithm",
"description": "The cipher algorithm to be used."
},
"additionalAuthenticationData": {
"type": "string",
"format": "base64",
"description": "Additional authentication data (aad, base64 encoded) used for encryption with algorithm that support them."
},
"tagLength": {
"type": "integer",
"format": "int",
"description": "The MAC (Message Authentication Tag) is a fixed-length value as part of the AES-GCM encryption process, that is INCLUDED in the ciphertext and used to authenticatethe integrity of the data and the authenticity of the sender. \nSupported tag_length: 0, 64, 96, 104, 112, 120, 128"
}
},
"required": [
"cipherAlgorithm",
"encryptKeyName",
"payload"
]
},
"SignedEncryptRequestDto": {
"type": "object",
"description": "Contains an encrypt request and optionally the requests signature.",
"properties": {
"encryptRequest": {
"$ref": "#/components/schemas/EncryptRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"encryptRequest"
]
},
"EncryptRequestResponseDto": {
"type": "object",
"description": "Response for an encrypt request.",
"properties": {
"encryptedPayload": {
"type": "string",
"description": "The encrypted payload."
},
"encryptedPayloadWithoutMessageAuthenticationCode": {
"type": "string",
"description": "The encrypted payload without message authentication code (MAC) as part of the AES-GCM encryption process."
},
"initializationVector": {
"type": [
"string",
"null"
],
"description": "The initialization vector (base64 encoded) used to encrypt the payload. Is empty if the algorithm used does not require an initialization vector."
},
"messageAuthenticationCode": {
"type": [
"string",
"null"
],
"format": "base64",
"description": "The authenticationTag is a message authentication code (MAC) as part of the AES-GCM encryption process. It is used to ensure the integrity of the ciphertext and the additional authenticated data (AAD) passed to the encrypt operation. The MAC is part of the cipher text and is additionally returned here. The cipher text contains the MAC and must be truncated depending on the framework used."
},
"derivationValue": {
"type": "integer",
"format": "int64",
"description": "If the key supports rollover, this is the latest derivation value (used as salt) for the KDF used to encrypt the payload."
}
}
},
"EncapsulationRequestDto": {
"type": "object",
"properties": {
"publicKey": {
"type": "string",
"description": "The ML-KEM PublicKey used for encapsulating the generated shared-secret.",
"minLength": 1
}
},
"required": [
"publicKey"
]
},
"EncapsulationResponseDto": {
"type": "object",
"description": "Response payload for a key‑encapsulation operation.",
"properties": {
"sharedSecret": {
"type": "string",
"description": "Base64‑encoded shared secret."
},
"ciphertext": {
"type": "string",
"description": "The encapsulated key."
}
}
},
"DeriveKeyAttributes": {
"type": "object",
"description": "The attributes of the derived key. The attributes from the base key are fetched and applied if no attributes are specified.",
"properties": {
"decrypt": {
"type": "boolean",
"description": "If true the key can be used to decrypt data."
},
"sign": {
"type": "boolean",
"description": "If true the key can sign."
},
"unwrap": {
"type": "boolean",
"description": "If true the key can be used to unwrap keys."
},
"derive": {
"type": "boolean",
"default": false,
"description": "If true it is possible to derive from this key."
},
"extractable": {
"type": "boolean",
"default": false,
"description": "If true the key is extractable. This option can only be true for keys without smart key attributes."
},
"modifiable": {
"type": "boolean",
"default": true,
"description": "If true the key can be modified. The derived key can not be modifiable if the base key is not modifiable"
},
"destroyable": {
"type": "boolean",
"default": false,
"description": "If true the key can be deleted."
},
"sensitive": {
"type": "boolean",
"description": "If true the key is sensitive. To export a key sensitive must be false"
}
},
"required": [
"decrypt",
"sign",
"unwrap"
]
},
"DeriveKeyDto": {
"type": "object",
"description": "Derive key request.",
"properties": {
"masterKeyLabel": {
"type": "string",
"default": "masterKeyName",
"description": "The name of the master key.",
"minLength": 1
},
"masterKeyPassword": {
"type": "string",
"description": "The password of the master key, if the master key has a password set.",
"example": "string"
},
"derivedKeyPassword": {
"type": "string",
"description": "(Optional) The password to set on the persisted derived key.",
"example": "string"
},
"derivationPath": {
"type": "string",
"default": "1/2/3",
"description": "BIP32 / SLIP10 derivation path to be used (without leading /)",
"example": "1/2/3",
"minLength": 1
},
"attributes": {
"$ref": "#/components/schemas/DeriveKeyAttributes"
}
},
"required": [
"derivationPath",
"masterKeyLabel"
]
},
"DecryptRequestResponseDto": {
"type": "object",
"description": "Response for a decrypt request.",
"properties": {
"decryptRequestId": {
"type": "string",
"description": "The id that has been assigned to the decrypt request."
}
}
},
"DecapsulationRequestResponseDto": {
"type": "object",
"description": "Response for a decapsulation request.",
"properties": {
"decapsulationRequestId": {
"type": "string",
"description": "The id that has been assigned to the decapsulation request."
}
}
},
"DataObjectAttributes": {
"type": "object",
"description": "The attributes of a data object.",
"properties": {
"modifiable": {
"type": "boolean",
"description": "If true the data object can be modified."
},
"destroyable": {
"type": "boolean",
"description": "If true the data object can be deleted."
},
"private": {
"type": "boolean",
"description": "If true the data object is encrypted"
}
}
},
"DataObjectDto": {
"type": "object",
"description": "Data object",
"properties": {
"name": {
"type": "string",
"description": "The name of the data object.",
"minLength": 1
},
"value": {
"type": "string",
"format": "base64",
"description": "The value (base64 encoded) of the data object. The maximum size of the value is 64 kilobytes.",
"minLength": 1
},
"attributes": {
"$ref": "#/components/schemas/DataObjectAttributes"
},
"kmip": {
"$ref": "#/components/schemas/DataObjectKmip"
}
},
"required": [
"name",
"value"
]
},
"DataObjectKmip": {
"type": "object",
"description": "The KMIP attributes of a data object.",
"properties": {
"dataObjectType": {
"type": [
"string",
"null"
],
"description": "The KMIP data object type. The maximum size of the value is 65280 bytes (UTF-8)."
