KeyTalk API Reference
Certificate & Key Management
Download OpenAPI specification:
KeyTalk certificate and key management & enrolment virtual appliance - REST API.
This specification covers five distinct API groups exposed by a KeyTalk server, extracted from the "KeyTalk - Protocols" reference document (document version 2.8.9, last updated 2026-07-15):
/rcdp/... - the protocol used by KeyTalk end-user agents
to obtain certificates. Session-based (cookie keytalkcookie), 3 phases: handshake, authentication,
service provision./public/... - unauthenticated (or certificate-parameter-based) informational calls./admapi/... - management calls used by the KeyTalk Web Admin Interface,
authenticated with either a username/password pair supplied as request body fields, or a TLS client
certificate./ssapi/... - S/MIME enrolment for external parties, authenticated purely via
TLS client certificate + key./ca/... - fetch KeyTalk's internal trust chain
certificates, unauthenticated.keytalkcookie, returned by /rcdp/hello in a Set-Cookie header and
required on every subsequent RCDPv2 call in this session (except hello itself). This is modeled as
the keytalkCookieAuth API-key (cookie) security scheme.Authorization: Basic header.
Per section 4.2: "All the API calls should be authenticated using credentials of the Web Admin
Interface (username/password or a client certificate)" - and every example in the document passes
credentials as the ordinary POST body fields auth-username / auth-password (see each operation's
request body), OR alternatively via a mutual-TLS client certificate (curl --cert/--key). Because
OpenAPI 3.0.3 has no clean way to model "mutual TLS OR body-embedded credentials", a basicAuth
(http/basic) security scheme is declared for documentation completeness/tooling compatibility, but
it is not actually placed in the security requirement of Administrator operations - the true
credential transport is the auth-username/auth-password request-body properties, which are marked
optional on every Administrator operation ("required if the webserver is configured with
username/password authentication"; otherwise a client certificate presented at the TLS layer is used).
This is flagged explicitly because it deviates from conventional HTTP Basic auth.security block.<version> path segmentsRCDPv2, Public API and Administrator API all support two forms of every path: /xxx/<action> (uses the
latest protocol version supported by the server) and /xxx/<version>/<action> (pins a specific
protocol version). Both forms are modeled below as sibling paths: a version-less "latest" alias and a
{version}-templated path.
This specification was live-tested against a real KeyTalk demo deployment across two passes, each using a disposable KeyTalk-provided test seat account (account names/passwords intentionally omitted from this public document). Results:
https://demo1.keytalkdemo.com - KeyTalk server v8.1.4, RCDP protocol v2.8.5.hello → handshake → auth-requirements (service=Internal_server_auth) →
authentication (credential types USERID, HWSIG, PASSWD; server returned auth-status: "OK" both
times) → last-messages → csr-requirements → cert (format=PEM; server returned a real issued
X.509 certificate plus a private key both times). Second pass also confirmed the flow works when
calling the version-less host with no explicit port (https://demo1.keytalkdemo.com/), matching the
servers entry below exactly./public/version (returned {"status":"version","version":"8.1.4"}),
/public/health-check (returned {"status":"health-check","check-result":"operational"}),
/public/cn-customization-policy, /public/cert-expiration-margin./admapi/list-templates) is reachable at the correct path and port
(https://demo1.keytalkdemo.com:3000), but the test account's template does not have Administrator
REST API access enabled, so the call returned a scoped HTTP 400
({"status":"error","error":"Administrator REST API calls are disabled for the given template"})
rather than data. The request/response shape still matched this spec - this is a real business-logic
rejection, not a routing/404 failure, and it confirms the path + port are correct.Internal_server_auth - neither
is an Administrator API or Web Admin GUI user/credential. Nothing elsewhere in this spec should be read
as implying either account works for /admapi/... calls.auth-requirements
(seat mode: USERID + computer-name, then HWSIG) returned encrypted-challenge → decrypted per
the OpenSSL recipe in the RESPONSE field's description → authentication with only RESPONSE (no
USERID/PASSWD at all) returned auth-status: "OK" → a subsequent /rcdp/cert call on that same
session issued a fresh certificate. Found and corrected a real documentation bug in the process:
see the RESPONSE property description under AuthenticationRequest for the exact fix (the decrypted
challenge's size# prefix must be stripped before sending, contrary to the source document's
wording). This is KeyTalk's certificate-based re-authentication mode - it runs over ordinary HTTPS,
using the certificate only to decrypt an application-layer challenge, not as a TLS client certificate
presented during the handshake (RCDPv2 has no genuine mutual-TLS mode; true mTLS is used only by the
Self-Service API and optionally the Administrator API, per their respective sections above).ACME_DigiCert_GeoTrust_demo, ACME_GeoTrust,
ALSTOMGROUP-TRAIN-CERT-DEMO, Demo-TLS-PrivateCA, Digicert_Basic_OV, Internal_server_auth (used
above), Internal_server_auth_II, KeyTalk_Demo_SMIMI_DigiCert, User_Certificate.https://demo1.keytalk.com:3000 (note: keytalk.com, not keytalkdemo.com) - one of the three
URLs originally supplied for validation - is completely unreachable (DNS/connection failure, no
HTTP response at all; confirmed via direct browser navigation showing a connection-error page). This
appears to be a typo for demo1.keytalkdemo.com:3000 and has been excluded from the servers list
below; do not use it as a target host.Certificate Retrieval API (RCDPv2) - handshake, authentication and service-provision phases used by KeyTalk end-user agents.
Ends RCDPv2 communication. Can be sent at any time by either side. Alias of /rcdp/{version}/eoc using the latest protocol version supported by the server.
| reason | string Example: reason=bye, server Optional reason for ending communication. |
{- "status": "eoc",
- "reason": "string"
}Ends RCDPv2 communication. Can be sent at any time, initiated by any communication side.
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| reason | string Example: reason=bye, server Optional reason for ending communication. |
{- "status": "eoc",
- "reason": "string"
}Typically sent by the server to notify the caller of an error. The client can also send this to the
server when it cannot handle the server's response. Alias of /rcdp/{version}/error using the
latest protocol version supported by the server.
| code required | integer Example: code=1066 Numeric error code. |
| description | string Example: description=invalid response Optional error description. Might be required for certain error codes. |
{- "status": "error",
- "code": 1066,
- "description": "string"
}Errors are typically sent by the server to notify the caller of an error while processing its request. The client can also send errors to the server when it can't handle the server's response.
| code | name | direction | remarks |
|---|---|---|---|
| 1001 | ErrResolvedIpInvalid | server -> client | Sent when none of the IPs resolved by the client and by the server match. |
| 1002 | ErrDigestInvalid | server -> client | Sent when the client's calculated executable digest does not match the digest stored on the server. |
| 1003 | ErrTimeOutOfSync | server -> client | Sent when the client time is out of sync with the server's time (by the given number of seconds). |
| 1004 | ErrMaxLicensedUsersReached | server -> client | Sent when no certificate can be supplied because the max number of licensed users has been reached. |
| 1005 | ErrPasswordExpired | server -> client | Sent when the user's password is expired and the caller is not supposed to change it. |
| 1006 | ErrIncompatibleProtocolVersion | server -> client | Sent when further communication is not possible because the client's API version is not supported (normally too old). |
| 1007 | ErrTpmEkCertNotIssuedByEkCa | server -> client | Sent to indicate the TPM Endorsement certificate presented in a TPM attestation request is not issued by the TPM Endorsement CA configured on the server. |
| 1008 | ErrTpmEkCertMismatchEkPubBlob | server -> client | Sent to indicate the TPM Endorsement certificate and the public BLOB presented in a TPM attestation request do not correspond to each other. |
| 1009 | ErrInvalidSeat | server -> client | [as of v2.7.7] Sent to indicate the seat supplied by the caller cannot be used for authentication, typically because the seat does not exist, is archived, or lacks a valid certificate. |
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| code required | integer Example: code=1066 Numeric error code. |
| description | string Example: description=invalid response Optional error description. Might be required for certain error codes. |
{- "status": "error",
- "code": 1066,
- "description": "string"
}Agree on RCDP API version and establish a session ID. Alias of /rcdp/{version}/hello using the latest protocol version supported by the server. Does NOT require the keytalkcookie session cookie (it is issued by this call).
| caller-app-description | string Example: caller-app-description=Demo KeyTalk Agent Optional description of the caller application. |
{- "status": "hello",
- "version": "string"
}Agree on RCDP API version and establish a session ID. The RCDP API version proposed by the caller
is sent as part of the HTTP GET path. The session ID is returned in the keytalkcookie HTTP cookie
via the Set-Cookie response header, and must be sent back (as a Cookie request header) on every
subsequent RCDPv2 call in this session.
