Completar una importación de clave de firma BYOK Modelo A (SaaS)

curl --request POST \
  --url https://slc.sandbox.lerian.net/v1/signing-key \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "encryptedKeyMaterialBase64": "<string>",
  "importTokenBase64": "<string>",
  "keyId": "<string>",
  "participantIspb": "<string>",
  "publicCertPem": "<string>"
}
'

import requests

url = "https://slc.sandbox.lerian.net/v1/signing-key"

payload = {
    "encryptedKeyMaterialBase64": "<string>",
    "importTokenBase64": "<string>",
    "keyId": "<string>",
    "participantIspb": "<string>",
    "publicCertPem": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    encryptedKeyMaterialBase64: '<string>',
    importTokenBase64: '<string>',
    keyId: '<string>',
    participantIspb: '<string>',
    publicCertPem: '<string>'
  })
};

fetch('https://slc.sandbox.lerian.net/v1/signing-key', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://slc.sandbox.lerian.net/v1/signing-key",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'encryptedKeyMaterialBase64' => '<string>',
    'importTokenBase64' => '<string>',
    'keyId' => '<string>',
    'participantIspb' => '<string>',
    'publicCertPem' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://slc.sandbox.lerian.net/v1/signing-key"

	payload := strings.NewReader("{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://slc.sandbox.lerian.net/v1/signing-key")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://slc.sandbox.lerian.net/v1/signing-key")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "certificateId": "<string>",
  "kmsRef": "<string>",
  "status": "<string>"
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

Completar una importación de clave de firma BYOK Modelo A (SaaS)

Reenvía el material de clave opaco y ya envuelto del tenant (Modelo A — nunca en texto plano) a KMS mediante el sidecar del firmante, luego persiste ÚNICAMENTE el certificado público + la referencia KMS por tenant + custody_provider=KMS (nunca material de clave). RBAC: signing-key:import (rol de aprovisionamiento solo para admin). La presencia/el tipo de los campos se valida contra el esquema (422); un ISPB mal formado o base64 inválido es un 400 codificado. Idempotente mediante el encabezado Idempotency-Key OBLIGATORIO.

POST

signing-key

curl --request POST \
  --url https://slc.sandbox.lerian.net/v1/signing-key \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "encryptedKeyMaterialBase64": "<string>",
  "importTokenBase64": "<string>",
  "keyId": "<string>",
  "participantIspb": "<string>",
  "publicCertPem": "<string>"
}
'

import requests

url = "https://slc.sandbox.lerian.net/v1/signing-key"

payload = {
    "encryptedKeyMaterialBase64": "<string>",
    "importTokenBase64": "<string>",
    "keyId": "<string>",
    "participantIspb": "<string>",
    "publicCertPem": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    encryptedKeyMaterialBase64: '<string>',
    importTokenBase64: '<string>',
    keyId: '<string>',
    participantIspb: '<string>',
    publicCertPem: '<string>'
  })
};

fetch('https://slc.sandbox.lerian.net/v1/signing-key', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://slc.sandbox.lerian.net/v1/signing-key",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'encryptedKeyMaterialBase64' => '<string>',
    'importTokenBase64' => '<string>',
    'keyId' => '<string>',
    'participantIspb' => '<string>',
    'publicCertPem' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://slc.sandbox.lerian.net/v1/signing-key"

	payload := strings.NewReader("{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://slc.sandbox.lerian.net/v1/signing-key")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://slc.sandbox.lerian.net/v1/signing-key")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"encryptedKeyMaterialBase64\": \"<string>\",\n  \"importTokenBase64\": \"<string>\",\n  \"keyId\": \"<string>\",\n  \"participantIspb\": \"<string>\",\n  \"publicCertPem\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "certificateId": "<string>",
  "kmsRef": "<string>",
  "status": "<string>"
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

Autorizaciones

Authorization

string

header

requerido

JWT bearer token issued by the identity provider.

Encabezados

Idempotency-Key

string

Idempotency key for safe retries (MANDATORY on this high-sensitivity endpoint).

Ejemplo:

"018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

Cuerpo

application/json

encryptedKeyMaterialBase64

string

requerido

Base64-encoded wrapped private-key material (Model A — never cleartext).

importTokenBase64

string

requerido

Base64-encoded opaque KMS import token from the import-params step.

keyId

string

requerido

KMS key id returned by the import-params step.

Ejemplo:

"018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

participantIspb

string

requerido

Participant ISPB the certificate belongs to (8-digit identifier).

Ejemplo:

"29011780"

publicCertPem

string

requerido

PEM-encoded PUBLIC ICP-Brasil A1 certificate.

Respuesta

certificateId

string

requerido

Stored public-certificate id.

Ejemplo:

"018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

kmsRef

string

requerido

Per-tenant KMS key reference.

Ejemplo:

"arn:aws:kms:us-east-1:000000000000:key/018f8a3e-4b2c-7c1a-9e5d-2f6a1b3c4d5e"

status

string

requerido

Import result status.

Ejemplo:

"imported"

⌘I

Pix — Lerian SPI (mensajería nativa)

Pix — JD (interfaz, directo)

Pix — BTG (interfaz, indirecto)

TED — Lerian SPB (mensajería nativa)

TED — JD (interfaz)

Boletos — BTG (interfaz)

Lerian SILOC (mensajería nativa)

Lerian SLC (mensajería nativa)

Lerian STA (mensajería nativa)

Lerian SISBAJUD (mensajería nativa)

Lerian Consignado (mensajería nativa)

Completar una importación de clave de firma BYOK Modelo A (SaaS)

Autorizaciones

Encabezados

Cuerpo

Respuesta