> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Rotate ICP-Brasil certificate > Prerequisite: this is the first step of the onboarding chain (certificate → readiness → connectivity-test → submit); rotate the certificate before activating it (see activateCertificate), checking readiness (see getReadiness), or submitting any operation. Performs an evidence-emitting hot-reload of the ICP-Brasil/RSFN certificate pair. The new certificate must already exist on disk under the configured base path; this endpoint swaps the in-memory signer, adds the certificate to the keys inbound frames decrypt with (the previous one stays until restart, so frames BACEN encrypted before the activation still open) and emits an audit record. Idempotent — replaying the same X-Idempotency key with the same parsed request (member order and whitespace do not count; any other difference, such as number spelling, null for an absent field, or an unknown member, is another request) returns the cached response. The response NEVER includes the private key path or key material. ## OpenAPI ````yaml /pt/openapi/v3-current/spb.yaml post /v1/str/certificates/rotate openapi: 3.1.0 info: contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for Lerian SPB, the direct integration between the institution and the Brazilian Payment System (SPB) over the National Financial System Network (RSFN). It covers the Reserve Transfer System (STR): message registry and capability catalog, operation lifecycle (bank transfers, IBS repasses, liquidity transfers, returns and cancellations), reserve-account and schedule queries, alçada governance, SME and LDL operations, inbound quarantine triage, reconciliation, and event delivery. license: name: Lerian Studio General License title: Lerian SPB API version: 1.0.0 servers: - url: https://api.example.com description: >- Replace the example host with the URL provided during environment onboarding. security: [] tags: - description: Immutable audit-record trails for STR operations and lifecycle events. name: Audit - description: >- STR capability catalog describing supported message types and their constraints. name: Capabilities - description: >- ICP-Brasil certificate inventory with hot-reloadable rotation and activation. name: Certificates - description: >- STR compulsory-movement (RCO) family: the movements BACEN orders on a participant's reserve account, their answers and the periods they belong to. name: Compulsory - description: >- Maker-checker approval queue for emissions parked above their alçada band: list pending, sign (approve), and deny. name: EmissionApprovals - description: Operation event catalog enumerating the emitted domain event types. name: Events - description: >- Inbound GEN-family notice log (GEN0001 connectivity echo, GEN0004 transmission error, GEN0005 administrative notice). name: GenNotices - description: >- SPB alçada governance config: value-band table + per-message-type signature requirements, hot-reloaded at runtime. name: Governance - description: >- Read raw STR message status: list messages and read a single message by NUOp. name: Messages - description: Aggregated operational summaries and metrics across STR operations. name: OperationalIntelligence - description: >- STR operation lifecycle for bank transfers and IBS repasses, including returns and cancellations. name: Operations - description: >- Service readiness state covering startup self-probes and dependency health. name: Readiness - description: Reconciliation cases and the actions that resolve operation discrepancies. name: Reconciliation - description: >- Redesconto do Banco Central: collateralised intraday and one-business-day BCB lending against Selic-registered federal securities. One create door derives the nine RDC commands from four operator-facing kinds (contract, payment, conversion, cancellation), plus the two consultas over eligible-security prices and open positions. An accepted rediscount is not necessarily a settled one — Selic may hold the request for want of securities, and that middle state is reported as its own. name: Rediscounts - description: >- STR Relatórios suite: synchronous, date-ranged aggregate reports (movimento financeiro, transações rejeitadas, volumetria) over Lerian SPB's own transmission record. name: Reports - description: >- STR0013 reserve-account balance and STR0014 statement (extrato, message-mode) queries and their async results. name: ReserveQueries - description: >- GEN0019 participant responsável roster: full-replacement updates announced to BACEN. name: Responsibles - description: STR operating-window schedule governing when operations may be sent. name: Schedule - description: >- STR0001 single-party schedule queries (consulta de horários do STR) and their async STR0001R1 grid results. name: ScheduleQueries - description: >- STR lançamentos (SLB) family: the charges BACEN raises against this participant, the payments that settle them, payments to BACEN it never demanded, and the entry consultas over them. name: SLB - description: >- Reads over an IEME's conta correspondente a moeda eletrônica (CCME): SME0003 statement (extrato) queries and their async SME0003R1 results, plus the log of SME0001R2/SME0002R2/SME0004R2 movement advices the STR delivered about movements this rail did not command. name: SMEQueries - description: Runtime SPB configuration settings for the STR integration. name: Settings - description: >- Flow (mandatory order): certificate → readiness → connectivity-test → submit. Activate a certificate, confirm the rail reports ready, pass a connectivity test, then submit an operation. Each step is its own resource; a submit must not be attempted before readiness passes. name: onboarding - description: >- Flow (mandatory order): parent operation SETTLED → return/cancel. A return or cancellation is a sub-resource of a settled parent operation; the {operationId}/{endToEndID} path segment enforces the parent structurally. name: lifecycle paths: /v1/str/certificates/rotate: post: tags: - Certificates - onboarding summary: Rotate ICP-Brasil certificate description: >- Prerequisite: this is the first step of the onboarding chain (certificate → readiness → connectivity-test → submit); rotate the certificate before activating it (see activateCertificate), checking readiness (see getReadiness), or submitting any operation. Performs an evidence-emitting hot-reload of the ICP-Brasil/RSFN certificate pair. The new certificate must already exist on disk under the configured base path; this endpoint