Upload or rotate the Dataprev client certificate

Stores (or rotates) the tenant’s ICP-Brasil A1 client certificate (PEM cert+key) for the Dataprev rail in the tenant secret store and upserts non-secret metadata. The certificate is validated before storage. The response NEVER carries secret material.

PUT /v1/credentials/dataprev/certificate

Upload or rotate the Dataprev client certificate

cURL

curl --request PUT \
  --url https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev/certificate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "certPem": "<string>",
  "keyPem": "<string>"
}
'

200

{
  "certPresent": true,
  "oauthPresent": true,
  "provider": "dataprev",
  "updatedAt": "2026-06-23T12:00:00Z",
  "certFingerprint": "3b1f...c0",
  "certNotAfter": "2027-01-01T00:00:00Z",
  "codigoSolicitante": "341",
  "revokedAt": "2026-07-14T15:30:00Z"
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Headers

X-Idempotency · string

Optional idempotency key. Sent again with the SAME body, the stored response is replayed and the certificate is stored once; sent again with a DIFFERENT body, the request is refused with 422 because the key was already spent on another intent. Absent, the request executes once, exactly as it always has.

Example:

"idem-1"

Body

application/json

certPem · string · required

PEM-encoded ICP-Brasil A1 client certificate chain.

Required string length: 1 - 1048576

keyPem · string · required

PEM-encoded private key for the client certificate.

Required string length: 1 - 1048576

Response

200

application/json

OK

certPresent · boolean · required

Whether a client certificate is stored for the tenant.

oauthPresent · boolean · required

Whether OAuth2 client_credentials are stored for the tenant.

provider · string · required

External rail the credentials belong to.

Example:

"dataprev"

updatedAt · string<date-time> · required

Last-update timestamp (RFC 3339, UTC).

Example:

"2026-06-23T12:00:00Z"

certFingerprint · string

SHA-256 hex fingerprint of the stored certificate (absent when none).

Example:

"3b1f...c0"

certNotAfter · string<date-time>

RFC 3339 cert expiry (UTC); absent when no cert is stored.

Example:

"2027-01-01T00:00:00Z"

codigoSolicitante · string

Dataprev codigoSolicitante: the institution's BACEN COMPE code (3 digits, zero-padded, 001-999). Public, non-secret; absent when none is stored.

Example:

"341"

revokedAt · string<date-time>

Credential revocation timestamp (RFC 3339, UTC); absent when credentials were never revoked.

Example:

"2026-07-14T15:30:00Z"