Upload or rotate the Dataprev OAuth2 credentials

Stores (or rotates) the tenant’s OAuth2 client_credentials secret for the Dataprev token endpoint in the tenant secret store and flips the oauth-present flag. The response NEVER echoes the client secret.

PUT /v1/credentials/dataprev/oauth

Upload or rotate the Dataprev OAuth2 credentials

cURL

curl --request PUT \
  --url https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev/oauth \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "clientId": "<string>",
  "clientSecret": "<string>"
}
'

200

{
  "certPresent": true,
  "oauthPresent": true,
  "provider": "dataprev",
  "updatedAt": "2026-06-23T12:00:00Z",
  "certFingerprint": "3b1f...c0",
  "certNotAfter": "2027-01-01T00:00:00Z",
  "codigoSolicitante": "341",
  "revokedAt": "2026-07-14T15:30:00Z"
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Headers

X-Idempotency · string

Optional idempotency key. Sent again with the SAME body, the stored response is replayed and the OAuth material is stored once; sent again with a DIFFERENT body, the request is refused with 422 because the key was already spent on another intent. Absent, the request executes once, exactly as it always has.

Example:

"idem-1"

Body

application/json

clientId · string · required

OAuth2 client_credentials client id.

Required string length: 1 - 512

clientSecret · string · required

OAuth2 client_credentials client secret.

Required string length: 1 - 4096

Response

200

application/json

OK

certPresent · boolean · required

Whether a client certificate is stored for the tenant.

oauthPresent · boolean · required

Whether OAuth2 client_credentials are stored for the tenant.

provider · string · required

External rail the credentials belong to.

Example:

"dataprev"

updatedAt · string<date-time> · required

Last-update timestamp (RFC 3339, UTC).

Example:

"2026-06-23T12:00:00Z"

certFingerprint · string

SHA-256 hex fingerprint of the stored certificate (absent when none).

Example:

"3b1f...c0"

certNotAfter · string<date-time>

RFC 3339 cert expiry (UTC); absent when no cert is stored.

Example:

"2027-01-01T00:00:00Z"

codigoSolicitante · string

Dataprev codigoSolicitante: the institution's BACEN COMPE code (3 digits, zero-padded, 001-999). Public, non-secret; absent when none is stored.

Example:

"341"

revokedAt · string<date-time>

Credential revocation timestamp (RFC 3339, UTC); absent when credentials were never revoked.

Example:

"2026-07-14T15:30:00Z"