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| caller-app-description | string Example: caller-app-description=Demo KeyTalk Agent Optional description of the caller application. |
{- "status": "hello",
- "version": "string"
}Confirm the version handshake and exchange time information. Alias of /rcdp/{version}/handshake using the latest protocol version supported by the server.
| caller-utc required | string <date-time> Example: caller-utc=2023-04-14T10:44:35Z Caller UTC time, ISO 8601 format including date and time. |
{- "status": "handshake",
- "server-utc": "2019-08-24T14:15:22Z"
}Confirm version handshake and exchange time information. If the caller agrees with the API version
proposed by the server on the previous (hello) step, it proceeds with this version by putting it
in the path here. Otherwise, the caller ends communication (eoc).
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| caller-utc required | string <date-time> Example: caller-utc=2023-04-14T10:44:35Z Caller UTC time, ISO 8601 format including date and time. |
{- "status": "handshake",
- "server-utc": "2019-08-24T14:15:22Z"
}Alias of /rcdp/{version}/auth-requirements using the latest protocol version supported by the server. See that operation for the full description of all three usage modes.
| service | string Example: service=DEMO_SERVICE KeyTalk TEMPLATE (service) name. Required for the template-wide and seat-wide-step-1 usage modes. |
| USERID | string Example: USERID=Jos [as of v2.8.1] User ID of the caller. Required (together with |
| computer-name | string Example: computer-name=joscomp [as of v2.8.1] Caller's machine/device name. Required (together with |
| HWSIG | string Example: HWSIG=CS-123456 [as of v2.8.1] Hardware Signature of the caller's device, calculated over the formula returned in |
{- "status": "auth-requirements",
- "credential-types": [
- "HWSIG",
- "PASSWD",
- "USERID",
- "OTP/MFA"
], - "hwsig_formula": "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16",
- "password-prompt": "Password",
- "resolve-service-uris": "true",
- "calc-service-uris-digest": "string",
- "use-tpm-vsc-authentication": "yes",
- "use-kerberos-authentication": true,
- "supply-computer-name": true,
- "mfa-settings": {
- "kind": "mfa-popups",
- "client-id": "01234567-89ab-cdef-0123-456789abcdef",
- "scopes": [
- "User.Read.All",
- "Mail.Read"
],
}
}This single endpoint serves three distinct request/response shapes, distinguished by which query parameters are supplied:
service (the KeyTalk
TEMPLATE name). Returns credential-types and associated hints (hwsig_formula,
password-prompt, service-uris, resolve-service-uris, calc-service-uris-digest,
use-tpm-vsc-authentication, use-kerberos-authentication, supply-computer-name,
mfa-settings).service, USERID and computer-name. Returns either hwsig_formula (when an HWSIG formula is
configured for the TEMPLATE) or encrypted-challenge (when it is not).HWSIG
(the hardware signature calculated over the formula returned in step 1). Returns
encrypted-challenge: a random string S/MIME-encrypted with the public key of the latest issued
certificate for the resolved seat, base64-encoded. The seat must exist, not be archived, and have
a valid, non-revoked certificate, otherwise ErrInvalidSeat (error code 1009) is returned. The
caller decrypts the challenge with the private key of the seat's certificate and sends it back in
the subsequent /authentication (seat-wide authentication) request as the RESPONSE credential.| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| service | string Example: service=DEMO_SERVICE KeyTalk TEMPLATE (service) name. Required for the template-wide and seat-wide-step-1 usage modes. |
| USERID | string Example: USERID=Jos [as of v2.8.1] User ID of the caller. Required (together with |
| computer-name | string Example: computer-name=joscomp [as of v2.8.1] Caller's machine/device name. Required (together with |
| HWSIG | string Example: HWSIG=CS-123456 [as of v2.8.1] Hardware Signature of the caller's device, calculated over the formula returned in |
{- "status": "auth-requirements",
- "credential-types": [
- "HWSIG",
- "PASSWD",
- "USERID",
- "OTP/MFA"
], - "hwsig_formula": "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16",
- "password-prompt": "Password",
- "resolve-service-uris": "true",
- "calc-service-uris-digest": "string",
- "use-tpm-vsc-authentication": "yes",
- "use-kerberos-authentication": true,
- "supply-computer-name": true,
- "mfa-settings": {
- "kind": "mfa-popups",
- "client-id": "01234567-89ab-cdef-0123-456789abcdef",
- "scopes": [
- "User.Read.All",
- "Mail.Read"
],
}
}Alias of /rcdp/{version}/authentication using the latest protocol version supported by the server. See that operation for the full description of all four usage modes.
| service | string KeyTalk service (template) name. Used by the template-wide and start-OTP/MFA modes. |
| caller-hw-description | string Caller HW description, unique per device (e.g. BIOS serial number or iOS device UDID). Used by template-wide, seat-wide and start-OTP/MFA modes. |
| USERID | string ID of the user. Required if previously set by the server in |
| HWSIG | string Hardware Signature calculated with the formula from the preceding |
| PASSWD | string User password. Required if previously requested by the server. |
| PIN | string User pincode. Required if previously requested by the server. |
| OTP/MFA | string [as of v2.7.5] OTP acquired via an alternative channel, or MFA Access Token. Can only be used once per positive authentication. |
| resolved | string JSON-encoded array of |
| digests | string JSON-encoded array of |
object Kerberos TGT. Present if | |
| computer-name | string Caller's machine/device name. Required if |
| retired-computer-name | string Only passed when |
| RESPONSE | string Seat-wide authentication: the value of Live-tested correction (2026-07-30): decrypting |
| responses | string Challenge-response authentication: JSON-encoded array of |
service=DEMO_SERVICE&caller-hw-description=Windows%2011%2C%20BIOS%20s%2Fn%201234567890&USERID=DemoUser&HWSIG=CS-123456&PASSWD=change%21&resolved=%5B%7B%22uri%22%3A%22https%3A%2F%2Fdemo.keytalk.com%2F%22%2C%22ips%22%3A%5B%2281.175.103.107%22%5D%7D%5D
{- "status": "auth-result",
- "auth-status": "OK"
}This single endpoint serves four distinct request/response flows, distinguished by which form
fields are supplied. Content-Type is always application/x-www-form-urlencoded.
