Signers

Create a RICAL signer

POST/v1/ecosystems/certificates/rical-signers

Creates a RICAL signer.

Only available in implementations using unmanaged (external) DTS root CA certificates.
A maximum of five RICAL signers can be created per tenant.

Provide either caId or intermediateCaId.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_CREATE_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_CREATE_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_CREATE_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

`application/json`

curl -X POST "https://example.com/v1/ecosystems/certificates/rical-signers" \  -H "Content-Type: application/json" \  -d '{}'

{  "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1",  "csrPem": "-----BEGIN CERTIFICATE REQUEST-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE REQUEST-----",  "caId": "b0aae560-10e7-4247-8e96-7cdd3578a1e2",  "intermediateCaId": "c1bbe671-21f8-5358-9537-eed4669b43f3",  "active": false}

Retrieve all RICAL signers

GET/v1/ecosystems/certificates/rical-signers

Retrieves all RICAL signers.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_LIST_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_LIST_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_LIST_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Query Parameters

limit?number

Range size of returned list.

Range1 <= value <= 1000

Default100

cursor?string

Starting point for the list of entries.

Response Body

`application/json`

curl -X GET "https://example.com/v1/ecosystems/certificates/rical-signers"

{  "data": [    {      "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1",      "active": true,      "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----",      "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172",      "certificateData": {        "commonName": "example.com",        "country": "US",        "notAfter": "2024-10-22T00:00:00Z",        "notBefore": "2023-10-22T00:00:00Z"      }    }  ],  "nextCursor": "Y3JlYXRlZEF0PTIwMjAtMDgtMjVUMDY6NDY6MDkuNTEwWiZpZD1hNjZmZmVhNS04NDhlLTQzOWQtODBhNC1kZGE1NWY1M2UzNmM"}

Retrieve a RICAL signer

GET/v1/ecosystems/certificates/rical-signers/{ricalSignerId}

Retrieves a RICAL signer.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Path Parameters

ricalSignerId*string

Unique identifier of the RICAL signer.

Formatuuid

Response Body

`application/json`

curl -X GET "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000"

{  "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1",  "active": true,  "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----",  "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172",  "certificateData": {    "commonName": "example.com",    "country": "US",    "notAfter": "2024-10-22T00:00:00Z",    "notBefore": "2023-10-22T00:00:00Z"  }}

Update a RICAL signer

PUT/v1/ecosystems/certificates/rical-signers/{ricalSignerId}

Updates a RICAL signer by:

Providing a RICAL Signer Certificate in PEM format that matches its Certificate Signing Request (CSR).
Activating or deactivating the RICAL signer. Only RICAL signers with a valid certificatePem can be activated.
The certificatePem field becomes immutable after it's updated for the first time.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_UPDATE_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_UPDATE_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_UPDATE_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Path Parameters

ricalSignerId*string

Unique identifier of the RICAL signer.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

`application/json`

curl -X PUT "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000" \  -H "Content-Type: application/json" \  -d '{    "active": true  }'

{  "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1",  "active": true,  "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----",  "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172",  "certificateData": {    "commonName": "example.com",    "country": "US",    "notAfter": "2024-10-22T00:00:00Z",    "notBefore": "2023-10-22T00:00:00Z"  }}

Delete a RICAL signer

DELETE/v1/ecosystems/certificates/rical-signers/{ricalSignerId}

Deletes a RICAL signer.

Deleting a RICAL signer does not affect any RICALs it has already signed — those remain valid. It only means this signer can no longer be used to sign new RICALs.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_DELETE_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_DELETE_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_DELETE_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Path Parameters

ricalSignerId*string

Unique identifier of the RICAL signer.

Formatuuid

Response Body

`application/json`

curl -X DELETE "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000"

Empty

Create a RICAL signer

POST/v1/ecosystems/certificates/rical-signers

Creates a RICAL signer.

Only available in implementations using unmanaged (external) DTS root CA certificates.
A maximum of five RICAL signers can be created per tenant.

Provide either caId or intermediateCaId.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_CREATE_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_CREATE_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_CREATE_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

caId*string

Internal identifier of the DTS root CA certificate that will be used for signing the RICAL signer.

Must be an unmanaged (external) DTS root CA certificate.

Formatuuid

intermediateCaId?string

Internal identifier of the DTS intermediate CA certificate that will be used for signing the RICAL signer.

