title | description | ms.localizationpriority | author | ms.subservice | doc_type |
---|---|---|---|---|---|
servicePrincipal: addKey |
Add a key credential to a servicePrincipal. |
medium |
sureshja |
entra-applications |
apiPageType |
Namespace: microsoft.graph
Adds a key credential to a servicePrincipal. This method along with removeKey can be used by a servicePrincipal to automate rolling its expiring keys.
Note
Create servicePrincipal and Update servicePrincipal operations can continue to be used to add and update key credentials for any servicePrincipal with or without a user's context.
As part of the request validation for this method, a proof of possession of an existing key is verified before the action can be performed.
ServicePrincipals that don’t have any existing valid certificates (i.e.: no certificates have been added yet, or all certificates have expired), won’t be able to use this service action. Update servicePrincipal can be used to perform an update instead.
[!INCLUDE national-cloud-support]
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
[!INCLUDE permissions-table]
You can address the service principal using either its id or appId. id and appId are referred to as the Object ID and Application (Client) ID, respectively, in app registrations in the Microsoft Entra admin center.
POST /serviceprincipals/{id}/addKey
POST /servicePrincipals(appId='{appId}')/addKey
Name | Description |
---|---|
Authorization | Bearer {token}. Required. Learn more about authentication and authorization. |
Content-Type | application/json. Required. |
In the request body, provide the following required properties.
Property | Type | Description |
---|---|---|
keyCredential | keyCredential | The new servicePrincipal key credential to add. The type, usage and key are required properties for this usage. Supported key types are:
|
passwordCredential | passwordCredential | Only secretText is required to be set which should contain the password for the key. This property is required only for keys of type X509CertAndPassword . Set it to null otherwise. |
proof | String | A self-signed JWT token used as a proof of possession of the existing keys. This JWT token must be signed with a private key that corresponds to one of the existing valid certificates associated with the servicePrincipal. The token should contain the following claims:
For steps to generate this proof of possession token, see Generating proof of possession tokens for rolling keys. |
If successful, this method returns a 200 OK
response code and a new keyCredential object in the response body.
The following example shows a request.
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/addKey
Content-type: application/json
{
"keyCredential": {
"type": "AsymmetricX509Cert",
"usage": "Verify",
"key": "MIIDYDCCAki..."
},
"passwordCredential": null,
"proof":"eyJ0eXAiOiJ..."
}
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
The following example shows the response.
HTTP/1.1 200 OK
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.keyCredential"
}
The following example shows a request.
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/addKey
Content-type: application/json
{
"keyCredential": {
"type": "X509CertAndPassword",
"usage": "Sign",
"key": "MIIDYDCCAki..."
},
"passwordCredential": {
"secretText": "MKTr0w1..."
},
"proof":"eyJ0eXAiOiJ..."
}
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
The following example shows the response.
HTTP/1.1 200 OK
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.keyCredential"
}