---
title: "Add new key to a bound device"
method: POST
path: "/v1/mfa/devices/{id}/keys"
tags: ["Device binding"]
---

# Add new key to a bound device

`POST /v1/mfa/devices/{id}/keys`

Adds a new public key to a device that was previously registered by a customer using the device binding process. The new key must have a different `purpose` than the existing key. E.g., if the device already has an `unrestricted` key, then the new key must be `restricted`.

## Path parameters

- `id` string, required

## Request body

- object
  - `key` string — The hex-encoded public key generated on the registered device.
  - `key_type` 'ecdsa-p256' — The type of key pair used for verifying the device and, after registration, for device signing. At this time, only `ecdsa-p256` is supported.
  - `key_purpose` 'unrestricted' | 'restricted' — The purpose of the key that will be used to sign for the device. Possible values are `unrestricted` (default) and `restricted`.
  - `device_signature` object — Contains information about the **existing** key registered for the device.
    - `signature_key_purpose` 'restricted' | 'unrestricted' — The purpose of the **existing** key registered for the device.
    - `signature` string — The existing signature (created with the previously registered key).
  - `device_data` string — Base64 encoded device data as provided by Seon SDK. Details of Seon SDK integration can be found in the [device monitoring guide](https://docs.solarisgroup.com/guides/kyc/device-monitoring/).

## Response `201`

Created

- object
  - `id` string — ID of the new key.

## Other responses

- `400` — Validation error
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `409` — Conflict
- `500` — Internal server error

---

[API](https://skmtc.net/solarisgroup/apis/device-management.md) · [All operations](https://skmtc.net/solarisgroup/apis/device-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/solarisgroup/device-management/revisions/80dd46738839/schema)