Formatuuid

Response Body

`application/json`

curl -X POST "https://example.com/v1/ecosystems/certificates/rical-signers" \  -H "Content-Type: application/json" \  -d '{}'

{  "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1",  "csrPem": "-----BEGIN CERTIFICATE REQUEST-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE REQUEST-----",  "caId": "b0aae560-10e7-4247-8e96-7cdd3578a1e2",  "intermediateCaId": "c1bbe671-21f8-5358-9537-eed4669b43f3",  "active": false}

Retrieve all RICAL signers

GET/v1/ecosystems/certificates/rical-signers

Retrieves all RICAL signers.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_LIST_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_LIST_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_LIST_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Query Parameters

limit?number

Range size of returned list.

Range1 <= value <= 1000

Default100

cursor?string

Starting point for the list of entries.

Response Body

`application/json`

curl -X GET "https://example.com/v1/ecosystems/certificates/rical-signers"

{  "data": [    {      "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1",      "active": true,      "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----",      "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172",      "certificateData": {        "commonName": "example.com",        "country": "US",        "notAfter": "2024-10-22T00:00:00Z",        "notBefore": "2023-10-22T00:00:00Z"      }    }  ],  "nextCursor": "Y3JlYXRlZEF0PTIwMjAtMDgtMjVUMDY6NDY6MDkuNTEwWiZpZD1hNjZmZmVhNS04NDhlLTQzOWQtODBhNC1kZGE1NWY1M2UzNmM"}

Retrieve a RICAL signer

GET/v1/ecosystems/certificates/rical-signers/{ricalSignerId}

Retrieves a RICAL signer.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_RETRIEVE_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Path Parameters

ricalSignerId*string

Unique identifier of the RICAL signer.

Formatuuid

Response Body

`application/json`

curl -X GET "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000"

{  "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1",  "active": true,  "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----",  "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172",  "certificateData": {    "commonName": "example.com",    "country": "US",    "notAfter": "2024-10-22T00:00:00Z",    "notBefore": "2023-10-22T00:00:00Z"  }}

Update a RICAL signer

PUT/v1/ecosystems/certificates/rical-signers/{ricalSignerId}

Updates a RICAL signer by:

Providing a RICAL Signer Certificate in PEM format that matches its Certificate Signing Request (CSR).
Activating or deactivating the RICAL signer. Only RICAL signers with a valid certificatePem can be activated.
The certificatePem field becomes immutable after it's updated for the first time.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_UPDATE_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_UPDATE_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_UPDATE_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Path Parameters

ricalSignerId*string

Unique identifier of the RICAL signer.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

active*boolean

Indicates if the RICAL signer is active. Only active RICAL signers can be used to sign RICALs.

certificatePem?string

RICAL Signer Certificate in PEM format.

Must match the Certificate Signing Request (CSR) issued for this RICAL signer.
Must be signed by the same DTS root CA (or DTS intermediate CA) specified when the RICAL signer was created.

Response Body

`application/json`

curl -X PUT "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000" \  -H "Content-Type: application/json" \  -d '{    "active": true  }'

{  "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1",  "active": true,  "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----",  "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172",  "certificateData": {    "commonName": "example.com",    "country": "US",    "notAfter": "2024-10-22T00:00:00Z",    "notBefore": "2023-10-22T00:00:00Z"  }}

Delete a RICAL signer

DELETE/v1/ecosystems/certificates/rical-signers/{ricalSignerId}

Deletes a RICAL signer.

Deleting a RICAL signer does not affect any RICALs it has already signed — those remain valid. It only means this signer can no longer be used to sign new RICALs.

Roles

admindts-provider

Analytics Events

ECOSYSTEM_RICAL_SIGNER_CERTIFICATE_DELETE_STARTECOSYSTEM_RICAL_SIGNER_CERTIFICATE_DELETE_SUCCESSECOSYSTEM_RICAL_SIGNER_CERTIFICATE_DELETE_FAIL

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Path Parameters

ricalSignerId*string

Unique identifier of the RICAL signer.

Formatuuid

Response Body

`application/json`

curl -X DELETE "https://example.com/v1/ecosystems/certificates/rical-signers/123e4567-e89b-12d3-a456-426614174000"

Empty

Roles

Analytics Events

201application/json

400application/json

404application/json

409application/json

Roles

Analytics Events

200application/json

400application/json

404application/json

Roles

Analytics Events

200application/json

404application/json

Roles

Analytics Events

200application/json

400application/json

404application/json

Roles

Analytics Events

204

400application/json

404application/json

On this page

Signers

Roles

Analytics Events

201application/json

400application/json

404application/json

409application/json

Roles

Analytics Events

200application/json

400application/json

404application/json

Roles

Analytics Events

200application/json

404application/json

Roles

Analytics Events

200application/json

400application/json

404application/json

Roles

Analytics Events

204

400application/json

404application/json

On this page

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`