> For the complete documentation index, see [llms.txt](https://docs.meeco.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.meeco.me/openapi-docs/svx-api/certificates.md). # Certificates ## List certificates > Returns a list of imported certificates and metadata.\ > \ > Certificates are stored by type:\ > \- \`managed\`: bound to a managed signing key (\`key\_name\` present), may contain a full \`x5c\` chain,\ > and has \`fingerprint256 = null\`.\ > \- \`trust\_anchor\`: imported without \`key\_name\`, must contain exactly one certificate in \`x5c\`, and has\ > a non-null \`fingerprint256\`.\ > \ > The response includes certificate id, type, associated \`key\_name\` (when bound), the stored \`x5c\`,\ > and \`fingerprint256\` according to the certificate type rules above.
```json {"openapi":"3.1.0","info":{"title":"SVX Wallet API","version":"4.0.1"},"servers":[{"url":"https://zyfla-wallet-sandbox.meeco.cloud","description":"SVX Wallet deployment (relative)"}],"security":[{},{"bearerAuth":[]},{"mutualTLS":[]}],"components":{"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"},"mutualTLS":{"type":"mutualTLS"}},"schemas":{"CertificatesResponseDto":{"type":"object","properties":{"certificates":{"type":"array","items":{"$ref":"#/components/schemas/CertificateModelDto"}}},"required":["certificates"]},"CertificateModelDto":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["trust_anchor","managed"]},"key_name":{"anyOf":[{"type":"string"},{"type":"null"}]},"x5c":{"type":"array","minItems":1,"items":{"type":"string"}},"fingerprint256":{"description":"Present for `trust_anchor`; `null` for `managed`.","anyOf":[{"type":"string"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time"}},"required":["id","type","key_name","x5c","fingerprint256","created_at"]}}},"paths":{"/system/certificates":{"get":{"summary":"List certificates","description":"Returns a list of imported certificates and metadata.\n\nCertificates are stored by type:\n- `managed`: bound to a managed signing key (`key_name` present), may contain a full `x5c` chain,\n and has `fingerprint256 = null`.\n- `trust_anchor`: imported without `key_name`, must contain exactly one certificate in `x5c`, and has\n a non-null `fingerprint256`.\n\nThe response includes certificate id, type, associated `key_name` (when bound), the stored `x5c`,\nand `fingerprint256` according to the certificate type rules above.\n","operationId":"CertificatesController_listCertificates","parameters":[],"responses":{"200":{"description":"Certificates list retrieved","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CertificatesResponseDto"}}}}},"tags":["Certificates"]}}}} ``` ## Import certificate > Import certificate material in \`x5c\` form (DER-encoded, base64-encoded items).\ > \ > Behavior depends on whether \`key\_name\` is provided:\ > \- With \`key\_name\`: imports a \`managed\` certificate for that managed signing key.\ > \- \`x5c\` must contain at least one certificate.\ > \- The first item (leaf certificate) public key must match the managed key.\ > \- The full provided chain is stored.\ > \- \`fingerprint256\` is stored as \`null\`.\ > \- Without \`key\_name\`: imports a \`trust\_anchor\` certificate.\ > \- \`x5c\` must contain exactly one certificate.\ > \- \`fingerprint256\` is computed and stored.\ > \ > Notes:\ > \- For \`mso\_mdoc\` (mDL) credential issuance the credential key must have a valid DSC certificate; issuance\ > will fail without it (see ISO 18013-5 for mDL DSC requirements).\ > \- When signing CSRs externally (for example with \`openssl x509 -req\`), explicitly provide extensions\ > such as \`subjectAltName\`, \`keyUsage\`, and \`extendedKeyUsage\` so they are present in the issued certificate.
```json {"openapi":"3.1.0","info":{"title":"SVX Wallet API","version":"4.0.1"},"servers":[{"url":"https://zyfla-wallet-sandbox.meeco.cloud","description":"SVX Wallet deployment (relative)"}],"security":[{},{"bearerAuth":[]},{"mutualTLS":[]}],"components":{"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"},"mutualTLS":{"type":"mutualTLS"}},"schemas":{"ImportCertificateRequestDto":{"type":"object","properties":{"x5c":{"type":"array","minItems":1,"description":"Certificate chain in DER base64 format.\n- With `key_name`, provide at least the leaf certificate (full chain is accepted and stored).\n- Without `key_name`, exactly one certificate is required.\n","items":{"type":"string"}},"key_name":{"type":"string","description":"Optional managed signing key name. When present, imports as `managed`."}},"required":["x5c"]},"CertificateResponseDto":{"type":"object","properties":{"certificate":{"$ref":"#/components/schemas/CertificateModelDto"}},"required":["certificate"]},"CertificateModelDto":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["trust_anchor","managed"]},"key_name":{"anyOf":[{"type":"string"},{"type":"null"}]},"x5c":{"type":"array","minItems":1,"items":{"type":"string"}},"fingerprint256":{"description":"Present for `trust_anchor`; `null` for `managed`.","anyOf":[{"type":"string"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time"}},"required":["id","type","key_name","x5c","fingerprint256","created_at"]}}},"paths":{"/system/certificates/import":{"post":{"summary":"Import certificate","description":"Import certificate material in `x5c` form (DER-encoded, base64-encoded items).\n\nBehavior depends on whether `key_name` is provided:\n- With `key_name`: imports a `managed` certificate for that managed signing key.\n - `x5c` must contain at least one certificate.\n - The first item (leaf certificate) public key must match the managed key.\n - The full provided chain is stored.\n - `fingerprint256` is stored as `null`.\n- Without `key_name`: imports a `trust_anchor` certificate.\n - `x5c` must contain exactly one certificate.\n - `fingerprint256` is computed and stored.\n\nNotes:\n- For `mso_mdoc` (mDL) credential issuance the credential key must have a valid DSC certificate; issuance\n will fail without it (see ISO 18013-5 for mDL DSC requirements).\n- When signing CSRs externally (for example with `openssl x509 -req`), explicitly provide extensions\n such as `subjectAltName`, `keyUsage`, and `extendedKeyUsage` so they are present in the issued certificate.\n","operationId":"CertificatesController_importCertificate","parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportCertificateRequestDto"}}}},"responses":{"201":{"description":"Certificate imported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CertificateResponseDto"}}}}},"tags":["Certificates"]}}}} ``` ## Delete certificate > Delete an imported certificate by identifier.\ > \ > Removal deletes either:\ > \- a \`managed\` key-bound certificate chain, or\ > \- a trust entry (\`trust\_anchor\`).\ > \ > Removing a credential signing certificate can break \`mso\_mdoc\` issuance.
