Activate ICP-Brasil certificate on the RSFN (GEN0006)

Prerequisite: the certificate must have been rotated first (see rotateCertificate) — its persisted state must be VALID or EXPIRING and carry the recorded serial. Submits a GEN0006 certificate-activation announcement to BACEN for the current OUTBOUND_SIGNING certificate. The submission is persisted with status SUBMITTED before dispatch; BACEN’s GEN0006R1 acknowledgment confirms it via NUOp correlation. Idempotent — the X-Idempotency key lives with the GEN0006 it sent: the same key and parsed request (member order and whitespace do not count; any other difference, such as number spelling, null for an absent field, or an unknown member, is another request) answer that GEN0006, also after X-TTL has dropped the cached response; the same key with another request answers 422, as does the same key under another current certificate once the cached response is gone.

POST /v1/str/certificates/activate

Activate ICP-Brasil certificate on the RSFN (GEN0006)

cURL

curl --request POST \
  --url https://api.example.com/v1/str/certificates/activate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Idempotency: <x-idempotency>' \
  --data '
{
  "reason": "Activating Q2 ICP-Brasil certificate"
}
'

200

{
  "certificateId": "550e8400-e29b-41d4-a716-446655440000",
  "certificateSerial": "00A1B2C3D4E5F60718293A4B5C5D6E7F",
  "controlNumber": "20260610000000000001",
  "correlationId": "req-7a3f9c2e",
  "messageType": "GEN0006",
  "nuOp": "12345678202606100000001",
  "status": "SUBMITTED",
  "submittedAt": "2026-06-10T18:30:00Z"
}

Autorizações

Authorization · string · header · obrigatório

JWT bearer token issued by the identity provider.

Cabeçalhos

X-Idempotency · string · obrigatório

Idempotency key. Required on every mutation.

X-TTL · string

Seconds the cached response is kept; it may only shorten IDEMPOTENCY_DEFAULT_TTL_SEC. The key itself lives with the message.

Corpo

application/json

reason · string

Optional operator rationale recorded with the activation submission. The 200-character bound is LERIAN'S OWN, not BACEN's: the rationale is Lerian SPB audit evidence and is not an element of the CodCertifrAtv submission.

Maximum string length: 200

Exemplo:

"Activating Q2 ICP-Brasil certificate"

Resposta

200

application/json

OK

certificateId · string<uuid> · obrigatório

UUID of the activated OUTBOUND_SIGNING certificate-state row.

Exemplo:

"550e8400-e29b-41d4-a716-446655440000"

certificateSerial · string · obrigatório

Hex serial number of the activated certificate, read from the persisted certificate-state evidence.

Exemplo:

"00A1B2C3D4E5F60718293A4B5C5D6E7F"

controlNumber · string · obrigatório

IF control number assigned to the GEN0006 submission (official ControleIF, 1-20 characters).

Required string length: 1 - 20

Exemplo:

"20260610000000000001"

correlationId · string · obrigatório

Request-scoped correlation identifier echoing X-Request-ID, for pivoting from response to trace.

Exemplo:

"req-7a3f9c2e"

messageType · string · obrigatório

STR message code of the submission (always GEN0006 for activation).

Exemplo:

"GEN0006"

nuOp · string · obrigatório

BACEN protocol identifier (NUOp) assigned to the GEN0006 activation submission.

Pattern: ^[0-9A-Z]{8}[0-9]{15}$

Exemplo:

"12345678202606100000001"

status · string · obrigatório

Submission status; always SUBMITTED until BACEN's GEN0006R1 acknowledgment flips it to CONFIRMED.

Exemplo:

"SUBMITTED"

submittedAt · string<date-time> · obrigatório

RFC3339 UTC timestamp when the activation was persisted before dispatch.

Exemplo:

"2026-06-10T18:30:00Z"