service, caller-hw-description, and
whichever of USERID/HWSIG/PASSWD/PIN/OTP/MFA/resolved/digests/kerberos-ticket/
computer-name/retired-computer-name were requested by the preceding /auth-requirements
call).RESPONSE (the decrypted
encrypted-challenge from the seat-wide /auth-requirements flow, encoded as size#challenge)
and caller-hw-description.responses, a JSON array of
{name, value} objects answering a previously-received CHALLENGE.service,
caller-hw-description, and whichever of USERID/HWSIG/computer-name were requested, after
receiving "OTP/MFA" in credential-types. On success the caller receives WAIT-FOR-OTP and
should obtain an OTP via an alternative channel (email/SMS) or trigger the MFA flow, then
re-submit template-wide authentication with the OTP/Access Token supplied as the OTP/MFA
credential.auth-status values (used across all four flows)OK - authentication successful.DELAY - authentication was not successful; delay gives the number of seconds before retrying (can be 0).LOCKED - cannot log in because the user is locked on the server; delay gives remaining lock time.EXPIRED - authentication not successful because the user's password is expired.CHALLENGE - the server supplied a challenge; challenges and optionally response-names are set.KERBEROS-AUTH-NOK - Kerberos ticket validation failed (e.g. expired); the caller may retry with remaining credentials (no user lock is applied).WAIT-FOR-OTP - the caller's identity was verified; wait for the OTP (or trigger MFA) and resubmit with it as a credential. Can only be used once per positive authentication.| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| service | string KeyTalk service (template) name. Used by the template-wide and start-OTP/MFA modes. |
| caller-hw-description | string Caller HW description, unique per device (e.g. BIOS serial number or iOS device UDID). Used by template-wide, seat-wide and start-OTP/MFA modes. |
| USERID | string ID of the user. Required if previously set by the server in |
| HWSIG | string Hardware Signature calculated with the formula from the preceding |
| PASSWD | string User password. Required if previously requested by the server. |
| PIN | string User pincode. Required if previously requested by the server. |
| OTP/MFA | string [as of v2.7.5] OTP acquired via an alternative channel, or MFA Access Token. Can only be used once per positive authentication. |
| resolved | string JSON-encoded array of |
| digests | string JSON-encoded array of |
object Kerberos TGT. Present if | |
| computer-name | string Caller's machine/device name. Required if |
| retired-computer-name | string Only passed when |
| RESPONSE | string Seat-wide authentication: the value of Live-tested correction (2026-07-30): decrypting |
| responses | string Challenge-response authentication: JSON-encoded array of |
service=DEMO_SERVICE&caller-hw-description=Windows%2011%2C%20BIOS%20s%2Fn%201234567890&USERID=DemoUser&HWSIG=CS-123456&PASSWD=change%21&resolved=%5B%7B%22uri%22%3A%22https%3A%2F%2Fdemo.keytalk.com%2F%22%2C%22ips%22%3A%5B%2281.175.103.107%22%5D%7D%5D
{- "status": "auth-result",
- "auth-status": "OK"
}Alias of /rcdp/{version}/change-password using the latest protocol version supported by the server.
| old-password required | string Current (old) user password. |
| new-password required | string New user password. |
old-password=changeme&new-password=changed
{- "status": "auth-result",
- "auth-status": "OK"
}Changes the user's password. Password-change must be supported by the server's backend (e.g. Active
Directory). A caller should normally change the password after an EXPIRED authentication result,
or proactively when password-validity hints the password is about to expire.
The response uses the same AuthResult shape as /authentication, but auth-status is limited to
OK (password changed, caller must re-authenticate with the new password), DELAY (change did not
succeed, e.g. incorrect old password or too-short new password; retry after delay seconds), or
LOCKED.
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| old-password required | string Current (old) user password. |
| new-password required | string New user password. |
old-password=changeme&new-password=changed
{- "status": "auth-result",
- "auth-status": "OK"
}Alias of /rcdp/{version}/last-messages using the latest protocol version supported by the server.
| from-utc | string <date-time> Example: from-utc=2023-04-26T06:49:55.614010Z UTC (ISO 8601) to request messages from. Defaults to requesting all server messages. |
{- "status": "last-messages",
- "messages": [
- {
- "text": "This is user message number 1",
- "utc": "2017-04-06T04:15:15+0000"
}
]
}Check for the last server messages. Server messages are meant for KeyTalk users, e.g. to indicate planned server maintenance.
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| from-utc | string <date-time> Example: from-utc=2023-04-26T06:49:55.614010Z UTC (ISO 8601) to request messages from. Defaults to requesting all server messages. |
{- "status": "last-messages",
- "messages": [
- {
- "text": "This is user message number 1",
- "utc": "2017-04-06T04:15:15+0000"
}
]
}Alias of /rcdp/{version}/cert using the latest protocol version supported by the server. See that operation for the full description.
| format | string Enum: "PEM" "P12" "P12v2" Server-generated-keypair flow only. |
| out-of-band | boolean Default: false When set, the server returns a download URL for the certificate instead of the certificate itself. |
| response | string JSON-encoded |
object Cookie received in a previous | |
| common-name | string Common Name to use in the certificate. Only honored if allowed by the server (see Public API |
| given-name | string [as of v2.8.2] Given name (first name), used in the certificate and CN. Only honored if |
| surname | string [as of v2.8.2] Surname (second name), used in the certificate and CN. Only honored if |
| san-domains | Array of strings [as of v2.8.3] Extra SAN domains to use in the certificate. |
| csr | string Client-supplied-CSR flow only. Base64-encoded PKCS#10 certificate signing request. |
| tpm-evidence | string [as of v2.7.2] Client-supplied-CSR flow only. Required when TPM attestation is in effect (i.e.
|
format=P12v2{- "status": "cert",
- "cert": "string",
- "execute-sync": false,
- "store-to-system": "true",
- "apply-address-books": "true",
- "address-books": [
- {
- "ldap_svr_url": "string",
- "search_base": "ou=people,dc=example,dc=com",
- "verification_ca": "string"
}
], - "apply-smime-settings": "true",
- "set-disclaimer": "true",
- "historical-certs": [
- "string"
], - "historical-certs-url-templ": "string"
}This single endpoint serves two related enrolment flows plus a shared multi-step
challenge/polling protocol. Content-Type is always application/x-www-form-urlencoded.
format (PEM, P12, or P12v2), and optionally out-of-band, common-name,
given-name/surname ([as of v2.8.2]), san-domains ([as of v2.8.3]), or a previous
cert-challenge/submitted/in-progress continuation via response/cookie.GET /csr-requirements). Pass csr (base64-encoded PKCS#10),
and optionally out-of-band and tpm-evidence ([as of v2.7.2], required when TPM attestation is
in effect).Both flows can return one of four response shapes (see CertOperationResponse):
cert - the certificate (and optionally address books / disclaimer / historical certs) is
returned immediately, or a cert-url-templ for out-of-band download.cert-challenge - extra info is required from the client before issuing (e.g.
select-globalsign-domainssl-approver-email); resend /cert with response and cookie.submitted / in-progress - the request needs time or an extra external action; poll /cert
again using the returned cookie.pending-approval - the request requires manual approval; poll /cert again.PEM-encoded certificates/keys are encrypted with the first 30 characters of the session ID
(keytalkcookie); PKCS#12 packages are likewise encrypted and then base64-encoded for JSON
transport. Note JSON-serialized PEM blocks must escape / as \/.
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| format | string Enum: "PEM" "P12" "P12v2" Server-generated-keypair flow only. |
| out-of-band | boolean Default: false When set, the server returns a download URL for the certificate instead of the certificate itself. |
| response | string JSON-encoded |
object Cookie received in a previous | |
| common-name | string Common Name to use in the certificate. Only honored if allowed by the server (see Public API |
| given-name | string [as of v2.8.2] Given name (first name), used in the certificate and CN. Only honored if |
| surname | string [as of v2.8.2] Surname (second name), used in the certificate and CN. Only honored if |
| san-domains | Array of strings [as of v2.8.3] Extra SAN domains to use in the certificate. |
| csr | string Client-supplied-CSR flow only. Base64-encoded PKCS#10 certificate signing request. |
| tpm-evidence | string [as of v2.7.2] Client-supplied-CSR flow only. Required when TPM attestation is in effect (i.e.
|
format=P12v2{- "status": "cert",
- "cert": "string",
- "execute-sync": false,
- "store-to-system": "true",
- "apply-address-books": "true",
- "address-books": [
- {
- "ldap_svr_url": "string",
- "search_base": "ou=people,dc=example,dc=com",
- "verification_ca": "string"
}
], - "apply-smime-settings": "true",
- "set-disclaimer": "true",
- "historical-certs": [
- "string"
], - "historical-certs-url-templ": "string"
}Alias of /rcdp/{version}/csr-requirements using the latest protocol version supported by the server.
