---
title: "Authorize credential access"
method: POST
path: "/csc/v1/credentials/authorize"
tags: ["CSC (v1)"]
---

# Authorize credential access

`POST /csc/v1/credentials/authorize`

## Request

- Base URL: `https://one.digicert.com/documentmanager`
- URL: `https://one.digicert.com/documentmanager/csc/v1/credentials/authorize`
- Auth: one of:
  - API key in header `X-API-Key`
  - OAuth 2
    - Client credentials
    - Token URL: `/imauth/oauth2/token` scopes: `service`
  - OAuth 2
    - Authorization code: `/imauth/oauth2/authorize`
    - Token URL: `/imauth/oauth2/token` scopes: `service`
- TypeScript: <https://skmtc.dev/digicert/apis/digicert-content-trust-manager/docs/csc/v1/credentials/authorize/post.ts> (a function with typed inputs; its response is checked against the schema)

Use this endpoint to authorize access to a given credential for signing.

The following parameters are required in the request body:

`credentialID` — Signing credential ID.

`hash` — Signature hash string value.

`numSignatures` — The number of signatures to authorize the credential for.

## Request body

- AuthorizeCredentialsRequest
  - `hash` string[], required: One or more Base64-encoded hash values to be signed. It shall be used if the SCAL parameter returned by credentials/info is “2”.If the SCAL parameter is “1”, the hash parameter is OPTIONAL.
  - `credentialID` string, required: The identifier associated to the credential.
  - `numSignatures` integer, required: The number of signatures to authorize. Multi-signature transactions can be obtained by using a combination of passing an array of hash values and calling the signatures/signHash method multiple times.
  - `PIN` string: The PIN collected from the user. It shall be used only when authMode from credentials/info is “explicit” and PIN/presence is not “false”.
  - `OTP` string: The OTP collected from the user. It shall be used only when authMode from credentials/info is “explicit” and OTP/presence is not “false”.
  - `description` string: Contains a free form description of the authorization transaction in the lang language. The maximum size of the string shall be 500 characters. It can be useful when authMode from credentials/info is “implicit” to provide some hints about the occurring transaction.
  - `clientData` string: Arbitrary data from the Signature Application. It can be used to handle a transaction identifier or other application-specific data.

## Response `200`

Credential authorization details

- AuthorizeCredentialsResponse
  - `expiresIn` string: The lifetime in seconds of the service access token. If omitted, the default expiration time is 3600 (1 hour).
  - `SAD` string: The Signature Activation Data to provide as input to the signatures/signHash method.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `500`: Internal Server Error

---

[API](https://skmtc.dev/digicert/apis/digicert-content-trust-manager.md) - [All operations](https://skmtc.dev/digicert/apis/digicert-content-trust-manager/llms.txt) - [OpenAPI document](https://skmtc.dev/digicert/apis/digicert-content-trust-manager/revisions/8dec322a0e2b?raw)