Upload a complete Dataprev custody

curl --request PUT \
  --url https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "certPem": "<string>",
  "clientId": "<string>",
  "clientSecret": "<string>",
  "keyPem": "<string>"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev"

	payload := strings.NewReader("{\n  \"certPem\": \"<string>\",\n  \"clientId\": \"<string>\",\n  \"clientSecret\": \"<string>\",\n  \"keyPem\": \"<string>\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    certPem: '<string>',
    clientId: '<string>',
    clientSecret: '<string>',
    keyPem: '<string>'
  })
};

fetch('https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev"

payload = {
    "certPem": "<string>",
    "clientId": "<string>",
    "clientSecret": "<string>",
    "keyPem": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "certPresent": true,
  "oauthPresent": true,
  "provider": "dataprev",
  "updatedAt": "2026-06-23T12:00:00Z",
  "certFingerprint": "3b1f...c0",
  "certNotAfter": "2027-01-01T00:00:00Z",
  "codigoSolicitante": "341",
  "portalBaseUrl": "https://portal.example.com/formalizacao",
  "revokedAt": "2026-07-14T15:30:00Z"
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Upload a complete Dataprev custody

Stores the tenant’s ICP-Brasil A1 certificate (PEM cert+key) and OAuth2 client_credentials secret together, in one audited transaction, at new secret references. It is the only write a revoked custody accepts: it closes the revocation and opens a new custody generation, and the revoked material is never used again. A body that carries a certificate or an OAuth client secret a revocation retired is refused with 409 DATAPREV_CREDENTIAL_REVOKED; the client id may stay, because Dataprev can regenerate the secret of the same client, so a recustody after a revocation carries a client secret newly generated at Dataprev. On a custody that was not revoked it replaces both at once. The response NEVER carries secret material.

PUT

credentials

dataprev

curl --request PUT \
  --url https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "certPem": "<string>",
  "clientId": "<string>",
  "clientSecret": "<string>",
  "keyPem": "<string>"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev"

	payload := strings.NewReader("{\n  \"certPem\": \"<string>\",\n  \"clientId\": \"<string>\",\n  \"clientSecret\": \"<string>\",\n  \"keyPem\": \"<string>\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    certPem: '<string>',
    clientId: '<string>',
    clientSecret: '<string>',
    keyPem: '<string>'
  })
};

fetch('https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://br-consignado-gw.sandbox.lerian.net/v1/credentials/dataprev"

payload = {
    "certPem": "<string>",
    "clientId": "<string>",
    "clientSecret": "<string>",
    "keyPem": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "certPresent": true,
  "oauthPresent": true,
  "provider": "dataprev",
  "updatedAt": "2026-06-23T12:00:00Z",
  "certFingerprint": "3b1f...c0",
  "certNotAfter": "2027-01-01T00:00:00Z",
  "codigoSolicitante": "341",
  "portalBaseUrl": "https://portal.example.com/formalizacao",
  "revokedAt": "2026-07-14T15:30:00Z"
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "AUT-0033",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Autorizaciones

Authorization

string

header

requerido

JWT bearer token issued by the identity provider.

Encabezados

X-Idempotency

string

Optional idempotency key. Sent again with the SAME body, the stored response is replayed and the custody is stored once; sent again with a DIFFERENT body, the request is refused with 422 because the key was already spent on another intent.

Ejemplo:

"idem-1"

Cuerpo

application/json

certPem

string

requerido

PEM-encoded ICP-Brasil A1 client certificate chain.

Required string length: 1 - 65536

clientId

string

requerido

OAuth2 client_credentials client id.

Required string length: 1 - 512

clientSecret

string

requerido

OAuth2 client_credentials client secret.

Required string length: 1 - 4096

keyPem

string

requerido

PEM-encoded private key for the client certificate.

Required string length: 1 - 65536

Respuesta

certPresent

boolean

requerido

Whether a client certificate is stored for the tenant.

oauthPresent

boolean

requerido

Whether OAuth2 client_credentials are stored for the tenant.

provider

string

requerido

External rail the credentials belong to.

Ejemplo:

"dataprev"

updatedAt

string<date-time>

requerido

Last-update timestamp (RFC 3339, UTC).

Ejemplo:

"2026-06-23T12:00:00Z"

certFingerprint

string

SHA-256 hex fingerprint of the stored certificate (absent when none).

Ejemplo:

"3b1f...c0"

certNotAfter

string<date-time>

RFC 3339 cert expiry (UTC); absent when no cert is stored.

Ejemplo:

"2027-01-01T00:00:00Z"

codigoSolicitante

string

Dataprev codigoSolicitante: the institution's BACEN COMPE code (3 digits, zero-padded, 001-999). Public, non-secret; absent when none is stored.

Ejemplo:

"341"

portalBaseUrl

string

Base URL of the tenant's worker portal. Public, non-secret; absent when none is stored.

Ejemplo:

"https://portal.example.com/formalizacao"

revokedAt

string<date-time>

Credential revocation timestamp (RFC 3339, UTC); absent when credentials were never revoked.

Ejemplo:

"2026-07-14T15:30:00Z"

Configuración del tenant y credenciales

Datos del trabajador y margen

Subastas y propuestas

Configuración de la presubasta

Fondos de la presubasta

Subastas y cotizaciones de la presubasta

Registro y documentos del contrato

Correcciones del contrato

Ciclo de vida del contrato

Refinanciación, renegociación y portabilidad

Contratos legados

Garantías del FGTS

Conciliación y calendario

Fondos y cesiones

Acceso de socio del fondo

Acceso de socio del originador

Acceso de socio del originador (credencial vinculada)

Capacidad

Monitoreo

Suscripciones de eventos

Manejo de errores

Eventos

Upload a complete Dataprev custody

Autorizaciones

Encabezados

Cuerpo

Respuesta