{- "status": "csr-requirements",
- "subject": {
- "cn": "TestUser",
- "c": "NL",
- "st": "Utrecht",
- "l": "Amersfoort",
- "o": "KeyTalk",
- "ous": [
- "Development",
- "Administration"
], - "e": "test@keytalk.com"
}, - "san": [
- "email:test@keytalk.com",
- "DNS:test.keytalk.com"
]
}A client might want to generate a key pair itself and submit the resulting CSR to the KeyTalk server
for signing (see /cert, flow 2). Before doing that, the client should query the server for the
initial parameters to use in the CSR: certificate subject and Subject Alternative Names. [as of
v2.8.5] key-size and signing-algo are no longer included in the response. [as of server v7.4.1]
empty subject attribute values / an empty san array should be treated by the caller as "any"
rather than a literal empty value. [as of server v7.7.11] the single-value subject.ou was replaced
by the multi-value subject.ous.
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
{- "status": "csr-requirements",
- "subject": {
- "cn": "TestUser",
- "c": "NL",
- "st": "Utrecht",
- "l": "Amersfoort",
- "o": "KeyTalk",
- "ous": [
- "Development",
- "Administration"
], - "e": "test@keytalk.com"
}, - "san": [
- "email:test@keytalk.com",
- "DNS:test.keytalk.com"
]
}Alias of /rcdp/{version}/tpm-attestation using the latest protocol version supported by the server.
| ek-cert required | string PEM-encoded TPM Endorsement Certificate. |
| ek-pub-blob required | string Base64-encoded Endorsement Public Key BLOB. |
| ak-name required | string TPM Attestation Key name. |
{- "status": "tpm-attestation",
- "challenge": "string"
}[as of v2.7.2] Starts the TPM attestation procedure with the server. On successful verification of
the supplied TPM Endorsement Certificate/Public Key BLOB, the server returns a challenge to be used
by the TPM for calculating evidence, which is then supplied back in the tpm-evidence parameter of
a subsequent /cert (client CSR flow) request.
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| ek-cert required | string PEM-encoded TPM Endorsement Certificate. |
| ek-pub-blob required | string Base64-encoded Endorsement Public Key BLOB. |
| ak-name required | string TPM Attestation Key name. |
{- "status": "tpm-attestation",
- "challenge": "string"
}Alias of /rcdp/{version}/store-certs using the latest protocol version supported by the server.
| certificates required | string Concatenated list of PEM certificates with private keys. |
| common-name | string [as of v2.8.4] Common Name to use in the certificate. Only honored if allowed by the server (see the Public API |
| given-name | string [as of v2.8.4] Given name (first name), used in the certificate and CN. Only honored if the CN policy returns |
| surname | string [as of v2.8.4] Surname (second name), used in the certificate and CN. Only honored if the CN policy returns |
{- "status": "store-certificates",
- "stored-this-seat": [
- "string"
], - "stored-other-seats": [
- "string"
], - "skipped": [
- "string"
]
}[as of v2.7.4] Stores certificates along with their private keys to the server. [as of v2.8.4] the
response differentiates certificates stored under the authenticated seat vs. under other seats, and
the request additionally honors common-name/given-name/surname overrides (subject to the CN
customization policy, see the Public API cn-customization-policy call).
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| certificates required | string Concatenated list of PEM certificates with private keys. |
| common-name | string [as of v2.8.4] Common Name to use in the certificate. Only honored if allowed by the server (see the Public API |
| given-name | string [as of v2.8.4] Given name (first name), used in the certificate and CN. Only honored if the CN policy returns |
| surname | string [as of v2.8.4] Surname (second name), used in the certificate and CN. Only honored if the CN policy returns |
{- "status": "store-certificates",
- "stored-this-seat": [
- "string"
], - "stored-other-seats": [
- "string"
], - "skipped": [
- "string"
]
}Alias of /rcdp/{version}/smbcerts using the latest protocol version supported by the server.
| format required | string Enum: "P12" "PEM" "P12v2" Format of the SMB certificates (same semantics as |
| out-of-band | boolean Default: false [as of v2.7.9] When set, the server sends back a download URL instead of the certificate itself. |
{- "status": "smbcerts",
- "apply-smime-settings": true,
- "smbcerts": [
- {
- "upn": "string",
- "cert": "string",
- "cert-url-templ": "string",
- "historical-certs": [
- "string"
], - "historical-certs-url-templ": "string"
}
]
}[as of v2.8.1] Retrieves the list of Shared Mailboxes (SMBs), along with their certificates, that
belong to the seat previously resolved from the USERID and computer-name submitted during the
authentication phase. [as of v2.7.9] supports out-of-band delivery (a download URL template
instead of the certificate data). [as of v2.8.4] the response communicates the
apply-smime-settings flag. [as of v2.7.7] this allows retrieving certificates for all Shared
Mailboxes of the given seat. [as of v2.7.9] adds support for out-of-band retrieval of SMB
certificates.
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| format required | string Enum: "P12" "PEM" "P12v2" Format of the SMB certificates (same semantics as |
| out-of-band | boolean Default: false [as of v2.7.9] When set, the server sends back a download URL instead of the certificate itself. |
{- "status": "smbcerts",
- "apply-smime-settings": true,
- "smbcerts": [
- {
- "upn": "string",
- "cert": "string",
- "cert-url-templ": "string",
- "historical-certs": [
- "string"
], - "historical-certs-url-templ": "string"
}
]
}Alias of /rcdp/{version}/cert-scraping-settings using the latest protocol version supported by the server.
{- "status": "cert-scraping-settings",
- "schedule": "never",
- "cert-purposes": [
- "smime"
], - "cert-store-types": [
- "personal"
]
}[as of v2.7.8] Queries the settings for the caller (typically the KeyTalk Windows Certificate
Scanner agent) to scan for certificates and keys and send them to the KeyTalk server using the
/store-certs call (section 2.7.6).
| version required | string Enum: "2.7.4" "2.7.5" "2.7.6" "2.7.7" "2.7.8" "2.7.9" "2.8.0" "2.8.1" "2.8.2" "2.8.3" "2.8.4" "2.8.5" Example: 2.8.5 RCDPv2 protocol version to use. Documented versions (see section 2.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
{- "status": "cert-scraping-settings",
- "schedule": "never",
- "cert-purposes": [
- "smime"
], - "cert-store-types": [
- "personal"
]
}Alias of /public/{version}/self-service-availability using the latest Public API version.
| cert required | string PEM-encoded X.509 user certificate previously received from KeyTalk, identifying the caller. |
{- "status": "self-service-availability",
- "available": true
}Retrieves whether self-service is available for the given account, identified by a previously-issued KeyTalk PEM certificate.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| cert required | string PEM-encoded X.509 user certificate previously received from KeyTalk, identifying the caller. |
{- "status": "self-service-availability",
- "available": true
}Alias of /public/{version}/address-book-list using the latest Public API version.
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
{- "status": "address-book-list",
- "apply-address-books": true,
- "address-books": [
- {
- "ldap_svr_url": "string",
- "search_base": "ou=people,dc=example,dc=com",
- "verification_ca": "string"
}
]
}Retrieves URLs of address books used by back-end LDAP/AD servers, for the given KeyTalk service (template).
