> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Create institution config and provision keys > Creates a new institution configuration (create-only; 409 if one already exists for the id) and provisions its tokenization PRF + audit MAC keysets in the same flow. The institution id is supplied in the request body. Invalid input is refused with 400 SBJ-0001, including an empty or malformed institutionCode and a branchFormat/accountFormat that does not compile or is longer than 64 characters. ## OpenAPI ````yaml /es/openapi/v3-current/sisbajud-executor.yaml post /v1/institutions openapi: 3.1.0 info: description: >- API for the Lerian SISBAJUD executor, which runs judicial orders on Midaz. It covers institution and Midaz connector configuration, orders that need attention, ledger-routing checks, credential key rotation and audit verification. title: Lerian SISBAJUD Executor API version: 1.0.0 servers: - url: https://api.example.com description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Institution configuration lifecycle: create (with key provisioning), read, and partial update of a connector configuration addressed by institution id. name: Institution - description: >- Rotation of the key that wraps an institution's stored connector credentials, addressed by institution id. name: Security - description: 'Admin API: audit-trail integrity verification.' name: Admin paths: /v1/institutions: post: tags: - Institution summary: Create institution config and provision keys description: >- Creates a new institution configuration (create-only; 409 if one already exists for the id) and provisions its tokenization PRF + audit MAC keysets in the same flow. The institution id is supplied in the request body. Invalid input is refused with 400 SBJ-0001, including an empty or malformed institutionCode and a branchFormat/accountFormat that does not compile or is longer than 64 characters. operationId: create-institution-config requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateInstitutionConfigRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/InstitutionConfigResponse' description: Created '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error components: schemas: CreateInstitutionConfigRequest: additionalProperties: false properties: accountFormat: description: >- Regular expression (Go RE2 syntax, at most 64 characters) the institution DECLARES for the account number a court may indicate in a BLOQUEIO restriction. A value is proven invalid (TARGET_INVALID) only when it fails the WHOLE pattern; with no declaration nothing is ever proven invalid. Per institution and never defaulted. A pattern that does not compile, or is longer than 64 characters, is refused with 400. Absent or blank declares nothing. examples: - ^[0-9]{1,12}$ type: string branchFormat: description: >- Regular expression (Go RE2 syntax, at most 64 characters) the institution DECLARES for the branch (agência) number a court may indicate in a BLOQUEIO restriction. A value is proven invalid (TARGET_INVALID) only when it fails the WHOLE pattern; with no declaration nothing is ever proven invalid. Per institution and never defaulted. A pattern that does not compile, or is longer than 64 characters, is refused with 400. Absent or blank declares nothing. examples: - ^[0-9]{4}$ type: string connectorMetadata: description: >- Connector-specific configuration bag: routing (baseUrl required; organizations[] required — the only targeting form, at least one entry naming a Midaz organizationId with optional ledgers; authAddress required when credentials are present; crmBaseUrl optional; crmMode optional — legacy|embedded, where absent/null/blank INHERITS the service-wide MIDAZ_CRM_MODE, an unrecognised value is rejected, and embedded requires an EMPTY crmBaseUrl), admission sets (blockableBalances/blockableAccountTypes), and the connector's credentials under their snake_case allowlisted names: ledger_client_id + ledger_client_secret are always required when credentials are present; crm_client_id + crm_client_secret are an all-or-nothing pair that is REQUIRED when the effective crmMode is legacy and FORBIDDEN when it is embedded (an embedded bag carries the ledger pair only, e.g. credentials:{ledger_client_id,ledger_client_secret}); the example shows the legacy four-field shape. blockableBalances carries the LEDGER's balance-key values (for Midaz: balanceKey, e.g. default/overdraft/a client-registered key) — NOT available/onHold, which are fields of