}
}
},
"CreateRfcTimestampDto": {
"type": "object",
"description": "Create a RFC3161 timestamp.",
"properties": {
"payload": {
"type": "string",
"format": "base64",
"description": "The payload for which the timestamp should be created.",
"minLength": 1
},
"hashAlgorithm": {
"type": "string",
"description": "The hash algorithm to use for creating the timestamp.",
"example": "SHA256",
"minLength": 1
}
},
"required": [
"hashAlgorithm",
"payload"
]
},
"RfcTimestampDto": {
"type": "object",
"description": "Create RFC timestamp response",
"properties": {
"timestamp": {
"type": "string",
"description": "The RFC3161 timestamp created by the HSM (base64 encoded)."
}
}
},
"SynchronousSignCertificateRequestDto": {
"type": "object",
"description": "Generates a valid x509 certificate.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The name of the key.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/KeytoolSignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The signature algorithm to be used. The chosen algorithm has to be compatible with the type of the key referenced by the signKeyName.",
"example": "SHA256_WITH_RSA"
},
"standardCertificateAttributes": {
"$ref": "#/components/schemas/CertificateAttributesDto",
"description": "The standard certificate request attributes for X.500 series"
},
"validity": {
"type": "integer",
"format": "int32",
"description": "The days from today after which the certificate is not valid. e.g. 365 //valid for 1 year."
},
"copyExtensions": {
"$ref": "#/components/schemas/CopyExtensions",
"default": "no_copy",
"description": "The copyExtensions option should be used with caution. If care is not taken then it can be a security risk. COPY copies extensions without basicConstraints, this because for example if a certificate request contains a basicConstraints extension with CA:TRUE and the user does not spot this when the certificate is displayed then this will hand the requester a valid CA certificate. NO_COPY request does not copy the extensions from the CSR."
},
"certificateSigningRequest": {
"type": "string",
"format": "pem",
"description": "The PEM-encoded certificate signing request (CSR), including its BEGIN and END markers."
},
"keyUsage": {
"type": "array",
"description": "KeyUsage is set if copyExtensions = NO_COPY.The key usage extension defines the purpose (for example, encipherment, signature, or certificate signing) of the key contained in the certificate. If the public key is used for entity authentication, then the certificate extension should have the key usage Digital signature.",
"items": {
"$ref": "#/components/schemas/KeyUsage"
}
},
"extendedKeyUsage": {
"type": "array",
"description": "ExtendedKeyUsage is set if copyExtensions = NO_COPY. This extension indicates one or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension. In general, this extension will appear only in end entity certificates.",
"items": {
"$ref": "#/components/schemas/ExtendedKeyUsage"
}
},
"subjectAlternativeNames": {
"type": "array",
"description": "Subject Alternative Name (SAN) is set if copyExtensions = NO_COPY.The Subject Alternative Name (SAN) is an extension to the X.509 standard that allows a single certificate to secure multiple hostnames, IP addresses, or other identifiers. It is used by clients to verify that the presented certificate is valid for the server they are connecting to. Sample: SAN=dns:my-primary-host.example.com,dns:*.api.example.com,dns:localhost,ip:192.168.1.10,ip:127.0.0.1,ip:::1,uri:https://service.example.com/endpoint,email:admin@example.com,rid:1.2.3.4",
"items": {
"$ref": "#/components/schemas/SubjectAlternativeName"
}
},
"certificateAuthority": {
"type": "boolean"
}
},
"required": [
"certificateSigningRequest",
"signKeyName",
"signatureAlgorithm",
"validity"
]
},
"CertificateResponseDto": {
"type": "object",
"description": "Response containing the certificate.",
"properties": {
"label": {
"type": "string",
"description": "The name of the key a certificate is attached to."
},
"certificate": {
"type": "string",
"format": "pem",
"description": "The PEM-encoded X.509 certificate, including the BEGIN CERTIFICATE and END CERTIFICATE markers."
}
}
},
"SynchronousRolloverSelfSignCertificateRequestDto": {
"type": "object",
"description": "Rollover Self-Signed Certificate request with Smart Key Attributes.",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
}
},
"required": [
"label"
]
},
"SynchronousRolloverCertificateSigningRequestDto": {
"type": "object",
"description": "Rollover CSR request",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The name of the key for which CSR will be provided.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
}
},
"required": [
"signKeyName"
]
},
"RolloverCsrResponseDto": {
"type": "object",
"description": "Response containing the CSR to be signed.",
"properties": {
"certificateSigningRequest": {
"type": "string",
"format": "pem",
"description": "The generated PEM-encoded certificate signing request (CSR), including its BEGIN and END markers."
