Complete a BYOK Model-A signing-key import (SaaS)

curl --request POST \
  --url https://slc.sandbox.lerian.net/v1/signing-key \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "encryptedKeyMaterialBase64": "<string>",
  "importTokenBase64": "<string>",
  "keyId": "<string>",
  "participantIspb": "<string>",
  "publicCertPem": "<string>"
}
'

import requests

url = "https://slc.sandbox.lerian.net/v1/signing-key"

payload = {
    "encryptedKeyMaterialBase64": "<string>",
    "importTokenBase64": "<string>",
    "keyId": "<string>",
    "participantIspb": "<string>",
    "publicCertPem": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    encryptedKeyMaterialBase64: '<string>',
    importTokenBase64: '<string>',
    keyId: '<string>',
    participantIspb: '<string>',
    publicCertPem: '<string>'
  })
};

fetch('https://slc.sandbox.lerian.net/v1/signing-key', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://slc.sandbox.lerian.net/v1/signing-key",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'encryptedKeyMaterialBase64' => '<string>',
    'importTokenBase64' => '<string>',
    'keyId' => '<string>',
    'participantIspb' => '<string>',
    'publicCertPem' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://slc.sandbox.lerian.net/v1/signing-key"

	payload := strings.NewReader("{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://slc.sandbox.lerian.net/v1/signing-key")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://slc.sandbox.lerian.net/v1/signing-key")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "certificateId": "<string>",
  "kmsRef": "<string>",
  "status": "<string>"
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

Complete a BYOK Model-A signing-key import (SaaS)

Forwards the tenant’s already-wrapped, opaque key material (Model A — never cleartext) to KMS via the signer sidecar, then persists ONLY the public certificate + the per-tenant KMS reference + custody_provider=KMS (never key material). RBAC: signing-key:import (admin-only provisioning role). Field presence/type is validated against the schema (422); a malformed ISPB or invalid base64 is a coded 400. Idempotent via the MANDATORY Idempotency-Key header.

POST

signing-key

curl --request POST \
  --url https://slc.sandbox.lerian.net/v1/signing-key \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "encryptedKeyMaterialBase64": "<string>",
  "importTokenBase64": "<string>",
  "keyId": "<string>",
  "participantIspb": "<string>",
  "publicCertPem": "<string>"
}
'

import requests

url = "https://slc.sandbox.lerian.net/v1/signing-key"

payload = {
    "encryptedKeyMaterialBase64": "<string>",
    "importTokenBase64": "<string>",
    "keyId": "<string>",
    "participantIspb": "<string>",
    "publicCertPem": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    encryptedKeyMaterialBase64: '<string>',
    importTokenBase64: '<string>',
    keyId: '<string>',
    participantIspb: '<string>',
    publicCertPem: '<string>'
  })
};

fetch('https://slc.sandbox.lerian.net/v1/signing-key', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://slc.sandbox.lerian.net/v1/signing-key",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'encryptedKeyMaterialBase64' => '<string>',
    'importTokenBase64' => '<string>',
    'keyId' => '<string>',
    'participantIspb' => '<string>',
    'publicCertPem' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://slc.sandbox.lerian.net/v1/signing-key"

	payload := strings.NewReader("{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://slc.sandbox.lerian.net/v1/signing-key")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://slc.sandbox.lerian.net/v1/signing-key")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "certificateId": "<string>",
  "kmsRef": "<string>",
  "status": "<string>"
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

Authorizations

Authorization

string

header

required

JWT bearer token issued by the identity provider.

Headers

Idempotency-Key

string

Idempotency key for safe retries (MANDATORY on this high-sensitivity endpoint).

Example:

"018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

Body

application/json

encryptedKeyMaterialBase64

string

required

Base64-encoded wrapped private-key material (Model A — never cleartext).

importTokenBase64

string

required

Base64-encoded opaque KMS import token from the import-params step.

keyId

string

required

KMS key id returned by the import-params step.

Example:

"018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

participantIspb

string

required

Participant ISPB the certificate belongs to (8-digit identifier).

Example:

"29011780"

publicCertPem

string

required

PEM-encoded PUBLIC ICP-Brasil A1 certificate.

Response

certificateId

string

required

Stored public-certificate id.

Example:

"018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

kmsRef

string

required

Per-tenant KMS key reference.

Example:

"arn:aws:kms:us-east-1:000000000000:key/018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

status

string

required

Import result status.

Example:

"imported"

⌘I

Pix — Lerian SPI (native messaging)

Pix — JD (interface, direct)

Pix — BTG (interface, indirect)

TED — Lerian SPB (native messaging)

TED — JD (interface)

Boletos — BTG (interface)

Lerian SILOC (native messaging)

Lerian SLC (native messaging)

Lerian STA (native messaging)

Lerian SISBAJUD (native messaging)

Lerian Consignado (native messaging)

Complete a BYOK Model-A signing-key import (SaaS)

Authorizations

Headers

Body

Response