swaps the in-memory signer, adds the certificate to the keys inbound frames decrypt with (the previous one stays until restart, so frames BACEN encrypted before the activation still open) and emits an audit record. Idempotent — replaying the same X-Idempotency key with the same parsed request (member order and whitespace do not count; any other difference, such as number spelling, null for an absent field, or an unknown member, is another request) returns the cached response. The response NEVER includes the private key path or key material. operationId: rotateCertificate parameters: - description: Idempotency key. Required on every mutation. in: header name: X-Idempotency required: true schema: description: Idempotency key. Required on every mutation. type: string - description: >- Seconds the cached response is kept; it may only shorten IDEMPOTENCY_DEFAULT_TTL_SEC. in: header name: X-TTL schema: description: >- Seconds the cached response is kept; it may only shorten IDEMPOTENCY_DEFAULT_TTL_SEC. type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/RotateCertificateRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/RotateCertificateResponseWire' description: OK '400': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Bad Request '401': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unauthorized '403': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Forbidden '409': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Conflict '413': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Request Entity Too Large '415': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unsupported Media Type '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '429': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Too Many Requests '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Service Unavailable '504': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Gateway Timeout default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: RotateCertificateRequest: additionalProperties: false properties: certificateRef: description: >- Path to the new certificate, validated against the configured cert directory before any read. The 2048-character bound is LERIAN'S OWN, not BACEN's: a material reference is deployment configuration and never crosses an SFN wire. examples: - /certs/2026-q2/icp-brasil.crt maxLength: 2048 minLength: 1 type: string privateKeyRef: description: >- The new private key in the configured custody: with SPB_SIGNER_KIND=file a path validated against the configured cert directory before any read, with pkcs11 the key label, with kmip the private key UID. The 2048-character bound is LERIAN'S OWN, not BACEN's: a material reference is deployment configuration and never crosses an SFN wire. examples: - /certs/2026-q2/icp-brasil.key maxLength: 2048 minLength: 1 type: string publicKeyRef: description: >- With SPB_SIGNER_KIND=kmip, the UID of the new key's public half; unused by the other custodies. The 2048-character bound is LERIAN'S OWN, not BACEN's: a material reference is deployment configuration and never crosses an SFN wire. examples: - spb-sign-2026-q2-pub maxLength: 2048 type: string reason: description: >- Optional operator rationale recorded in the audit evidence. The 512-character bound is LERIAN'S OWN, not BACEN's: a rotation rationale is Lerian SPB audit evidence and never crosses an SFN wire. examples: - Quarterly rotation per ICP-Brasil policy maxLength: 512 type: string required: - certificateRef - privateKeyRef type: object RotateCertificateResponseWire: additionalProperties: false properties: auditId: description: UUID of the audit record written for this rotation. examples: - a1b2c3d4-e5f6-7890-abcd-ef1234567890 format: uuid type: string certificate: $ref: '#/components/schemas/CertificateStatusWire' description: State of the certificate after the rotation hot-reload. correlationId: description: >- Request-scoped correlation identifier echoing X-Request-ID, for pivoting from response to trace. examples: - req-7a3f9c2e type: string readiness: $ref: '#/components/schemas/ReadinessSummary' description: >- Optional post-rotation readiness summary; omitted when readiness lookup is unavailable. required: - certificate - auditId - correlationId type: object Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string correlationId: description: Request-scoped correlation identifier echoing X-Request-ID. examples: - req-7a3f9c2e type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. required: - correlationId type: object CertificateStatusWire: additionalProperties: false properties: certificateId: description: Certificate-state row UUID. examples: - 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string daysUntilExpiry: description: Whole days remaining until expiry; null when expiry is unknown. examples: - 45 format: int64 type: integer expiresAt: description: RFC3339 UTC expiry timestamp; null when unknown. examples: - '2027-05-04T18:30:00Z' format: date-time type: string purpose: description: >- Role this certificate serves: OUTBOUND_SIGNING (signs submissions), INBOUND_PROCESS, BACEN_VERIFICATION, or EXTERNAL_RAIL. enum: - OUTBOUND_SIGNING - INBOUND_PROCESS - BACEN_VERIFICATION - EXTERNAL_RAIL examples: - OUTBOUND_SIGNING type: string readinessImpact: description: >- Effect of this certificate's state on service readiness: NONE, WARNING, or BLOCKER. enum: - NONE - WARNING - BLOCKER examples: - NONE type: string status: description: >- Current validity state: VALID, EXPIRING (within the warning window), EXPIRED, INVALID, or MISSING. enum: - VALID - EXPIRING - EXPIRED - INVALID - MISSING examples: - VALID type: string updatedAt: description: RFC3339 UTC timestamp of the last certificate-state update. examples: - '2026-05-04T18:30:00Z' format: date-time type: string required: - certificateId - purpose - status - readinessImpact - updatedAt type: object ReadinessSummary: additionalProperties: false properties: blockers: description: >- Messages for conditions that block readiness; empty when there are none. examples: - - 'redis: connection refused' items: type: string type: array status: description: Aggregate readiness status. enum: - READY - PENDING_CONFIGURATION - DEGRADED - UNAVAILABLE examples: - READY type: string warnings: description: >- Messages for non-blocking conditions that need attention; empty when there are none. examples: - - certificate expires in 12 days items: type: string type: array required: - status - blockers - warnings type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.