Creating An Approver

This article explains how to use the Approver Management REST API to create approvers that can be onboarded to the Securosys Authorization App on your mobile device.

Ensure that the you meet the prerequisites before creating an Approver.

Approvers are created and managed centrally in the Transaction Security Broker (TSB). The private key is generated ephemerally on the HSM, then stored in the TSB database in encrypted form. During onboarding, the key is securely transferred from the TSB to the Authorization App.

TSB securely stores encrypted backups of approver private keys, enabling the Approver Manager to restore an Approver’s credentials, for example, if the Approver loses their phone.

For more details, see the SKA documentation.

Later when you create an SKA key you can reference the approvers in the policy of the SKA key. For details, see this tutorial.

Create Approver Key

The Approver Manager initiates the creation of an Approver Key by following the steps below.

POST: /v1/approverManagement/create

See the API reference for an explanation of the parameters.

Swagger

{
  "approverName": "finance-officer@securosys.com",
  "algorithm": "RSA",
  "keySize": 2048,
  "backupPassword": "6se1Qbsi3bJshe",
  "validity": 3650,
  "qrCode": true
}

Response:

• If "qrCode": true, the response includes a QR code image to scan in the Authorization App.
• If "qrCode": false, the response returns a oneTimeCode that must be securely shared with the approver to fetch their key.

{
  "oneTimeCode": "410447"
}

curl

curl -X PUT -H "Authorization: Bearer ey..." \
  https://sbx-rest-api.cloudshsm.com/v1/approverManagement/create --json '{
  "approverName": "officer1@securosys.com",
  "algorithm": "RSA",
  "keySize": 2048,
  "backupPassword": "2al152aL",
  "validity": 3650,
  "qrCode": false
}'

Response: Response is a oneTimeCode to be sent to the approver to fetch the approver-key

{
  "oneTimeCode": "410447"
}

CyberVault KMS

Approver Management can also be done through a graphical user interface within the CyberVault KMS.

1. Log in to your deployed CyberVault KMS
2. Go to on Add-ons ➜ Approvers
3. Click Create Approver
4. Specify your Approver parameters
5. Click Create

The Approver will be created and a QR code will be presented. Share the QR code and the backup password with the user. They can now onboard their Approver to the Authorization App.

Backup Password

The backup password is used to encrypt the PKCS#12 container containing the approver key. It is required for registration and restoration. It must be at least 8 characters with an uppercase, lowercase and a digit. The password must be sent to the Approver (Mobile Application User) and should be kept secure.

As an Approver Manager, now that you have prepared the Approver account, give the following details to the human Approver. The user needs them to onboard in the Securosys Authorization App.

• If you send "qrCode": true in the request:

  • The QR code image and the backupPassword.

• If you send "qrCode": false:

  • oneTimeCode,
  • backupPassword,
  • REST API URL, and
  • approverName

One-Time-Code

The oneTimeCode can only be used once. If re-registration is required, follow this guide.

What's next?

• Register Approver on the Securosys Authorization App
• Verify Onboarding Status
• Create an SKA Key with a policy that specifies which approvers need to sign off on operations using this key.