```json {"openapi":"3.1.0","info":{"title":"SVX Wallet API","version":"4.0.1"},"servers":[{"url":"https://zyfla-wallet-sandbox.meeco.cloud","description":"SVX Wallet deployment (relative)"}],"security":[{},{"bearerAuth":[]},{"mutualTLS":[]}],"components":{"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"},"mutualTLS":{"type":"mutualTLS"}}},"paths":{"/system/certificates/{certificate_id}":{"delete":{"summary":"Delete certificate","description":"Delete an imported certificate by identifier.\n\nRemoval deletes either:\n- a `managed` key-bound certificate chain, or\n- a trust entry (`trust_anchor`).\n\nRemoving a credential signing certificate can break `mso_mdoc` issuance.\n","operationId":"CertificatesController_deleteCertificate","parameters":[{"name":"certificate_id","in":"path","required":true,"schema":{"type":"string","format":"uuid"},"description":"Certificate ID"}],"responses":{"204":{"description":"Certificate deleted"}},"tags":["Certificates"]}}}} ``` ## Create CSR > Create a Certificate Signing Request (CSR) for a named wallet key and return the CSR PEM.\ > \ > Typical flow: create CSR → sign the CSR with your CA (ensuring required extensions are present) →\ > import the signed chain using \`/system/certificates/import\` with \`key\_name\`.\ > \ > Notes:\ > \- When using \`openssl x509 -req\` to sign a CSR, pass required extensions via \`-extfile\` so attributes such\ > as \`subjectAltName\` and \`keyUsage\` are present in the issued certificate.\ > \- For credential signing keys used with \`mso\_mdoc\`, ensure the issued certificate contains the DSC-related\ > EKUs and usages required by ISO 18013-5.
```json {"openapi":"3.1.0","info":{"title":"SVX Wallet API","version":"4.0.1"},"servers":[{"url":"https://zyfla-wallet-sandbox.meeco.cloud","description":"SVX Wallet deployment (relative)"}],"security":[{},{"bearerAuth":[]},{"mutualTLS":[]}],"components":{"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"},"mutualTLS":{"type":"mutualTLS"}},"schemas":{"CreateCsrRequestDto":{"type":"object","properties":{"key_name":{"type":"string","description":"Managed signing key identifier","enum":["AccessTokenKey","CredentialKey","PresentationRequestKey","AdminSigningKey"]},"subject":{"$ref":"#/components/schemas/CertificateSubjectDto"},"issuer_alternative_name_url":{"type":"array","items":{"type":"string"}}},"required":["key_name","subject"]},"CertificateSubjectDto":{"type":"object","properties":{"common_name":{"type":"string"},"country":{"type":"string"},"state":{"type":"string"},"locality":{"type":"string"},"organization":{"type":"string"},"organizational_unit":{"type":"string"}},"required":["common_name"]},"CsrResponseDto":{"type":"object","properties":{"csr":{"type":"object","properties":{"key_name":{"type":"string"},"csr_pem":{"type":"string"},"created_at":{"type":"string","format":"date-time"}},"required":["key_name","csr_pem","created_at"]}},"required":["csr"]}}},"paths":{"/system/certificates/csrs":{"post":{"summary":"Create CSR","description":"Create a Certificate Signing Request (CSR) for a named wallet key and return the CSR PEM.\n\nTypical flow: create CSR → sign the CSR with your CA (ensuring required extensions are present) →\nimport the signed chain using `/system/certificates/import` with `key_name`.\n\nNotes:\n- When using `openssl x509 -req` to sign a CSR, pass required extensions via `-extfile` so attributes such\n as `subjectAltName` and `keyUsage` are present in the issued certificate.\n- For credential signing keys used with `mso_mdoc`, ensure the issued certificate contains the DSC-related\n EKUs and usages required by ISO 18013-5.\n","operationId":"CertificatesController_createCsr","parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCsrRequestDto"}}}},"responses":{"201":{"description":"CSR created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CsrResponseDto"}}}}},"tags":["Certificates"]}}}} ```