}
}
},
"SynchronousCertificateRequestRequestDto": {
"type": "object",
"description": "Create a certificate request.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The name of the key used to sign the certificate request.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"signatureAlgorithm": {
"$ref": "#/components/schemas/KeytoolSignatureAlgorithm",
"default": "SHA256_WITH_RSA",
"description": "The signature algorithm to be used. The chosen algorithm has to be compatible with the type of the key referenced by the signKeyName.",
"example": "SHA256_WITH_RSA"
},
"standardCertificateAttributes": {
"$ref": "#/components/schemas/CertificateAttributesDto",
"description": "The standard certificate request attributes for X.500 series"
},
"keyUsage": {
"type": "array",
"description": "The key usage extension defines the purpose (for example, encipherment, signature, or certificate signing) of the key contained in the certificate. If the public key is used for entity authentication, then the certificate extension should have the key usage Digital signature.",
"items": {
"$ref": "#/components/schemas/KeyUsage"
}
},
"extendedKeyUsage": {
"type": "array",
"description": "This extension indicates one or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension. In general, this extension will appear only in end entity certificates.",
"items": {
"$ref": "#/components/schemas/ExtendedKeyUsage"
}
},
"subjectAlternativeNames": {
"type": "array",
"description": "The Subject Alternative Name (SAN) is an extension to the X.509 standard that allows a single certificate to secure multiple hostnames, IP addresses, or other identifiers. It is used by clients to verify that the presented certificate is valid for the server they are connecting to. Sample: SAN=dns:my-primary-host.example.com,dns:*.api.example.com,dns:localhost,ip:192.168.1.10,ip:127.0.0.1,ip:::1,uri:https://service.example.com/endpoint,email:admin@example.com,rid:1.2.3.4",
"items": {
"$ref": "#/components/schemas/SubjectAlternativeName"
}
}
},
"required": [
"signKeyName",
"signatureAlgorithm",
"standardCertificateAttributes"
]
},
"CertificateRequestResponseDto": {
"type": "object",
"description": "Response containing the CSR to be signed.",
"properties": {
"label": {
"type": "string",
"description": "The name of the key the CSR is associated with."
},
"certificateSigningRequest": {
"type": "string",
"format": "pem",
"description": "The generated PEM-encoded certificate signing request (CSR), including its BEGIN and END markers."
}
}
},
"RolloverSelfSignCertificateRequestDto": {
"type": "object",
"description": "Rollover Self-Signed Certificate request with Smart Key Attributes.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The name of the key",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
}
},
"required": [
"signKeyName"
]
},
"SignedRolloverSelfSignCertificateRequestDto": {
"type": "object",
"description": "Rollover a self-signed x509 certificate (asynchronous). After the request was approved the x509 can be obtained with GET /v1/request/{id}",
"properties": {
"rolloverSelfSignCertificateRequest": {
"$ref": "#/components/schemas/RolloverSelfSignCertificateRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"rolloverSelfSignCertificateRequest"
]
},
"RolloverImportCertificateRequestDto": {
"type": "object",
"description": "Rollover import certificate request",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key for which certificate will be provided.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"certificate": {
"type": "string",
"format": "base64",
"description": "Certificate that should be set to the key.",
"minLength": 1
}
},
"required": [
"certificate",
"label"
]
},
"RolloverCsrSignRequestDto": {
"type": "object",
"description": "Rollover CSR request with Smart Key Attributes.",
"properties": {
"signKeyName": {
"type": "string",
"default": "keyname",
"description": "The name of the key for which CSR will be provided.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"metaData": {
"type": "string",
"format": "base64",
"description": "Base64-encoded metadata shown to the human or automated approval client to explain the request's intent. It is approval input, not merely audit-log data. Treat unsigned metadata as untrusted display text."
},
"metaDataSignature": {
"type": "string",
"format": "base64",
"description": "Base64-encoded signature over metaData, forwarded to the approval client so it can verify the displayed intent against a trusted or whitelisted signer. The field alone does not establish trust; verification and signer allow-list enforcement are the responsibility of the approval workflow."
}
},
"required": [
"signKeyName"
]
},
"SignedRolloverCertificateSigningRequestDto": {
"type": "object",
"description": "Rollover CSR request (asynchronous) for provided ska-key.",
"properties": {
"rolloverCsrSignRequest": {
"$ref": "#/components/schemas/RolloverCsrSignRequestDto"
},
"requestSignature": {
"$ref": "#/components/schemas/SignatureDto"
}
},
"required": [
"rolloverCsrSignRequest"
]
},
"CertificateListDto": {
"type": "object",
"description": "List Certificate in human-readable format.",
"properties": {
"detailLevel": {
"type": "string",
"default": "level1",
"description": "The detail level of the response.",
"enum": [
"level1",
"level2",
"level3",
"level4"
]
},
"filter": {
"$ref": "#/components/schemas/CertificateListFilterDto"
},
"paging": {
"$ref": "#/components/schemas/ListCertificatePagingDto"
}
}
},
"CertificateListFilterDto": {
"type": "object",
"description": "Filter Certificate response by certificate attributes. All attributes are (AND) associated.",
"properties": {
"keyName": {
"type": "string",
"default": "keyname",
"description": "(optional) Filter response by a given keyName (fetches the certificate information for a specific key)"
},
"subject": {
"type": "string",
"description": "(optional) Filter response by the subject of the certificate (fetches the certificate information for a given subject)"
},
"issuer": {
"type": "string",
"description": "(optional) Filter response by the issuer of the certificate (fetches the certificate information for a given issuer)"
},
"showCACertificatesOnly": {
"type": "boolean",
"description": "(optional) Filter response to only show CA certificates [basicConstraint: CA=true]"
},
"publicKeyAlgorithm": {
"type": "string",
"description": "(optional) Filter response by the key algorithm of the certificate. (RSA, EC, ..)"
},
"showPrimusX509Certificate": {
"type": "boolean",
"default": false,
"description": "(optional) Include default PrimusX509Certificate in response"
}
}
},
"ListCertificatePagingDto": {
"type": "object",
"description": "Metadata for enabling result paging",
"properties": {
"pageNumber": {
"type": "integer",
"format": "int32",
"description": "The number of the page of results to be returned.",
"minimum": 0
},
"pageSize": {
"type": "integer",
"format": "int32",
"default": 100,
"description": "The number of results to be returned per page",
"minimum": 1
},
"certificateExpiryOrder": {
"$ref": "#/components/schemas/SortOrder",
"description": "Sort order of the certificate expiry dates."
