Rotar certificado ICP-Brasil

curl --request POST \
  --url https://spb.sandbox.lerian.net/v1/str/certificates/rotate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "certificateRef": "<string>",
  "privateKeyRef": "<string>",
  "reason": "<string>"
}
'

import requests

url = "https://spb.sandbox.lerian.net/v1/str/certificates/rotate"

payload = {
    "certificateRef": "<string>",
    "privateKeyRef": "<string>",
    "reason": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({certificateRef: '<string>', privateKeyRef: '<string>', reason: '<string>'})
};

fetch('https://spb.sandbox.lerian.net/v1/str/certificates/rotate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://spb.sandbox.lerian.net/v1/str/certificates/rotate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'certificateRef' => '<string>',
    'privateKeyRef' => '<string>',
    'reason' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://spb.sandbox.lerian.net/v1/str/certificates/rotate"

	payload := strings.NewReader("{\n  \"certificateRef\": \"<string>\",\n  \"privateKeyRef\": \"<string>\",\n  \"reason\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://spb.sandbox.lerian.net/v1/str/certificates/rotate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"certificateRef\": \"<string>\",\n  \"privateKeyRef\": \"<string>\",\n  \"reason\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://spb.sandbox.lerian.net/v1/str/certificates/rotate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"certificateRef\": \"<string>\",\n  \"privateKeyRef\": \"<string>\",\n  \"reason\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "auditId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "certificate": {
    "certificateId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "purpose": "<string>",
    "readinessImpact": "<string>",
    "status": "<string>",
    "updatedAt": "2023-11-07T05:31:56Z",
    "daysUntilExpiry": 123,
    "expiresAt": "2023-11-07T05:31:56Z"
  },
  "correlationId": "<string>",
  "readiness": {
    "blockers": [
      "<string>"
    ],
    "status": "<string>",
    "warnings": [
      "<string>"
    ]
  }
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

Rotar certificado ICP-Brasil

Prerrequisito: este es el primer paso de la cadena de onboarding (certificado → disponibilidad → prueba-de-conectividad → envío); rota el certificado antes de activarlo (ver activateCertificate), verificar la disponibilidad (ver getReadiness) o enviar cualquier operación. Realiza una recarga en caliente, con emisión de evidencia, del par de certificados ICP-Brasil/RSFN. El nuevo certificado ya debe existir en disco bajo la ruta base configurada; este endpoint solo intercambia el puntero en memoria y emite un registro de auditoría. Idempotente: reenviar la misma clave X-Idempotency con el mismo cuerpo devuelve la respuesta en caché. La respuesta NUNCA incluye la ruta de la clave privada ni el material de claves.

POST

str

certificates

rotate

Rotar certificado ICP-Brasil

curl --request POST \
  --url https://spb.sandbox.lerian.net/v1/str/certificates/rotate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "certificateRef": "<string>",
  "privateKeyRef": "<string>",
  "reason": "<string>"
}
'

import requests

url = "https://spb.sandbox.lerian.net/v1/str/certificates/rotate"

payload = {
    "certificateRef": "<string>",
    "privateKeyRef": "<string>",
    "reason": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({certificateRef: '<string>', privateKeyRef: '<string>', reason: '<string>'})
};

fetch('https://spb.sandbox.lerian.net/v1/str/certificates/rotate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://spb.sandbox.lerian.net/v1/str/certificates/rotate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'certificateRef' => '<string>',
    'privateKeyRef' => '<string>',
    'reason' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://spb.sandbox.lerian.net/v1/str/certificates/rotate"

	payload := strings.NewReader("{\n  \"certificateRef\": \"<string>\",\n  \"privateKeyRef\": \"<string>\",\n  \"reason\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://spb.sandbox.lerian.net/v1/str/certificates/rotate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"certificateRef\": \"<string>\",\n  \"privateKeyRef\": \"<string>\",\n  \"reason\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://spb.sandbox.lerian.net/v1/str/certificates/rotate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"certificateRef\": \"<string>\",\n  \"privateKeyRef\": \"<string>\",\n  \"reason\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "auditId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "certificate": {
    "certificateId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "purpose": "<string>",
    "readinessImpact": "<string>",
    "status": "<string>",
    "updatedAt": "2023-11-07T05:31:56Z",
    "daysUntilExpiry": 123,
    "expiresAt": "2023-11-07T05:31:56Z"
  },
  "correlationId": "<string>",
  "readiness": {
    "blockers": [
      "<string>"
    ],
    "status": "<string>",
    "warnings": [
      "<string>"
    ]
  }
}

{
  "code": "<string>",
  "detail": "<string>",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "<string>",
  "status": 123,
  "title": "<string>",
  "type": "about:blank"
}

Autorizaciones

Authorization

string

header

requerido

JWT bearer token issued by the identity provider.

Encabezados

X-Idempotency

string

Idempotency key (primary).

X-Idempotency-Key

string

Idempotency key (legacy alias for X-Idempotency).

X-TTL

string

Idempotency key TTL in seconds (overrides the configured default).

Cuerpo

application/json

certificateRef

string

requerido

Operator-supplied reference to the new certificate material (filesystem path or secrets-manager URI), validated against the configured cert directory before any read.

Required string length: 1 - 2048

Ejemplo:

"/etc/lerian/certs/2026-q2/icp-brasil.crt"

privateKeyRef

string

requerido

Operator-supplied reference to the new private-key material (filesystem path or secrets-manager URI), validated against the configured cert directory before any read.

Required string length: 1 - 2048

Ejemplo:

"/etc/lerian/certs/2026-q2/icp-brasil.key"

reason

string

Optional operator rationale recorded in the audit evidence (max 512 chars).

Maximum string length: 512

Ejemplo:

"Quarterly rotation per ICP-Brasil policy"

Respuesta

auditId

string<uuid>

requerido

UUID of the audit record written for this rotation.

Ejemplo:

"a1b2c3d4-e5f6-7890-abcd-ef1234567890"

certificate

object

requerido

State of the certificate after the rotation hot-reload.

Show child attributes

correlationId

string

requerido

Request-scoped correlation identifier echoing X-Request-ID, for pivoting from response to trace.

Ejemplo:

"req-7a3f9c2e"

readiness

object

Optional post-rotation readiness summary; omitted when readiness lookup is unavailable.

Show child attributes

⌘I

Pix — Lerian SPI (mensajería nativa)

Pix — JD (interfaz, directo)

Pix — BTG (interfaz, indirecto)

TED — Lerian SPB (mensajería nativa)

TED — JD (interfaz)

Boletos — BTG (interfaz)

Lerian SILOC (mensajería nativa)

Lerian SLC (mensajería nativa)

Lerian STA (mensajería nativa)

Lerian SISBAJUD (mensajería nativa)

Lerian Consignado (mensajería nativa)

Rotar certificado ICP-Brasil

Autorizaciones

Encabezados

Cuerpo

Respuesta