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
{- "status": "address-book-list",
- "apply-address-books": true,
- "address-books": [
- {
- "ldap_svr_url": "string",
- "search_base": "ou=people,dc=example,dc=com",
- "verification_ca": "string"
}
]
}Alias of /public/{version}/smime-cert-enrollment-availability using the latest Public API version.
| cert required | string PEM-encoded X.509 S/MIME certificate previously received from KeyTalk, identifying the caller as a self-service-eligible user. |
| synchronous | boolean Default: true When |
{- "status": "smime-cert-enrollment-availability",
- "available": true,
- "mobile-required": true,
- "reason": "string"
}Checks the availability and requirements for S/MIME certificate enrolment to external parties for
the given self-service account, identified by a previously-issued S/MIME PEM certificate.
synchronous (default true) selects between an immediate enrolment check and an
order-placement-only check (asynchronous S/MIME orders are currently only supported by KeyTalk
services bound to GlobalSign PersonalSign products).
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| cert required | string PEM-encoded X.509 S/MIME certificate previously received from KeyTalk, identifying the caller as a self-service-eligible user. |
| synchronous | boolean Default: true When |
{- "status": "smime-cert-enrollment-availability",
- "available": true,
- "mobile-required": true,
- "reason": "string"
}Alias of /public/{version}/should-cert-go-to-system-store using the latest Public API version.
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
{- "status": "should-cert-go-to-system-store",
- "system-store": true
}Queries the type of certificate store to place a certificate received via the Certificate Retrieval
API. Identical result to the store-to-system flag returned from POST /rcdp/cert, but obtainable
without going through the entire handshake-authentication procedure.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
{- "status": "should-cert-go-to-system-store",
- "system-store": true
}Alias of /public/{version}/set-disclaimer-for-smime-cert-email using the latest Public API version.
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
| email required | string <email> Email address for which to request a disclaimer. |
{- "status": "set-disclaimer-for-smime-cert-email",
- "set-disclaimer": true,
- "disclaimer": {
- "name": "string",
- "zip": "string",
- "check-interval": 0
}
}Requests an email disclaimer based on the provided email address for the provided service. If the service is set up to supply a disclaimer, the response contains a disclaimer to be applied to the mail client.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
| email required | string <email> Email address for which to request a disclaimer. |
{- "status": "set-disclaimer-for-smime-cert-email",
- "set-disclaimer": true,
- "disclaimer": {
- "name": "string",
- "zip": "string",
- "check-interval": 0
}
}Alias of /public/{version}/cert-approver-emails using the latest Public API version.
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
| user required | string User name. Should match the USERID used in the RCDP authentication request. |
| computer-name required | string Caller's machine/device name. Should match the computer name used in the RCDP authentication request. |
{- "status": "cert-approver-emails",
- "emails": [
- "user@example.com"
]
}Queries approver emails for the certificate. Typically used by services configured with a 3rd-party CA, e.g. GlobalSign DomainSSL or GlobalSign AlphaSSL.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
| user required | string User name. Should match the USERID used in the RCDP authentication request. |
| computer-name required | string Caller's machine/device name. Should match the computer name used in the RCDP authentication request. |
{- "status": "cert-approver-emails",
- "emails": [
- "user@example.com"
]
}Queries the KeyTalk server version.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
{- "status": "version",
- "version": "string"
}Alias of /public/{version}/cn-customization-policy using the latest Public API version.
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
| user required | string User name. Should match the USERID used in the RCDP authentication request. |
| computer-name required | string Caller's machine/device name. Should match the computer name used in the RCDP authentication request. |
{- "status": "cn-customization-policy",
- "policy": "ALLOWED"
}Queries the Common Name customization policy for the given user, used to decide whether common-name/given-name/surname may be supplied on /rcdp/cert or /rcdp/store-certs.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
| user required | string User name. Should match the USERID used in the RCDP authentication request. |
| computer-name required | string Caller's machine/device name. Should match the computer name used in the RCDP authentication request. |
{- "status": "cn-customization-policy",
- "policy": "ALLOWED"
}Alias of /public/{version}/templates-to-auto-renew-seat-certs using the latest Public API version.
| template-names required | string JSON-encoded array of template names to check. |
{- "status": "templates-to-auto-renew-seat-certs",
- "template-names": [
- "string"
]
}Checks which of the submitted templates (services) seat-certificate auto-renewal should be applied to. When no templates are configured (an empty list is returned), the agent should fall back to the old behavior of renewing certificates for a single template only.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| template-names required | string JSON-encoded array of template names to check. |
{- "status": "templates-to-auto-renew-seat-certs",
- "template-names": [
- "string"
]
}Alias of /public/{version}/cert-expiration-margin using the latest Public API version.
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
| user | string User name (seat name). Should match the USERID used in the RCDP authentication request. When omitted or unknown, the TEMPLATE-wide setting is used. |
| computer-name | string Caller's machine/device name. Should match the computer name used in the RCDP authentication request. Only needed when |
{- "status": "cert-expiration-margin",
- "threshold-seconds": "172800"
}Queries the minimal number of seconds (margin) before certificate expiration at which the certificate is still considered valid and does not require renewal. When the remaining time until expiry falls below this margin, KeyTalk agents ought to renew the certificate.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| service required | string Example: service=DEMO_SERVICE KeyTalk service (TEMPLATE) name. |
| user | string User name (seat name). Should match the USERID used in the RCDP authentication request. When omitted or unknown, the TEMPLATE-wide setting is used. |
| computer-name | string Caller's machine/device name. Should match the computer name used in the RCDP authentication request. Only needed when |
{- "status": "cert-expiration-margin",
- "threshold-seconds": "172800"
}Alias of /public/{version}/rccd using the latest Public API version.
| uid required | string Client configuration UID. Retrievable from the KeyTalk template page. |
{- "status": "error",
- "error": "string"
}Downloads a client configuration file (RCCD - Real Client Communication Data), used for customizing KeyTalk agents, identified by its UID.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| uid required | string Client configuration UID. Retrievable from the KeyTalk template page. |
{- "status": "error",
- "error": "string"
}Performs a server health check. Initially made for load balancers to select the right KeyTalk backend server.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
{- "status": "health-check",
- "check-result": "operational",
- "error": "string"
}Alias of /public/{version}/ktagent-unattended-popup-msg-template using the latest Public API version.
{- "status": "ktagent-unattended-popup-msg-template",
- "msg-template": "string"
}[as of v1.6.6] Retrieves the notification template for the message shown to end-users when the KeyTalk agent automatically pops up.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
{- "status": "ktagent-unattended-popup-msg-template",
- "msg-template": "string"
}Alias of /public/{version}/keep-alive-interval using the latest Public API version.
| template-name required | string KeyTalk service (TEMPLATE) name. |
{- "status": "keep-alive-interval",
- "interval": "string"
}[as of v1.6.7] Retrieves the interval at which the agent is supposed to send a periodic keep-alive message to the server.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| template-name required | string KeyTalk service (TEMPLATE) name. |
{- "status": "keep-alive-interval",
- "interval": "string"
}Alias of /public/{version}/i-am-alive using the latest Public API version.
| template-name required | string KeyTalk service (TEMPLATE) name. |
| user required | string User name. Should match the USERID used in the RCDP authentication request. |
| computer-name required | string Caller's machine/device name. Should match the computer name used in the RCDP authentication request. |
{- "status": "success",
- "interval": "string"
}[as of v1.6.7] Sends a keep-alive message for the given KeyTalk user (seat). Normally sent by agents
periodically according to the keep-alive interval retrieved via /keep-alive-interval. [as of
v1.6.9] the response piggy-backs the current keep-alive interval.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| template-name required | string KeyTalk service (TEMPLATE) name. |
| user required | string User name. Should match the USERID used in the RCDP authentication request. |
| computer-name required | string Caller's machine/device name. Should match the computer name used in the RCDP authentication request. |
{- "status": "success",
- "interval": "string"
}Alias of /public/{version}/is-cert-tpm-attested using the latest Public API version.