}
},
"required": [
"certificateExpiryOrder"
]
},
"Basicx509v3ExtensionsDto": {
"type": "object",
"description": "Basic certificate X.509v3 extensions.",
"properties": {
"keyUsage": {
"type": "array",
"description": "Key Usage (digitalSignature, keyEncipherment, etc.)",
"items": {
"type": "string"
}
},
"basicConstraints": {
"type": "string",
"description": "Basic Constraints (CA=true/false, path length)"
},
"subjectKeyIdentifier": {
"type": "string",
"description": "Subject Key Identifier (short hex string)"
},
"authorityKeyIdentifier": {
"type": "string",
"description": "Authority Key Identifier"
}
}
},
"CertificateDetailLevel1": {
"allOf": [
{
"$ref": "#/components/schemas/CertificateListLevel"
},
{
"type": "object",
"properties": {
"keyName": {
"type": "string",
"description": "The name of the key associated to the key."
},
"issuer": {
"type": "string",
"description": "The issuer of the certificate."
},
"subject": {
"type": "string",
"description": "The subject of the certificate."
},
"validity": {
"$ref": "#/components/schemas/CertificateValidityDto",
"description": "The validity period."
},
"serialNumber": {
"type": "integer",
"description": "The serial Number period."
},
"signatureAlgorithm": {
"type": "string",
"description": "The signature algorithm."
},
"rawCertificate": {
"type": "string",
"format": "pem",
"description": "The PEM-encoded X.509 certificate, including the BEGIN CERTIFICATE and END CERTIFICATE markers."
},
"detailLevel": {
"type": "string",
"description": "Certificate detail level.",
"enum": [
"level1"
],
"readOnly": true
}
}
}
],
"description": "Certificate with detail level 1. These are the fields that most people care about at a glance basically the “business card” portion of the certificate"
},
"CertificateDetailLevel2": {
"allOf": [
{
"$ref": "#/components/schemas/CertificateListLevel"
},
{
"type": "object",
"properties": {
"keyName": {
"type": "string",
"description": "The name of the key associated to the key."
},
"issuer": {
"type": "string",
"description": "The issuer of the certificate."
},
"subject": {
"type": "string",
"description": "The subject of the certificate."
},
"validity": {
"$ref": "#/components/schemas/CertificateValidityDto",
"description": "The validity period."
},
"serialNumber": {
"type": "integer",
"description": "The serial Number period."
},
"signatureAlgorithm": {
"type": "string",
"description": "The signature algorithm."
},
"rawCertificate": {
"type": "string",
"format": "pem",
"description": "The PEM-encoded X.509 certificate, including the BEGIN CERTIFICATE and END CERTIFICATE markers."
},
"version": {
"type": "integer",
"format": "int32",
"description": "version"
},
"subjectAlternativeNames": {
"type": "array",
"description": "Subject Alternative Name(s)",
"items": {
"$ref": "#/components/schemas/SubjectAlternativeName"
}
},
"publicKeyInformation": {
"$ref": "#/components/schemas/PublicKeyInformationDto",
"description": "Public Key information (public Key algorithm, key size)."
},
"subjectDistinguishedName": {
"type": "string",
"description": "Detailed subject distinguished name (O, OU, C, ..)"
},
"issuerDistinguishedName": {
"type": "string",
"description": "Detailed issuer distinguished name (O, OU, C, ..)"
},
"basicExtensions": {
"$ref": "#/components/schemas/Basicx509v3ExtensionsDto",
"description": "Basic X.509v3 Extensions"
},
"sha1": {
"type": "string",
"description": "SHA-1 Thumbprint"
},
"sha256": {
"type": "string",
"description": "SHA-256 Thumbprint"
},
"detailLevel": {
"type": "string",
"description": "Certificate detail level.",
"enum": [
"level2"
],
"readOnly": true
}
}
}
],
"description": "Certificate with detail level 2. These fields give you enough to do basic technical validations and to understand the cryptographic properties."
},
"CertificateDetailLevel3": {
"allOf": [
{
"$ref": "#/components/schemas/CertificateListLevel"
},
{
"type": "object",
"properties": {
"keyName": {
"type": "string",
"description": "The name of the key associated to the key."
},
"issuer": {
"type": "string",
"description": "The issuer of the certificate."
},
"subject": {
"type": "string",
"description": "The subject of the certificate."
},
"validity": {
"$ref": "#/components/schemas/CertificateValidityDto",
"description": "The validity period."
},
"serialNumber": {
"type": "integer",
"description": "The serial Number period."
},
"signatureAlgorithm": {
"type": "string",
"description": "The signature algorithm."
},
"rawCertificate": {
"type": "string",
"format": "pem",
"description": "The PEM-encoded X.509 certificate, including the BEGIN CERTIFICATE and END CERTIFICATE markers."
},
"version": {
"type": "integer",
"format": "int32",
"description": "version"
},
"subjectAlternativeNames": {
"type": "array",
"description": "Subject Alternative Name(s)",
"items": {
"$ref": "#/components/schemas/SubjectAlternativeName"
}
},
"publicKeyInformation": {
"$ref": "#/components/schemas/PublicKeyInformationDto",
"description": "Public Key information (public Key algorithm, key size)."
},
"subjectDistinguishedName": {
"type": "string",
"description": "Detailed subject distinguished name (O, OU, C, ..)"
},
"issuerDistinguishedName": {
"type": "string",
"description": "Detailed issuer distinguished name (O, OU, C, ..)"
},
"basicExtensions": {
"$ref": "#/components/schemas/Basicx509v3ExtensionsDto",
"description": "Basic X.509v3 Extensions"
},
"sha1": {
"type": "string",
"description": "SHA-1 Thumbprint"
},
"sha256": {
"type": "string",
"description": "SHA-256 Thumbprint"
},
"extendedKeyUsage": {
"type": "array",
"description": "extended key usage",
"items": {
"type": "string"
}
},
"detailLevel": {
"type": "string",
"description": "Certificate detail level.",
"enum": [
"level3"
],
"readOnly": true
}
}
}
],
"description": "Certificate with detail level 3. These fields cover deeper extension data, raw numeric values, and less commonly viewed fields. A typical PKI admin or developer might need them when troubleshooting or validating advanced constraints"
},
"CertificateDetailLevel4": {
"allOf": [
{
"$ref": "#/components/schemas/CertificateListLevel"
},
{
"type": "object",
"properties": {
"keyName": {
"type": "string",
"description": "The name of the key associated to the key."
