Add or rotate a certificate

Add a certificate to an existing TPP registration to support certificate rotation or multiple certificates.

Before making this request, obtain a new management access token with scope=tpp:write. The request also requires mTLS with your existing valid eIDAS QWAC and private key.

Endpoints

Environment	Certificate-add endpoint
Production	`POST https://tpp.openbanking.prod.lunar.tech/tpp/{clientId}/certificates`
Sandbox	`POST https://tpp.openbanking-sandbox.prod.lunar.tech/tpp/{clientId}/certificates`

Send the bearer token as Authorization: Bearer <access-token>, present the existing QWAC over mTLS, and place the new certificate chain in the JSON request body.

Certificate requirements

Use a PEM-encoded certificate chain from the leaf certificate to the root CA.
The new certificate must be a valid eIDAS QWAC.
Its roles must match or be a subset of your registered TPP roles.
The certificate must not be expired.

Request format


{
  "certificate": "-----BEGIN CERTIFICATE-----\nMIIE...leaf certificate...\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIF...intermediate CA...\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIG...root CA...\n-----END CERTIFICATE-----",
  "updateDisplayName": true
}

Set updateDisplayName to true to update the consent display name from the Organization attribute in the added chain’s leaf QWAC. It defaults to false.

Example


CERT_JSON=$(cat leaf.pem intermediate.pem root.pem | jq -R -s .)
 
curl \
  -X POST \
  -H "Authorization: Bearer your-access-token" \
  -H "Content-Type: application/json" \
  --data "{\"certificate\": $CERT_JSON, \"updateDisplayName\": true}" \
  --cert client.pem \
  --key client.key \
  https://tpp.openbanking.prod.lunar.tech/tpp/your-client-id/certificates

Troubleshooting

Status	Description
`400 Bad Request`	The certificate format is invalid or the chain is incomplete.
`401 Unauthorized`	The bearer token is invalid, or certificate authentication failed.
`403 Forbidden`	The token does not include `tpp:write`, the certificate does not meet eIDAS requirements, or its roles do not match your registration.
`404 Not Found`	The client ID does not exist or is not owned by your certificate.

Verify your certificate

Verify that your eIDAS certificate is correctly configured when troubleshooting mTLS connectivity:


GET https://api.openbanking.prod.lunar.app/tpp/verify

This endpoint requires mTLS with your eIDAS certificate. A 200 OK response indicates that the certificate is valid and properly configured.