Certificates

List certificates

get

Returns a list of imported certificates and metadata.

Certificates are stored by type:

• managed: bound to a managed signing key (key_name present), may contain a full x5c chain, and has fingerprint256 = null.

• trust_anchor: imported without key_name, must contain exactly one certificate in x5c, and has a non-null fingerprint256.

The response includes certificate id, type, associated key_name (when bound), the stored x5c, and fingerprint256 according to the certificate type rules above.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Responses

200

Certificates list retrieved

application/json

get/system/certificates

HTTPcURLJavaScriptPython

GET /system/certificates HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200

Certificates list retrieved

{
  "certificates": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "type": "trust_anchor",
      "key_name": "text",
      "x5c": [
        "text"
      ],
      "fingerprint256": "text",
      "created_at": "2026-07-15T21:23:37.686Z"
    }
  ]
}

Import certificate

post

Import certificate material in x5c form (DER-encoded, base64-encoded items).

Behavior depends on whether key_name is provided:

• With key_name: imports a managed certificate for that managed signing key.

  • x5c must contain at least one certificate.

  • The first item (leaf certificate) public key must match the managed key.

  • The full provided chain is stored.

  • fingerprint256 is stored as null.

• Without key_name: imports a trust_anchor certificate.

  • x5c must contain exactly one certificate.

  • fingerprint256 is computed and stored.

Notes:

• For mso_mdoc (mDL) credential issuance the credential key must have a valid DSC certificate; issuance will fail without it (see ISO 18013-5 for mDL DSC requirements).

• When signing CSRs externally (for example with openssl x509 -req), explicitly provide extensions such as subjectAltName, keyUsage, and extendedKeyUsage so they are present in the issued certificate.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Body

application/json

x5cstring[] · min: 1Required

Certificate chain in DER base64 format.

• With key_name, provide at least the leaf certificate (full chain is accepted and stored).
• Without key_name, exactly one certificate is required.

key_namestringOptional

Optional managed signing key name. When present, imports as managed.

Responses

201

Certificate imported

application/json

post/system/certificates/import

HTTPcURLJavaScriptPython

POST /system/certificates/import HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 34

{
  "x5c": [
    "text"
  ],
  "key_name": "text"
}

201

Certificate imported

{
  "certificate": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "type": "trust_anchor",
    "key_name": "text",
    "x5c": [
      "text"
    ],
    "fingerprint256": "text",
    "created_at": "2026-07-15T21:23:37.686Z"
  }
}

Delete certificate

delete

Delete an imported certificate by identifier.

Removal deletes either:

• a managed key-bound certificate chain, or

• a trust entry (trust_anchor).

Removing a credential signing certificate can break mso_mdoc issuance.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Path parameters

certificate_idstring · uuidRequired

Certificate ID

Responses

204

Certificate deleted

No content

delete/system/certificates/{certificate_id}

HTTPcURLJavaScriptPython

DELETE /system/certificates/{certificate_id} HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

204

Certificate deleted

No content

Create CSR

post

Create a Certificate Signing Request (CSR) for a named wallet key and return the CSR PEM.

Typical flow: create CSR → sign the CSR with your CA (ensuring required extensions are present) → import the signed chain using /system/certificates/import with key_name.

Notes:

• When using openssl x509 -req to sign a CSR, pass required extensions via -extfile so attributes such as subjectAltName and keyUsage are present in the issued certificate.

• For credential signing keys used with mso_mdoc, ensure the issued certificate contains the DSC-related EKUs and usages required by ISO 18013-5.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Body

application/json

key_namestring · enumRequired

Managed signing key identifier

Possible values:

issuer_alternative_name_urlstring[]Optional

Responses

201

CSR created

application/json

post/system/certificates/csrs

HTTPcURLJavaScriptPython

POST /system/certificates/csrs HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 202

{
  "key_name": "AccessTokenKey",
  "subject": {
    "common_name": "text",
    "country": "text",
    "state": "text",
    "locality": "text",
    "organization": "text",
    "organizational_unit": "text"
  },
  "issuer_alternative_name_url": [
    "text"
  ]
}

201

CSR created

{
  "csr": {
    "key_name": "text",
    "csr_pem": "text",
    "created_at": "2026-07-15T21:23:37.686Z"
  }
}