},
"issuer": {
"type": "string",
"description": "The issuer of the certificate."
},
"subject": {
"type": "string",
"description": "The subject of the certificate."
},
"validity": {
"$ref": "#/components/schemas/CertificateValidityDto",
"description": "The validity period."
},
"serialNumber": {
"type": "integer",
"description": "The serial Number period."
},
"signatureAlgorithm": {
"type": "string",
"description": "The signature algorithm."
},
"rawCertificate": {
"type": "string",
"format": "pem",
"description": "The PEM-encoded X.509 certificate, including the BEGIN CERTIFICATE and END CERTIFICATE markers."
},
"version": {
"type": "integer",
"format": "int32",
"description": "version"
},
"subjectAlternativeNames": {
"type": "array",
"description": "Subject Alternative Name(s)",
"items": {
"$ref": "#/components/schemas/SubjectAlternativeName"
}
},
"publicKeyInformation": {
"$ref": "#/components/schemas/PublicKeyInformationDto",
"description": "Public Key information (public Key algorithm, key size)."
},
"subjectDistinguishedName": {
"type": "string",
"description": "Detailed subject distinguished name (O, OU, C, ..)"
},
"issuerDistinguishedName": {
"type": "string",
"description": "Detailed issuer distinguished name (O, OU, C, ..)"
},
"basicExtensions": {
"$ref": "#/components/schemas/Basicx509v3ExtensionsDto",
"description": "Basic X.509v3 Extensions"
},
"sha1": {
"type": "string",
"description": "SHA-1 Thumbprint"
},
"sha256": {
"type": "string",
"description": "SHA-256 Thumbprint"
},
"extendedKeyUsage": {
"type": "array",
"description": "extended key usage",
"items": {
"type": "string"
}
},
"rsaModulus": {
"type": "string",
"description": "modulus"
},
"exponent": {
"type": "string",
"description": "exponent"
},
"curveParameters": {
"type": "string",
"description": "curve parameters for (EC)"
},
"rawSignatureBytes": {
"type": "string",
"description": "rawSignatureBytes"
},
"detailLevel": {
"type": "string",
"description": "Certificate detail level.",
"enum": [
"level4"
],
"readOnly": true
}
}
}
],
"description": "Full raw data, debugging at the byte/ASN.1 level."
},
"CertificateListLevel": {
"type": "object",
"description": "Base Certificate Object",
"discriminator": {
"propertyName": "detailLevel"
},
"properties": {
"id": {
"type": "string",
"description": "Id of the certificate."
},
"detailLevel": {
"type": "string",
"description": "Certificate detail level.",
"enum": [
"level1",
"level2",
"level3",
"level4"
],
"readOnly": true
}
}
},
"CertificateListResponseDto": {
"type": "object",
"description": "Response containing the requested certificates with the specified detail level.",
"properties": {
"certificates": {
"type": "array",
"items": {
"description": "The requested certificates.",
"oneOf": [
{
"$ref": "#/components/schemas/CertificateListLevel"
},
{
"$ref": "#/components/schemas/CertificateDetailLevel1"
},
{
"$ref": "#/components/schemas/CertificateDetailLevel2"
},
{
"$ref": "#/components/schemas/CertificateDetailLevel3"
},
{
"$ref": "#/components/schemas/CertificateDetailLevel4"
}
]
}
}
}
},
"CertificateValidityDto": {
"type": "object",
"description": "Certificate Validity.",
"properties": {
"notBeforeUTC": {
"type": "string",
"format": "date-time",
"description": "not before, human readable (UTC)"
},
"notBefore": {
"type": "string",
"format": "date-time",
"description": "not before"
},
"notAfterUTC": {
"type": "string",
"format": "date-time",
"description": "not after, human readable (UTC)"
},
"notAfter": {
"type": "string",
"format": "date-time",
"description": "not after"
}
}
},
"PublicKeyInformationDto": {
"type": "object",
"description": "Public Key information (public Key algorithm, key size).",
"properties": {
"publicKeyAlgorithm": {
"type": "string",
"description": "The public key algorithm (RSA, EC, ..)"
},
"keySize": {
"type": "integer",
"format": "int32",
"description": "Key Size (2048 bits)"
},
"rawPublicKey": {
"type": "string",
"description": "The raw public-key."
}
}
},
"CertificateImportDto": {
"type": "object",
"description": "Certificate import request, the key must exist, if a certificate already exists (e.g. self-signed), it will be overridden",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the certificate.",
"minLength": 1
},
"certificate": {
"type": "string",
"format": "base64",
"description": "Certificate that should be set to the imported key"
}
},
"required": [
"label"
]
},
"ByokImportRequestDto": {
"type": "object",
"description": "BYOK import request.",
"properties": {
"byokOption": {
"$ref": "#/components/schemas/ByokOption",
"description": "Provider and import mode."
},
"inputData": {
"type": "string",
"description": "Input data for Azure BYOK import. Use base64 content or raw JSON text."
},
"wrappedKey": {
"type": "string",
"description": "Wrapped key for GENERIC/SERVICE_NOW/GOOGLE_CLOUD import (base64)."
},
"kekName": {
"type": "string",
"description": "KEK private key name on HSM (unwrap key).",
"minLength": 1
},
"kekPassword": {
"type": "string",
"description": "KEK private key password.",
"example": "string"
},
"keyName": {
"type": "string",
"description": "Target key name for the imported key.",
"minLength": 1
},
"keyPassword": {
"type": "string",
"description": "Target key password.",
"example": "string"
}
},
"required": [
"byokOption",
"kekName",
"keyName"
]
},
"ByokOption": {
"type": "string",
"enum": [
"AZURE_RSA",
"AZURE_EC",
"AZURE_AES",
"AWS_RSAES_OAEP_SHA_256",
"AWS_RSAES_OAEP_SHA_1",
"SALESFORCE_RSAES_OAEP_SHA_1",
"SALESFORCE_RSAES_OAEP_SHA_256",
"SERVICE_NOW",
"GOOGLE_CLOUD",
"GENERIC"
]
},
"ByokImportResponseDto": {
"type": "object",
"description": "BYOK import response.",
"properties": {
"keyName": {
"type": "string",
"description": "Name of the imported key on the HSM."