| cert-sha1-fingerprint required | string SHA-1 fingerprint of the seat certificate to look up. |
{- "status": "success",
- "attested": "yes"
}[as of v1.6.8] Checks whether the given seat certificate is known to have TPM key attestation, i.e. was previously attested by one of KeyTalk's TPM endorsement CAs.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| cert-sha1-fingerprint required | string SHA-1 fingerprint of the seat certificate to look up. |
{- "status": "success",
- "attested": "yes"
}Alias of /public/{version}/does-seat-cert-exist using the latest Public API version.
| cert-sha1-fingerprint required | string SHA-1 fingerprint of the seat certificate to look up. |
| template-name | string Optional seat TEMPLATE name to restrict the lookup to. |
{- "status": "success",
- "found": "yes"
}[as of v1.6.10] Checks whether the given seat certificate is known on the KeyTalk server.
| version required | string Enum: "1.6.6" "1.6.7" "1.6.8" "1.6.9" "1.6.10" Example: 1.6.10 Public API version to use. Documented versions (see section 3.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| cert-sha1-fingerprint required | string SHA-1 fingerprint of the seat certificate to look up. |
| template-name | string Optional seat TEMPLATE name to restrict the lookup to. |
{- "status": "success",
- "found": "yes"
}Alias of /admapi/{version}/cert-enrollment using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username. Required if the webserver is configured with username/password authentication (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password. Required if the webserver is configured with username/password authentication (alternative to a TLS client certificate). |
| service required | string Name of the KeyTalk service (template) of the seat to enroll. |
| deviduser required | string Name of the KeyTalk DevID user (seat) to enroll. |
| san | string JSON-encoded array of Subject Alternative Names to use in the certificate, e.g. ["DNS:test.server.com","IP:192.168.1.2"]. |
{- "status": "cert-enrollment",
- "cert": "string",
- "created-user-auth-password": "string"
}Enrolls a certificate for the given seat, creating the seat if it does not exist. The keypair is
created server-side. The enrolled certificate is returned either immediately, or - if immediate
enrolment is not possible (typically because the TEMPLATE is configured with Domain Validation,
e.g. a DigiCert DV signer) - order-id is returned [as of v1.9.6] and the caller should poll
/placed-order to get the order status and eventually download the certificate.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username. Required if the webserver is configured with username/password authentication (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password. Required if the webserver is configured with username/password authentication (alternative to a TLS client certificate). |
| service required | string Name of the KeyTalk service (template) of the seat to enroll. |
| deviduser required | string Name of the KeyTalk DevID user (seat) to enroll. |
| san | string JSON-encoded array of Subject Alternative Names to use in the certificate, e.g. ["DNS:test.server.com","IP:192.168.1.2"]. |
{- "status": "cert-enrollment",
- "cert": "string",
- "created-user-auth-password": "string"
}Alias of /admapi/{version}/csr-enrolment-requirements using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| service required | string Name of the KeyTalk service (template) of the seat to create a CSR for. |
| deviduser required | string Name of the KeyTalk DevID user (seat) to create a CSR for. |
{- "status": "csr-requirements",
- "subject": {
- "cn": "TestUser",
- "c": "NL",
- "st": "Utrecht",
- "l": "Amersfoort",
- "o": "KeyTalk",
- "ous": [
- "Development",
- "Administration"
], - "e": "test@keytalk.com"
}, - "san": [
- "email:test@keytalk.com",
- "DNS:test.keytalk.com"
]
}Part of the 3-step "enroll seat with caller's CSR" flow (section 4.2.2): query the server for the
initial parameters to use in the CSR (certificate subject and SAN) before generating the CSR
client-side and submitting it via /cert-enrollment-for-csr. [as of server v7.4.1] empty
subject attribute values / an empty san array should be treated as "any". [as of API v1.9.8]
key-size and signing-algo are no longer included in the response.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| service required | string Name of the KeyTalk service (template) of the seat to create a CSR for. |
| deviduser required | string Name of the KeyTalk DevID user (seat) to create a CSR for. |
{- "status": "csr-requirements",
- "subject": {
- "cn": "TestUser",
- "c": "NL",
- "st": "Utrecht",
- "l": "Amersfoort",
- "o": "KeyTalk",
- "ous": [
- "Development",
- "Administration"
], - "e": "test@keytalk.com"
}, - "san": [
- "email:test@keytalk.com",
- "DNS:test.keytalk.com"
]
}Alias of /admapi/{version}/cert-enrollment-for-csr using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| service required | string Name of the KeyTalk template (former "service") of the seat to enroll. |
| deviduser required | string Name of the KeyTalk seat (former "DevID user") to enroll. |
| csr required | string Base64-encoded PKCS#10 certificate signing request. |
{- "status": "cert-enrollment",
- "cert": "string",
- "created-user-auth-password": "string"
}Part of the 3-step "enroll seat with caller's CSR" flow (section 4.2.2, step 4.2.2.2): enrolls a
certificate for the given seat (creating it if necessary) from a client-supplied CSR obeying the
requirements retrieved via /csr-enrolment-requirements. The enrolled certificate is returned
either immediately, or - if immediate enrolment is not possible (e.g. Domain Validation) -
order-id is returned [as of v1.9.7] for polling via /placed-order.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| service required | string Name of the KeyTalk template (former "service") of the seat to enroll. |
| deviduser required | string Name of the KeyTalk seat (former "DevID user") to enroll. |
| csr required | string Base64-encoded PKCS#10 certificate signing request. |
{- "status": "cert-enrollment",
- "cert": "string",
- "created-user-auth-password": "string"
}Alias of /admapi/{version}/placed-order using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| order-id required | string ID of the certificate order placed with |
{- "status": "issued",
- "cert": "string"
}[as of v1.9.7] Checks the status of a certificate order previously placed via /cert-enrollment or
/cert-enrollment-for-csr, and downloads the resulting certificate once ready. While not ready,
status holds a signer-specific order status string; once ready, status is "issued" and cert
holds the certificate/key in PEM format.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| order-id required | string ID of the certificate order placed with |
{- "status": "issued",
- "cert": "string"
}Alias of /admapi/{version}/cert-revocation using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| service required | string Name of the KeyTalk service of the user whose certificates are to be revoked. |
| deviduser required | string Name of the KeyTalk DevID user (seat) whose certificates are to be revoked. |
{- "status": "cert-revocation",
- "num-revoked-certs": 0,
- "warning": "string"
}Revokes certificates of the given seat. Requires a valid system/cluster admin, manager, or operator privilege.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| service required | string Name of the KeyTalk service of the user whose certificates are to be revoked. |
| deviduser required | string Name of the KeyTalk DevID user (seat) whose certificates are to be revoked. |
{- "status": "cert-revocation",
- "num-revoked-certs": 0,
- "warning": "string"
}Alias of /admapi/{version}/settings using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| include-hsm-connection-settings | boolean Default: false Include HSM Connection Settings. |
| include-keytalk-cert-tree | boolean Default: false Include KeyTalk Certificate Tree. |
{- "status": "error",
- "error": "string"
}Downloads KeyTalk settings. Counterpart of saving settings under the System -> Settings page of the KeyTalk Web Admin Interface.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| include-hsm-connection-settings | boolean Default: false Include HSM Connection Settings. |
| include-keytalk-cert-tree | boolean Default: false Include KeyTalk Certificate Tree. |
{- "status": "error",
- "error": "string"
}Alias of /admapi/{version}/intune-scep-config using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
{- "status": "scep-config",
- "enabled": true,
- "service-name": "string",
- "recipient-cert": "string",
- "recipient-key": "string",
