Signers
Create a RICAL signer
Creates a RICAL signer.
- Only available in implementations using unmanaged (external) DTS root CA certificates.
- A maximum of five RICAL signers can be created per tenant.
Provide either caId or intermediateCaId.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>application/json- body
caId*stringInternal identifier of the DTS root CA certificate that will be used for signing the RICAL signer.
- Must be an unmanaged (external) DTS root CA certificate.
uuidintermediateCaId?stringInternal identifier of the DTS intermediate CA certificate that will be used for signing the RICAL signer.
uuidRICAL signer created
application/json- response
RICAL signer before a RICAL Signer Certificate has been uploaded. Includes the Certificate Signing Request (CSR).
id*stringEach RICAL signer will have a unique identifier which must be provided when using this RICAL signer to sign a RICAL.
uuidcsrPem*stringThe X.509 Certificate Signing Request (CSR) in PEM format. Use this CSR to generate a valid certificate, then update the RICAL signer with the resulting certificate.
caId?stringUnique identifier of the DTS root CA certificate used to sign the RICAL signer.
uuidintermediateCaId?stringUnique identifier of the DTS intermediate CA certificate, if applicable.
uuidactive*falseIndicates if the RICAL signer is active.
- Only active RICAL signers can be used to sign RICALs.
- RICAL signers are created as inactive by default, and cannot be activated until a RICAL Signer Certificate (PEM) has been uploaded.
falsecurl -X POST "https://example.com/v1/ecosystems/certificates/rical-signers" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "csrPem": "-----BEGIN CERTIFICATE REQUEST-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE REQUEST-----", "caId": "b0aae560-10e7-4247-8e96-7cdd3578a1e2", "intermediateCaId": "c1bbe671-21f8-5358-9537-eed4669b43f3", "active": false}Retrieve all RICAL signers
Retrieves all RICAL signers.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>limit?numberRange size of returned list.
1 <= value <= 1000100cursor?stringStarting point for the list of entries.
RICAL signers retrieved
application/json- response
data?array<|>nextCursor?nextCursorStarting point for next cursor to use in a paginated list.
curl -X GET "https://example.com/v1/ecosystems/certificates/rical-signers"{ "data": [ { "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" } } ], "nextCursor": "Y3JlYXRlZEF0PTIwMjAtMDgtMjVUMDY6NDY6MDkuNTEwWiZpZD1hNjZmZmVhNS04NDhlLTQzOWQtODBhNC1kZGE1NWY1M2UzNmM"}Retrieve a RICAL signer
Retrieves a RICAL signer.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>ricalSignerId*stringUnique identifier of the RICAL signer.
uuidRICAL signer retrieved
application/json- response
RICAL signer after a RICAL Signer Certificate has been uploaded. Includes the uploaded certificate in PEM format, as well as the certificate's fingerprint and data.
id*stringEach RICAL signer will have a unique identifier which must be provided when using this RICAL signer to sign a RICAL.
uuidactive*booleanIndicates if the RICAL signer is active. Only active RICAL signers can be used to sign RICALs.
certificatePem*stringRICAL Signer Certificate in PEM format.
certificateFingerprint*stringSHA-256 hash of the certificate content, including all certificate data and its signature.
certificateData*curl -X GET "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000"{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }}Update a RICAL signer
Updates a RICAL signer by:
- Providing a RICAL Signer Certificate in PEM format that matches its Certificate Signing Request (CSR).
- Activating or deactivating the RICAL signer. Only RICAL signers with a valid
certificatePemcan be activated. - The
certificatePemfield becomes immutable after it's updated for the first time.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>ricalSignerId*stringUnique identifier of the RICAL signer.
uuidapplication/json- body
active*booleanIndicates if the RICAL signer is active. Only active RICAL signers can be used to sign RICALs.
certificatePem?stringRICAL Signer Certificate in PEM format.
- Must match the Certificate Signing Request (CSR) issued for this RICAL signer.
- Must be signed by the same DTS root CA (or DTS intermediate CA) specified when the RICAL signer was created.
RICAL signer updated
application/json- response
RICAL signer after a RICAL Signer Certificate has been uploaded. Includes the uploaded certificate in PEM format, as well as the certificate's fingerprint and data.
id*stringEach RICAL signer will have a unique identifier which must be provided when using this RICAL signer to sign a RICAL.
uuidactive*booleanIndicates if the RICAL signer is active. Only active RICAL signers can be used to sign RICALs.
certificatePem*stringRICAL Signer Certificate in PEM format.
certificateFingerprint*stringSHA-256 hash of the certificate content, including all certificate data and its signature.
certificateData*curl -X PUT "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000" \ -H "Content-Type: application/json" \ -d '{ "active": true }'{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }}Delete a RICAL signer
Deletes a RICAL signer.
Deleting a RICAL signer does not affect any RICALs it has already signed — those remain valid. It only means this signer can no longer be used to sign new RICALs.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>ricalSignerId*stringUnique identifier of the RICAL signer.
uuidRICAL signer deleted
curl -X DELETE "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000"How would you rate this page?
Last updated on