}
}
},
"ByokExportRequestDto": {
"type": "object",
"description": "BYOK export request metadata.",
"properties": {
"byokOption": {
"$ref": "#/components/schemas/ByokOption",
"description": "Provider and target BYOK format."
},
"byokKeyName": {
"type": "string",
"description": "Name of the BYOK key on the HSM. If it does not exist it will be created with provider defaults.",
"minLength": 1
},
"byokKeyPassword": {
"type": "string",
"description": "Password of the BYOK key.",
"example": "string"
},
"wrappingKeyIdentifier": {
"type": "string",
"description": "Optional provider wrapping-key identifier (used for Azure BYOK JSON kid)."
},
"derivation": {
"type": "string",
"description": "Salesforce-only: derivation string."
},
"validate": {
"type": "boolean",
"default": false,
"description": "Salesforce-only: validate certificate chains in the uploaded wrapping public key file (if certificates are provided)."
},
"shaOnHsm": {
"type": "boolean",
"default": false,
"description": "Salesforce-only: calculate SHA-256 directly on HSM."
}
},
"required": [
"byokKeyName",
"byokOption"
]
},
"ByokExportResponseDto": {
"type": "object",
"description": "BYOK export response.",
"properties": {
"wrappedKey": {
"type": "string",
"description": "Wrapped key material in base64 (for AWS/SALESFORCE/GENERIC/SERVICE_NOW/GOOGLE_CLOUD)."
},
"byokJson": {
"type": "string",
"description": "Azure BYOK JSON payload."
},
"hash": {
"type": "string",
"description": "Salesforce BYOK hash output in base64."
}
}
},
"BlockKeyRequestResponseDto": {
"type": "object",
"description": "Response to a block key request.",
"properties": {
"blockKeyRequestId": {
"type": "string",
"description": "The id that has been assigned to the block key request."
}
}
},
"ApproverRestoreWithPasswordKnownDto": {
"type": "object",
"description": "Restore the approver key identified by name and (optional) a new backup password.",
"properties": {
"approverName": {
"type": "string",
"description": "The name of the approver e.g. the e-mail address",
"minLength": 1
}
},
"required": [
"approverName"
]
},
"ApproverRestoreWithPasswordKnownResponseDto": {
"type": "object",
"description": "Response containing the OneTimeCode.",
"properties": {
"oneTimeCode": {
"type": "array",
"description": "The OneTimePassword used for authentication of the onboarding process",
"items": {
"type": "string"
},
"minItems": 1
}
},
"required": [
"oneTimeCode"
]
},
"ApproverRestoreWithPasswordUnknownDto": {
"type": "object",
"description": "Restore the approver key identified by name and (optional) a new backup password.",
"properties": {
"approverName": {
"type": "string",
"description": "The name of the approver e.g. the e-mail address",
"minLength": 1
},
"newBackupPassword": {
"type": "array",
"description": "A new backup password, in case the approver lost his password. (optional)",
"items": {
"type": "string",
"pattern": "^.{1}$"
},
"minItems": 1
}
},
"required": [
"approverName",
"newBackupPassword"
]
},
"ApproverRenewOneTimePasswordDto": {
"type": "object",
"description": "Renew the one time code or QR code for an approver.",
"properties": {
"approverName": {
"type": "string",
"description": "The name of the approver",
"minLength": 1
},
"qrCode": {
"type": "boolean",
"description": "If true, a QR code will be generated and returned instead of OTP.",
"example": false
}
},
"required": [
"approverName"
]
},
"ApproverOnboardDto": {
"type": "object",
"description": "Onboard approver request with name, backup password and a secret for AES_GCM transport encryption of the pkcs12-container.",
"properties": {
"approverName": {
"type": "string",
"description": "The name of the approver e.g. the e-mail address",
"minLength": 1
},
"oneTimeCode": {
"type": "array",
"description": "The OneTimeCode used to verify the approver.",
"items": {
"type": "string",
"pattern": "^.{1}$"
},
"minItems": 1
},
"transportPassword": {
"type": "array",
"description": "The transportPassword is a secret for AES_GCM transport encryption and is used to encrypt the pkcs12-container.",
"items": {
"type": "string",
"pattern": "^.{1}$"
},
"minItems": 1
}
},
"required": [
"approverName",
"oneTimeCode",
"transportPassword"
]
},
"ApproverOnboardResponseDto": {
"type": "object",
"description": "Response containing the encrypted payload of the approvers onboarding.",
"properties": {
"encryptedPayload": {
"type": "string",
"description": "The encrypted payload containing the approvers p12 container and certificate",
"minLength": 1
},
"initializationVector": {
"type": "string",
"description": "The initialization Vector used to decrypt the approvers p12 container",
"minLength": 1
}
},
"required": [
"encryptedPayload",
"initializationVector"
]
},
"SendApprovalDto": {
"type": "object",
"description": "Request to submit the authorization token of an approval client.",
"properties": {
"id": {
"type": "string",
"description": "Id of the task for which the approval is being submitted.",
"minLength": 1
},
"approvalToBeSigned": {
"type": "string",
"description": "The approval token as received in the task or constructed by the client using additional data received in the task (base64 encoded)",
"minLength": 1
},
"signature": {
"type": "string",
"description": "The signature of the approvalToBeSigned received with the task (base64 encoded)",
"minLength": 1
},
"approvalDigestAlgorithm": {
"type": "string",
"default": "SHA-256",
"description": "The digest algorithm used for signing the approvalToBeSigned. The signature algorithm is given by the approver's private key. For pure ML-DSA or SLH-DSA signatures, provide ML-DSA or SLH-DSA respectively.",
"enum": [
"SHA-256",
"SHA-224",
"SHA-384",
"SHA-512",
"SHA3-224",
"SHA3-256",
"SHA3-384",
"SHA3-512",
"ML-DSA",
"SLH-DSA"
],
"example": "SHA-256",
"minLength": 1
},
"approverPublicKey": {
"type": "string",
"description": "If approver is public key based: The public key of the approver in the same format as provided during key creation (base64 encoded)"
},
"approverCertificate": {
"type": "string",
"description": "If approver is certificate based: The certificate of the approver in the same format as provided during key creation (base64 encoded)"
}
},
"required": [
"approvalDigestAlgorithm",
"approvalToBeSigned",
"id",
"signature"
]
},
"DeleteTaskRequestDto": {
"type": "object",
"description": "Request to delete a task.",
"properties": {
"timestamp": {
"type": "string",
"format": "date-time",
"description": "The ISO-8601 formatted timestamp that has been signed by the approval client.",
"minLength": 1
},
"timestampSignature": {
"type": "string",
"format": "base64",
"description": "Signature(base64 encoded) for the timestamp (ISO-8601) that was done using the key of the approver. Format of the signature is depending on the algorithm used and as returned when using a JDK's native Signature.sign() method.