- "signing-cert": "string",
- "signing-key": "string",
- "issuer-certs": "string"
}Retrieves Intune SCEP configuration. Counterpart of the Certificate and Keys -> Intune SCEP page of the KeyTalk Web Admin Interface.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
{- "status": "scep-config",
- "enabled": true,
- "service-name": "string",
- "recipient-cert": "string",
- "recipient-key": "string",
- "signing-cert": "string",
- "signing-key": "string",
- "issuer-certs": "string"
}Alias of /admapi/{version}/copy-template using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| src-template-name required | string Name of the TEMPLATE to copy. |
| new-template-name required | string Name of the new TEMPLATE. |
| digicert-central-settings | string JSON-encoded object of DigiCert Central CA settings to alter in the new TEMPLATE (only
applicable if the source TEMPLATE uses a DigiCert Central CA source). Shape:
|
| external-customer-settings | string [as of 1.9.5] JSON-encoded external customer settings:
|
{- "status": "success",
- "external-customer-reserved-seats": {
- "O20240601001": "seat-0001",
- "O20240601002": "seat-0002"
}
}Copies a KeyTalk TEMPLATE along with all its properties but without seats. Requires system admin,
cluster admin, or manager authorization. The copied template is automatically assigned to the
manager who performed the call, and automatically becomes a member of each tenant assigned to that
manager. [as of v1.9.5] supports external-customer-settings and DigiCert account-region.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| src-template-name required | string Name of the TEMPLATE to copy. |
| new-template-name required | string Name of the new TEMPLATE. |
| digicert-central-settings | string JSON-encoded object of DigiCert Central CA settings to alter in the new TEMPLATE (only
applicable if the source TEMPLATE uses a DigiCert Central CA source). Shape:
|
| external-customer-settings | string [as of 1.9.5] JSON-encoded external customer settings:
|
{- "status": "success",
- "external-customer-reserved-seats": {
- "O20240601001": "seat-0001",
- "O20240601002": "seat-0002"
}
}Alias of /admapi/{version}/import-certs using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Target KeyTalk TEMPLATE name. |
| owner-name | string Default: "no owner" Certificate owner name, used to notify on revocation/expiration. |
| certificates required | string Concatenated list of PEM certificates. |
{- "status": "import-certs",
- "imported": [
- "string"
], - "skipped": [
- "string"
]
}[changed in v1.9.8] Imports certificates into KeyTalk under the given TEMPLATE. Target seat names
are derived from the Common Name or SAN of the certificates. In addition to system admin/cluster
admin, an SSL Discovery Manager assigned to the given TEMPLATE is also eligible. [as of v1.9.8] the
custom. prefix was removed from request arguments, and the request is x-www-form-urlencoded
instead of JSON-encoded.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Target KeyTalk TEMPLATE name. |
| owner-name | string Default: "no owner" Certificate owner name, used to notify on revocation/expiration. |
| certificates required | string Concatenated list of PEM certificates. |
{- "status": "import-certs",
- "imported": [
- "string"
], - "skipped": [
- "string"
]
}Alias of /admapi/{version}/create-seat using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk TEMPLATE (service) the seat belongs to. |
| seat-name required | string Name of the KeyTalk seat to create/update. |
| cn | string Default: "" Seat common name. |
| san | string Default: "" JSON-encoded array of Seat Subject Alternative Names, e.g. ["DNS:test.server1.com","DNS:test2.server.com"]. |
{- "status": "success",
- "result": "created"
}[as of v1.9.6] Creates a new seat, or updates an existing one, under the given TEMPLATE.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk TEMPLATE (service) the seat belongs to. |
| seat-name required | string Name of the KeyTalk seat to create/update. |
| cn | string Default: "" Seat common name. |
| san | string Default: "" JSON-encoded array of Seat Subject Alternative Names, e.g. ["DNS:test.server1.com","DNS:test2.server.com"]. |
{- "status": "success",
- "result": "created"
}Alias of /admapi/{version}/archive-seat using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk TEMPLATE (service) the seat belongs to. |
| seat-name required | string Name of the KeyTalk seat (DevID user) to archive. |
{- "status": "archive-seat",
- "archived": true
}Archives the given seat. Requires a valid system/cluster admin or manager privilege.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk TEMPLATE (service) the seat belongs to. |
| seat-name required | string Name of the KeyTalk seat (DevID user) to archive. |
{- "status": "archive-seat",
- "archived": true
}Alias of /admapi/{version}/list-templates using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
{- "status": "success",
- "templates": [
- "string"
]
}Lists available KeyTalk templates.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
{- "status": "success",
- "templates": [
- "string"
]
}Alias of /admapi/{version}/remove-template using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the template to remove. |
{- "status": "success"
}Removes a KeyTalk template along with all the seats and Registration Authorities bound to it.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the template to remove. |
{- "status": "success"
}Alias of /admapi/{version}/open-slot using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the TEMPLATE the seat belongs to. |
| seat-name required | string Name of the seat to open the slot for. |
| unoccupied-only | boolean Default: false Look up the first unoccupied locked slot instead of simply taking the first slot. |
{- "status": "success",
- "extra-info": "string"
}Opens a slot on an existing seat, changing its status from locked to learn-once. No effect if
the slot is already learn-once.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the TEMPLATE the seat belongs to. |
| seat-name required | string Name of the seat to open the slot for. |
| unoccupied-only | boolean Default: false Look up the first unoccupied locked slot instead of simply taking the first slot. |
{- "status": "success",
- "extra-info": "string"
}Alias of /admapi/{version}/create-internal-ra-user using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the TEMPLATE to create the user under. |
| user-name required | string Name of the new user. |
| user-password | string Default: "" Password for the new user. |
| user-password-ttl | integer Time-to-live in seconds for the user password expiry. |
| user-pincode | string Default: "" Pincode for the new user. |
| user-cert-subject | string JSON-encoded certificate subject overrides for the new user. Supported attributes:
|
| user-cert-san | string JSON-encoded certificate Subject Alternative Name overrides for the new user. Supported
attributes: |
{- "status": "success"
}Creates a new user in the KeyTalk Internal Registration Authority database.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the TEMPLATE to create the user under. |
| user-name required | string Name of the new user. |
| user-password | string Default: "" Password for the new user. |
| user-password-ttl | integer Time-to-live in seconds for the user password expiry. |
| user-pincode | string Default: "" Pincode for the new user. |
| user-cert-subject | string JSON-encoded certificate subject overrides for the new user. Supported attributes:
|
| user-cert-san | string JSON-encoded certificate Subject Alternative Name overrides for the new user. Supported
attributes: |
{- "status": "success"
}Alias of /admapi/{version}/update-seats using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Target KeyTalk TEMPLATE name. |
| seats required | string JSON-encoded array of seats with properties to set. A seat is identified by |
{- "status": "success"
}Mass-updates some seat properties for the given TEMPLATE. At the moment, the only supported seat
property is mobile (the mobile phone number), used per-seat in the seats JSON array.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Target KeyTalk TEMPLATE name. |
| seats required | string JSON-encoded array of seats with properties to set. A seat is identified by |
{- "status": "success"
}Alias of /admapi/{version}/remove-seat using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk TEMPLATE (service) the seat belongs to. |
| seat-name required | string Name of the KeyTalk seat to remove. |
{- "status": "remove-seat",
- "removed": true,
- "warning": "string"
}Removes a seat, automatically revoking its certificate(s).
