Skip to main content
POST
Delegate Key

Authentication

✅ Organization User (CustomerEmployee)
❌ Delegated User (EndUser)
✅ Service Account

Required Permissions

Keys:Delegate: Always required.

Authorizations

Authorization
string
header
required

Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows

X-DFNS-USERACTION
string
header
required

User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows

Path Parameters

keyId
string
required

The key to delegate. Must have been created with delayDelegation: true.

Required string length: 1 - 64

Body

application/json
delegateTo
string
required

ID of the end user to transfer ownership of the key to.

Required string length: 1 - 64
Pattern: ^us-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$
Example:

"us-6b58p-r53sr-rlrd3l5cj3uc4ome"

Response

200 - application/json

Success

keyId
string
required

The delegated key.

Required string length: 1 - 64
Pattern: ^key-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$
Example:

"key-01snl-t56gb-j8tsok0vn802p80i"

status
enum<string>
required

The key status after delegation.

Available options:
Delegated
Last modified on August 24, 2026