Example (EC key):
echo \"MEUCIDOsDySFOWOcMKulHmR3uB8YCF7oX+vQ4dU8ooYC1OCvAiEApwMbu7nF19woZhO/KCIRV1api8oa/QCV2M2pcINAnEQ=\" | base64 -D | openssl asn1parse -inform DER
0:d=0 hl=2 l= 69 cons: SEQUENCE
2:d=1 hl=2 l= 32 prim: INTEGER :33AC0F248539639C30ABA51E6477B81F18085EE85FEBD0E1D53CA28602D4E0AF
36:d=1 hl=2 l= 33 prim: INTEGER :A7031BBBB9C5D7DC286613BF2822115756A98BCA1AFD0095D8CDA97083409C44",
"minLength": 1
},
"timestampSigningCertificate": {
"type": "string",
"format": "base64",
"description": "Certificate used for the timestampSignature. Use when tasks for all approvers or a specific approver shall be fetched, but without access to the approver's private key. To load all tasks neither the approverPublicKey nor the approverCertificate may be set. If either one is set only the tasks for this specific approver is loaded."
},
"approverPublicKey": {
"type": "string",
"format": "base64",
"description": "Public key of the approver (base64 encoded). Either the approverPublicKey or the approverCertificate has to be provided if the timestampSigningCertificate is not set."
},
"approverCertificate": {
"type": "string",
"format": "base64",
"description": "Certificate of the approver in DER format (base64 encoded). Either the approverPublicKey or the approverCertificate has to be provided if the timestampSigningCertificate is not set."
},
"timestampDigestAlgorithm": {
"type": "string",
"default": "SHA-256",
"description": "The message digest algorithm that was used for computing the timestamp signature. For pure ML-DSA or SLH-DSA signatures, provide ML-DSA or SLH-DSA respectively.",
"enum": [
"SHA-256",
"SHA-224",
"SHA-384",
"SHA-512",
"SHA3-224",
"SHA3-256",
"SHA3-384",
"SHA3-512",
"ML-DSA",
"SLH-DSA"
],
"example": "SHA-256",
"minLength": 1
},
"id": {
"type": "string",
"description": "Id of the task which shall be deleted.",
"minLength": 1
}
},
"required": [
"id",
"timestamp",
"timestampDigestAlgorithm",
"timestampSignature"
]
},
"ModifyKeyAttributes": {
"type": "object",
"description": "The attributes of the key that should be modified. Only one key attribute can be modified per request; startDate and endDate may be set together as one validity-period change.",
"properties": {
"newLabel": {
"type": "string",
"default": "newKeyName",
"description": "The new name of the key."
},
"newPassword": {
"type": "string",
"description": "The new password of the key.",
"example": "string"
},
"customerNote": {
"type": "string",
"description": "The new customer note stored in free field."
},
"startDate": {
"type": [
"string",
"null"
],
"description": "The first date or UTC time on which the key is valid. Accepts ISO-8601 date format yyyy-MM-dd or date-time format yyyy-MM-dd'T'HH:mm:ss.",
"example": "2026-05-11T08:08:08",
"pattern": "^\\d{4}-\\d{2}-\\d{2}(?:T\\d{2}:\\d{2}:\\d{2})?$"
},
"endDate": {
"type": [
"string",
"null"
],
"description": "The last date or UTC time on which the key is valid. Accepts ISO-8601 date format yyyy-MM-dd or date-time format yyyy-MM-dd'T'HH:mm:ss.",
"example": "2026-12-31T18:30:00",
"pattern": "^\\d{4}-\\d{2}-\\d{2}(?:T\\d{2}:\\d{2}:\\d{2})?$"
},
"encrypt": {
"type": "boolean",
"description": "If true the key can be used to encrypt data. This attribute is only supported for symmetric keys."
},
"decrypt": {
"type": "boolean",
"description": "If true the key can be used to decrypt data."
},
"verify": {
"type": "boolean",
"description": "This attribute is only supported for symmetric keys."
},
"sign": {
"type": "boolean",
"description": "If true the key can sign."
},
"wrap": {
"type": "boolean",
"description": "If true the key can be used to wrap another key. This attribute is only supported for symmetric keys."
},
"unwrap": {
"type": "boolean",
"description": "If true the key can be used to unwrap keys."
},
"derive": {
"type": "boolean",
"default": false,
"description": "If true it is possible to derive from this key."
},
"extractable": {
"type": "boolean",
"default": false,
"description": "If true the key is extractable. This option can only be true for keys without smart key attributes."
},
"modifiable": {
"type": "boolean",
"default": true,
"description": "If true the key can be modified. The 'modifiable' attribute applies exclusively to the key attribute and not to SKA-Policy."
},
"destroyable": {
"type": "boolean",
"default": false,
"description": "If true the key can be deleted."