a balance, not keys; the set is open and unvalidated, so a wrong value is not rejected, it only makes the admission gate never match. The presence of the credentials subtree selects authentication; there is no authMode. crmMode is a cleartext routing selector, never a credential: it is preserved on GET, which also echoes the RESOLVED surface as the read-only effectiveCrmMode. Credential values are sealed before the row is written and are never echoed. examples: - authAddress: https://auth.example.com baseUrl: https://midaz.example.com blockableAccountTypes: - deposit blockableBalances: - default credentials: crm_client_id: midaz-crm-client crm_client_secret: REPLACE_ME ledger_client_id: midaz-ledger-client ledger_client_secret: REPLACE_ME crmBaseUrl: https://midaz-crm.example.com crmMode: legacy organizations: - ledgers: - 019fcd7c-1e18-7034-8cd3-9e39c1759e41 organizationId: 019fcd7b-97df-71a5-8023-6eb3c661968b connectorType: description: The outbound connector type for this institution. examples: - midaz type: string enabled: description: Whether the connector configuration is active. examples: - true type: boolean institutionCode: description: >- The institution's BACEN CNPJ (8 digits) for return-file headers and file header validation. examples: - '12345678' type: string institutionId: description: >- The institution's unique identifier (UUID) that addresses the new configuration. examples: - 550e8400-e29b-41d4-a716-446655440000 type: string retryPolicyConfig: description: Operational retry policy (backoff/attempts) as arbitrary JSON. examples: - initialBackoffMs: 100 maxAttempts: 3 required: - institutionId - connectorType - institutionCode - enabled type: object InstitutionConfigResponse: additionalProperties: false properties: accountFormat: description: >- The regular expression the institution declared for the account number of a court-indicated target; omitted when none is declared. examples: - ^[0-9]{1,12}$ type: string branchFormat: description: >- The regular expression the institution declared for the branch (agência) number of a court-indicated target; omitted when none is declared. examples: - ^[0-9]{4}$ type: string connectorMetadata: description: >- Connector-specific configuration bag. The non-secret connector-owned keys (baseUrl, authAddress, crmBaseUrl, crmMode, organizations[], blockableBalances, blockableAccountTypes, salaryAccountTypes) are preserved verbatim; secret-bearing keys — the whole credentials subtree included — are removed and never echoed. blockableBalances carries the LEDGER's balance-key values — for Midaz, balanceKey (default/overdraft/a client-registered key), not the available/onHold fields of a balance. examples: - baseUrl: https://midaz.example.com blockableAccountTypes: - deposit blockableBalances: - default organizations: - ledgers: - 019fcd7c-1e18-7034-8cd3-9e39c1759e41 organizationId: 019fcd7b-97df-71a5-8023-6eb3c661968b connectorMetadataValid: description: >- Present and false only when the stored connector metadata cannot be parsed by its connector; absent otherwise. The offending value is never echoed. examples: - false readOnly: true type: boolean connectorType: description: The outbound connector type for this institution. examples: - midaz type: string createdAt: description: RFC 3339 creation timestamp (UTC). examples: - '2024-01-15T10:30:00Z' type: string effectiveCrmMode: description: >- The CRM surface this institution resolves to (legacy|embedded): its own crmMode override when the connector metadata names one, the service-wide default otherwise. Derived and read-only; omitted when the connector metadata cannot be parsed. enum: - legacy - embedded examples: - legacy readOnly: true type: string enabled: description: Whether the connector configuration is active. examples: - true type: boolean institutionCode: description: >- The institution's BACEN CNPJ (8 digits) for return-file headers and file header validation. examples: - '12345678' type: string institutionId: description: The institution's unique identifier (UUID). examples: - 550e8400-e29b-41d4-a716-446655440000 type: string retryPolicyConfig: description: Operational retry policy (backoff/attempts) as arbitrary JSON. examples: - maxAttempts: 3 updatedAt: description: RFC 3339 last-update timestamp (UTC). examples: - '2024-01-15T12:00:00Z' type: string required: - institutionId - connectorType - institutionCode - enabled - createdAt - updatedAt type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.