Stores a new SII credential for the caller. Cardda encrypts password and
certificate_password at rest; this is the only entry point that accepts them
in clear text. On creation Cardda runs a synchronous company sync against the
SII — on success the key flips to approved and its managed companies are
resolved; if the SII rejects the credentials the key ends up declined.
Company users must set user_id to their own Firebase uid, otherwise the
request is rejected with 401.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Unauthorized — missing/invalid token, or a non-staff caller tried to create a
key for a different (or missing) user_id. Authorization runs before the save
and is by ownership (user_id must match the caller, unless the caller is
Cardda staff); the company-id header plays no part in create authorization.
Empty body.
Unprocessable entity — validation failed
({ "message": "Validation failed: ..." }), e.g. missing/blank password,
missing/invalid rut, or a RUT that already has an SII key (the rut unique
index). A missing user_id reaches this validation
({ "message": "Validation failed: User must exist" }) only for Cardda
staff callers; a company user who omits user_id is rejected earlier with
401 (see above), because authorization runs before the save.