},
"sensitive": {
"type": "boolean",
"description": "If true the key is sensitive. To export a key sensitive must be false"
},
"copyable": {
"type": "boolean",
"default": false,
"description": "If true the encrypted key can be stored in an external memory"
}
}
},
"ModifyKeyDto": {
"type": "object",
"description": "Modify key request. Exactly one field in modifyAttributes may be changed per request, except that startDate and endDate may be supplied together as one validity-period change.",
"properties": {
"label": {
"type": "string",
"default": "keyname",
"description": "The name of the key.",
"minLength": 1
},
"password": {
"type": "string",
"description": "The password of the key.",
"example": "string"
},
"modifyAttributes": {
"$ref": "#/components/schemas/ModifyKeyAttributes"
}
},
"required": [
"label",
"modifyAttributes"
]
},
"SystemTimeInformationDto": {
"type": "object",
"description": "System Time Information",
"properties": {
"hsmTime": {
"type": "string",
"description": "The current system time of the HSM (ISO-8601 formatted timestamp)"
},
"signedTimestampPayload": {
"type": "string",
"format": "base64",
"description": "The payload used to create the timetstamp signature"
},
"timestampKeyName": {
"type": "string",
"description": "The key to sign the timestamp with SHA256withECDSA"
},
"timestampSignature": {
"type": "string",
"description": "The signature of the timestamp with optional payload"
},
"hostTime": {
"type": "string",
"description": "The current system time of the TSB Host (ISO-8601 formatted timestamp)"
}
}
},
"LicenseInformationDto": {
"type": "object",
"description": "License information",
"properties": {
"clientFlags": {
"type": "array",
"items": {
"type": "string",
"description": "The flags that are set for the current subscription of the client."
},
"uniqueItems": true
}
}
},
"KeyStoreStatisticsDto": {
"type": "object",
"properties": {
"keyStoreStatistics": {
"type": "string"
},
"ApiLoginRole": {
"type": "string",
"description": "API login role. Possible results: Key Manager(W), Auditor(R), Key Operator(X), or General.",
"enum": [
"Key Manager(W)",
"Auditor(R)",
"Key Operator(X)",
"General"
],
"example": "General"
}
}
},
"GetPublicKeyResponseDto": {
"type": "object",
"properties": {
"publicKey": {
"type": "string",
"format": "base64",
"description": "The public key from the provided private key (base64 encoded)."
}
}
},
"HsmMeasuredLatencyStatisticsDto": {
"type": "object",
"description": "Measured latency statistics for active HSM calls.",
"properties": {
"count": {
"type": "integer",
"format": "int64",
"description": "Number of measured calls."
},
"minimumMillis": {
"type": "integer",
"format": "int64",
"description": "Minimum measured latency in milliseconds."
},
"maximumMillis": {
"type": "integer",
"format": "int64",
"description": "Maximum measured latency in milliseconds."
},
"averageMillis": {
"type": "integer",
"format": "int64",
"description": "Average measured latency in milliseconds."
}
}
},
"HsmStatisticsDto": {
"type": "object",
"description": "HSM latency statistics.",
"properties": {
"deviceInfoLatencyStatistics": {
"$ref": "#/components/schemas/HsmMeasuredLatencyStatisticsDto",
"description": "Active latency measurement for PrimusDevice.getDeviceInfo()."
}
}
},
"HsmLogDto": {
"type": "object",
"description": "Signed HSM Logs",
"properties": {
"signature": {
"type": "string",
"description": "The log signature generated with the attestation-key. (Base64 encoded)"
},
"signatureAlgorithm": {
"type": "string",
"description": "The signature algorithm used to generate the signature."
},
"attestationCertificate": {
"type": "string",
"description": "The attestation-key certificate to verify the log-signature."
},
"log": {
"type": "string",
"description": "The HSM log as a String"
}
}
},
"HealthInformationDto": {
"type": "object",
"description": "Health information",
"properties": {
"status": {
"type": "string",
"description": "Overall health status of the TSB service."
},
"tsb": {
"type": "string",
"description": "TSB application function check status."
},
"database": {
"type": "string",
"description": "Database connectivity check status."
}
}
},
"GenerateRandomDto": {
"type": "object",
"description": "Generate random response",
"properties": {
"random": {
"type": "string",
"description": "The random bytes generated by the HSM (base64 encoded)."
}
}
},
"AttestationCertificateDto": {
"type": "object",
"description": "Response containing the certification chain of the attestation key.",
"properties": {
"attestationCertificateChain": {
"type": "array",
"items": {
"type": "string",
"format": "base64",
"description": "Certificate chain consisting of base64 encoded certificates."
}
}
}
},
"ApproverOnboardingCertificateDto": {
"type": "object",
"description": "Response containing the Certificate of approver(s).",
"properties": {
"approverName": {
"type": "string",
"description": "The name of the approver e.g. the e-mail address",
"minLength": 1
},
"approverCertificate": {
"type": "string",
"description": "The certificate of the approver.",
"minLength": 1
}
},
"required": [
"approverCertificate",
"approverName"
]
},
"ApproverOnboardingStatusResponseDto": {
"type": "object",
"description": "Response containing the OneTimePassword.",
"properties": {
"onboarded": {
"type": "array",
"description": "List of onboarded approvers (certificates)",
"items": {
"$ref": "#/components/schemas/ApproverOnboardingCertificateDto"
},
"minItems": 1
},
"pending": {
"type": "array",
"description": "List of pending onboarded approvers (certificates)",
"items": {
"$ref": "#/components/schemas/ApproverOnboardingCertificateDto"
},
"minItems": 1
}
},
"required": [
"onboarded",
"pending"
]
}
},
"securitySchemes": {
"XApiKeyAuth": {
"type": "apiKey",
"name": "X-API-KEY",
"in": "header"
},
"bearerAuth": {
"type": "http",
"scheme": "bearer",
"bearerFormat": "JWT"
}
}
}
}