Start a BYOK Model-A signing-key import (SaaS)

Creates a fresh EXTERNAL-origin KMS key for the caller’s tenant and returns the wrapping public key + import token the tenant uses to wrap their ICP-Brasil private key material LOCALLY (Model A — the SLC never sees the private key in cleartext). RBAC: signing-key:import (admin-only provisioning role). Idempotent via the MANDATORY Idempotency-Key header.

POST /v1/signing-key/import-params

Start a BYOK Model-A signing-key import (SaaS)

cURL

curl --request POST \
  --url https://slc.sandbox.lerian.net/v1/signing-key/import-params \
  --header 'Authorization: Bearer <token>'

200

{
  "importTokenBase64": "<string>",
  "keyId": "<string>",
  "wrappingPublicKeyBase64": "<string>",
  "expiresAt": "<string>"
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Headers

Idempotency-Key · string

Idempotency key for safe retries (MANDATORY: each call mints a real, billable AWS KMS key).

Example:

"018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

Response

200

application/json

OK

importTokenBase64 · string · required

Base64-encoded opaque KMS import token to pass back on the complete-import call.

keyId · string · required

KMS key id created for this import.

Example:

"018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

wrappingPublicKeyBase64 · string · required

Base64-encoded PUBLIC wrapping key (DER) used to wrap the private key locally.

expiresAt · string

Import-token expiry (RFC3339 UTC); omitted when zero.

Example:

"2026-06-15T07:50:00Z"