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk TEMPLATE (service) the seat belongs to. |
| seat-name required | string Name of the KeyTalk seat to remove. |
{- "status": "remove-seat",
- "removed": true,
- "warning": "string"
}Alias of /admapi/{version}/create-digicert-dv-acme-template using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk TEMPLATE (service). |
| digicert-account-region required | string Enum: "Europe" "US" Region the DigiCert account belongs to. |
| digicert-product required | string DigiCert DV product ID, e.g. "ssl_dv_geotrust" or "ssl_dv_rapidssl" (see DigiCert CertCentral API glossary for the full list). |
| digicert-api-key required | string Key to call the DigiCert REST API. |
| cert-validity-months required | integer Desired certificate validity in months. |
| mail-fetch-proto required | string Enum: "o365-msgraph" "o365-imap" Protocol to access the mailbox where the certificate order approval email is expected to arrive. |
| azure-client-id required | string Azure Client ID to access the Office 365 mailbox where the approval email arrives. |
| azure-client-secret required | string Azure secret to access the Office 365 mailbox where the approval email arrives. |
| azure-tenant-id required | string Azure Tenant ID to access the Office 365 mailbox where the approval email arrives. |
| approver-email required | string <email> Mailbox (email address) where the certificate order approval email is expected to arrive. |
{- "status": "success",
}[as of v1.9.4] Allows creating templates for enrolling DigiCert DV certificates via ACME. Returns the KeyTalk ACME directory URL to be used in an ACME agent, e.g. certbot.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk TEMPLATE (service). |
| digicert-account-region required | string Enum: "Europe" "US" Region the DigiCert account belongs to. |
| digicert-product required | string DigiCert DV product ID, e.g. "ssl_dv_geotrust" or "ssl_dv_rapidssl" (see DigiCert CertCentral API glossary for the full list). |
| digicert-api-key required | string Key to call the DigiCert REST API. |
| cert-validity-months required | integer Desired certificate validity in months. |
| mail-fetch-proto required | string Enum: "o365-msgraph" "o365-imap" Protocol to access the mailbox where the certificate order approval email is expected to arrive. |
| azure-client-id required | string Azure Client ID to access the Office 365 mailbox where the approval email arrives. |
| azure-client-secret required | string Azure secret to access the Office 365 mailbox where the approval email arrives. |
| azure-tenant-id required | string Azure Tenant ID to access the Office 365 mailbox where the approval email arrives. |
| approver-email required | string <email> Mailbox (email address) where the certificate order approval email is expected to arrive. |
{- "status": "success",
}Alias of /admapi/{version}/create-tenant using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| tenant-name required | string Name of the KeyTalk tenant. |
| assigned-templates | string JSON-encoded array of KeyTalk template names to assign to this tenant (templates must already exist). |
{- "status": "success"
}[as of v1.9.5] Allows creating tenants (groups of templates) and assigning templates to them. Assigned templates must already exist.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| tenant-name required | string Name of the KeyTalk tenant. |
| assigned-templates | string JSON-encoded array of KeyTalk template names to assign to this tenant (templates must already exist). |
{- "status": "success"
}Alias of /admapi/{version}/enable-acme using the latest Administrator API version.
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk template to enable requesting certs via ACME for. |
| external-customer-order-id | string External customer order ID previously submitted using the |
{- "status": "success",
}[as of v1.9.5] Allows requesting certificates via ACME for the template, yielding an ACME directory
URL that is either template-wide or, when external-customer-order-id (previously submitted via
/copy-template) is supplied, tied to the seat name reserved for that order.
| version required | string Enum: "1.9.4" "1.9.5" "1.9.6" "1.9.7" "1.9.8" Example: 1.9.8 Administrator API version to use. Documented versions (see section 4.1's changelog table); the server may also support earlier, undocumented versions. When the caller does not need to pin a version, use the sibling path without this segment (the server then uses the latest version it supports). |
| auth-username | string Caller's Web Admin Interface username (alternative to a TLS client certificate). |
| auth-password | string Caller's Web Admin Interface password (alternative to a TLS client certificate). |
| template-name required | string Name of the KeyTalk template to enable requesting certs via ACME for. |
| external-customer-order-id | string External customer order ID previously submitted using the |
{- "status": "success",
}Enrolls, or places orders for, S/MIME certificates for external parties, i.e. users generally not
registered at KeyTalk. Enrolled certificates are communicated to the indicated email addresses. It
is strongly recommended to call the Public API smime-cert-enrollment-availability before
enrolling, to get detailed diagnostics and minimize the chance of errors.
Authentication: this API requires a TLS client certificate and private key identifying the
caller as a KeyTalk self-service user (mutual TLS at the connection level - not a header-based
credential; the KeyTalk server must be configured to require certificate-based logins). There is no
OpenAPI 3.0.3 security scheme that models this cleanly, so no security block is set on this
operation - see the curl example (--cert ./client-cert.pem --key ./client-cert-key.pem).
When multiple recipients are supplied, enrolment/order-placement may succeed for some but fail along the way; if so, the process terminates and the remaining recipients are skipped.
| recipients required | string JSON-encoded array of recipient objects |
| svr-host-name | string KeyTalk server hostname to build the certificate download link communicated to the recipient (must be routable for them). Defaults to the hostname/IP extracted from the KeyTalk server's web management certificate. |
| synchronous | boolean Default: true [as of v1.1.0] When false, does not immediately yield a certificate; instead submits a request to a configured CA which communicates the certificate back via e-mail (currently only supported for GlobalSign PersonalSign-bound services). |
recipients=%5B%7B%22email%22%3A%22mike.brook%40example.com%22%2C%22mobile%22%3A%22%2B31645610000%22%7D%2C%7B%22email%22%3A%22chuck.norris%40badass.com%22%7D%5D
{- "status": "smime-cert-enrollment",
- "enrolled-recipients": [
- "user@example.com"
], - "failed-recipients": [
- {
- "email": "user@example.com",
- "error": "string"
}
], - "skipped-recipients": [
- "user@example.com"
], - "apply-address-books": true,
- "address-books": [
- {
- "ldap-svr-url": "string",
- "search-base": "string",
- "verification-ca": "string"
}
]
}Fetches KeyTalk internal CA certificate(s). The identifier path segment is overloaded by the
server and is resolved in two possible ways (this spec models both under one path, since OpenAPI
cannot express "same URL shape, dispatched by value" as two separate path items - the source
document itself defines these as if they were distinct URLs, which most OpenAPI tooling flags as
an ambiguous/identical path):
identifier matches one of the known CA type keywords - signing ("Signing CA"), primary
("Primary CA"), communication ("Communication CA"), root ("Root CA") (as labeled on the
KeyTalk admin web panel), or extrasigning (yields a list of all extra Signing CAs configured on
KeyTalk, concatenated into a single PEM file [as of v1.0.2]) - the CA certificate(s) of that type
are returned.identifier is treated as a SHA-1 fingerprint and the matching CA
certificate (of any type) is returned, if found.To fetch a specific certificate of a known type AND fingerprint (avoiding any ambiguity), use
/ca/{version}/{ca-type}/{cert-sha1-fingerprint} instead. The non-SSL HTTP communication goes over
the standard port 80; HTTPS goes over the standard port 443.
| version required | string Default: "1.0.3" Enum: "1.0.0" "1.0.1" "1.0.2" "1.0.3" Example: 1.0.3 CA API version to use. All documented URL patterns are pinned to 1.0.3 in the source document. |
| identifier required | string Examples:
Either a CA type keyword ( |
| format | string Enum: "PEM" "DER" Desired certificate download format. [as of CA API v1.0.1] |
[as of v1.0.1] Allows requesting a specific certificate of the given CA type by its SHA-1 fingerprint. [as of v1.0.3] fingerprint-only lookup (across all types) is also available via /ca/{version}/{cert-sha1-fingerprint}.
| version required | string Default: "1.0.3" Enum: "1.0.0" "1.0.1" "1.0.2" "1.0.3" Example: 1.0.3 CA API version to use. All documented URL patterns are pinned to 1.0.3 in the source document. |
| ca-type required | string Enum: "signing" "primary" "communication" "root" "extrasigning" Which internal CA to fetch. |
| cert-sha1-fingerprint required | string SHA-1 fingerprint of the desired CA certificate. |
| format | string Enum: "PEM" "DER" Desired certificate download format. [as of CA API v1.0.1] |