Card Security
The bank's card cryptography: the HSM adapter, the dual-control key ceremonies that create, import, export, rotate and retire keys, and each card's personalisation and PIN record. Clear keys, PINs and key blocks never appear.
OBJECTThe Card Security objectThe bank's card cryptography: the HSM adapter, the dual-control key ceremonies that create, import, export, rotate and retire keys, and each card's personalisation and PIN record. Clear keys, PINs and key blocks never appear.POSTOpen a dual-control key ceremony (Idempotency-Key required)
/cards/security/ceremonies · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:writeGETList key ceremonies (optional status)/cards/security/ceremonies · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:writeGETThe configured HSM adapter (a simulator until a validated device is wired)/cards/security/hsm · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:writeGETList the card cryptography key registry/cards/security/keys · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:writeGETRead one key ceremony/cards/security/ceremonies/{id} · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:writeGETRead one key registry entry/cards/security/keys/{id} · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:writePOSTEnter one custodian's clear key component (Idempotency-Key required)/cards/security/ceremonies/{id}/components · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:writePOSTApprove, reject or withdraw a ceremony (Idempotency-Key required)/cards/security/ceremonies/{id}/decision · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:writeGETThe key block an approved export produced, under the counterparty's zone master key/cards/security/ceremonies/{id}/exported-block · Verified bank staff with cards:read observe the registry; opening a ceremony, entering a component, personalising a card and unlocking a PIN take the narrow cards:security:write and a step-up in the last five minutes, never cards:write