List Credential Profiles
Enterprise only
Only available for enterprise customers. Returns all credential profiles for the authenticated account.
Request
# Build the JSON payload
PAYLOAD="{}"
# Sign the payload
PAYLOAD_B64=$(printf '%s' "$PAYLOAD" | openssl base64 -A)
SIG=$(printf '%s' "$PAYLOAD_B64" | openssl dgst -sha256 -hmac "$SECRET_KEY" -hex | awk '{print $NF}')
# Send curl request
curl -G \
-H "X-ACCT-ID: $ACCOUNT_ID" \
-H "X-PAYLOAD-SIG: $SIG" \
--data-urlencode "sig_payload=$PAYLOAD" \
"https://api.accessgrid.com/v1/console/credential-profiles"
require 'accessgrid'
account_id = ENV['ACCOUNT_ID']
secret_key = ENV['SECRET_KEY']
client = AccessGrid::Client.new(account_id, secret_key)
profiles = client.console.credential_profiles.list
profiles.each do |profile|
puts "ID: #{profile.id}, Name: #{profile.name}, AID: #{profile.aid}"
end
import AccessGrid from 'accessgrid';
const accountId = process.env.ACCOUNT_ID;
const secretKey = process.env.SECRET_KEY;
const client = new AccessGrid(accountId, secretKey);
const listProfiles = async () => {
try {
const profiles = await client.console.credentialProfiles.list();
profiles.forEach(profile => {
console.log(`ID: ${profile.id}, Name: ${profile.name}, AID: ${profile.aid}`);
});
} catch (error) {
console.error('Error listing credential profiles:', error);
}
};
listProfiles();
from accessgrid import AccessGrid
import os
account_id = os.getenv('ACCOUNT_ID')
secret_key = os.getenv('SECRET_KEY')
client = AccessGrid(account_id, secret_key)
profiles = client.console.credential_profiles.list()
for profile in profiles:
print(f"ID: {profile.id}, Name: {profile.name}, AID: {profile.aid}")
package main
import (
"context"
"fmt"
"os"
"github.com/Access-Grid/accessgrid-go"
)
func main() {
accountID := os.Getenv("ACCOUNT_ID")
secretKey := os.Getenv("SECRET_KEY")
client, err := accessgrid.NewClient(accountID, secretKey)
if err != nil {
fmt.Printf("Error creating client: %v\n", err)
return
}
ctx := context.Background()
profiles, err := client.Console.CredentialProfiles.List(ctx)
if err != nil {
fmt.Printf("Error listing credential profiles: %v\n", err)
return
}
for _, profile := range profiles {
fmt.Printf("ID: %s, Name: %s, AID: %s\n", profile.ID, profile.Name, profile.AID)
}
}
using AccessGrid;
using System;
using System.Threading.Tasks;
public async Task ListProfilesAsync()
{
var accountId = Environment.GetEnvironmentVariable("ACCOUNT_ID");
var secretKey = Environment.GetEnvironmentVariable("SECRET_KEY");
var client = new AccessGridClient(accountId, secretKey);
var profiles = await client.Console.CredentialProfiles.ListAsync();
foreach (var profile in profiles)
{
Console.WriteLine($"ID: {profile.Id}, Name: {profile.Name}, AID: {profile.Aid}");
}
}
import com.organization.accessgrid.AccessGridClient;
import com.organization.accessgrid.model.CredentialProfile;
import java.util.List;
public class CredentialProfileService {
private final AccessGridClient client;
public CredentialProfileService() {
String accountId = System.getenv("ACCOUNT_ID");
String secretKey = System.getenv("SECRET_KEY");
this.client = new AccessGridClient(accountId, secretKey);
}
public void listProfiles() throws AccessGridException {
List<CredentialProfile> profiles = client.console().credentialProfiles().list();
for (CredentialProfile profile : profiles) {
System.out.printf("ID: %s, Name: %s, AID: %s%n",
profile.getId(),
profile.getName(),
profile.getAid());
}
}
}
<?php
require 'vendor/autoload.php';
use AccessGridClient;
$accountId = $_ENV['ACCOUNT_ID'];
$secretKey = $_ENV['SECRET_KEY'];
$client = new Client($accountId, $secretKey);
$profiles = $client->console->credentialProfiles->list();
foreach ($profiles as $profile) {
echo "ID: {$profile->id}, Name: {$profile->name}, AID: {$profile->aid}\n";
}
{:ok, client} = AccessGrid.Client.new(
System.get_env("ACCOUNT_ID"),
System.get_env("SECRET_KEY")
)
{:ok, profiles} = AccessGrid.Console.CredentialProfiles.list(client)
Enum.each(profiles, fn profile ->
IO.puts("ID: #{profile.id}, Name: #{profile.name}, AID: #{profile.aid}")
end)
Response
[
{
"id": "a1b2c3d4e5f",
"aid": "F56401",
"name": "Main Office Profile",
"apple_id": "desfire_accessgrid_v1",
"created_at": "2025-01-15T12:00:00Z",
"card_storage": "4K EV1",
"keys": [
{ "ex_id": "00", "label": "Master", "keys_diversified": null, "source_key_index": null },
{ "ex_id": "01", "label": "Generic / Read", "keys_diversified": null, "source_key_index": null }
],
"files": [
{ "ex_id": "00", "file_type": "standard", "file_size": null, "communication_settings": "encrypted_with_mac", "read_rights": "read", "write_rights": "master", "read_write_rights": "master", "change_rights": "no-keys" }
]
},
{
"id": "f6e5d4c3b2a",
"aid": "ACCE55",
"name": "Warehouse Profile",
"apple_id": "accessgrid_kdf_desfire_v1",
"created_at": "2025-02-20T09:30:00Z",
"card_storage": "4K EV1",
"keys": [
{ "ex_id": "00", "label": "Master", "keys_diversified": false, "source_key_index": null },
{ "ex_id": "01", "label": "Generic / Read", "keys_diversified": true, "source_key_index": 0 },
{ "ex_id": "02", "label": "Privacy", "keys_diversified": true, "source_key_index": 0 }
],
"files": [
{ "ex_id": "00", "file_type": "standard", "file_size": null, "communication_settings": "encrypted_with_mac", "read_rights": "read", "write_rights": "master", "read_write_rights": "master", "change_rights": "no-keys" }
]
}
]
Create Credential Profile
Enterprise only
Only available for enterprise customers. Creates a new credential profile with DESFire keys for the authenticated account.
Read the DESFire application structures guide first — it explains the application id, key layout, and diversification strategy that the fields below configure.
name
nullable string
All
app_name
nullable string
All
keys
array
All
value
string
All
32-character hexadecimal key value (e.g. "6621fec0ffee15decafbab1ecd6abb11").
keys_diversified
nullable boolean
All
Set to true when you want AccessGrid to derive this key per-card using the AN10922 algorithm. Leave unset (or false) to use the value you provided as-is.
source_key_index
nullable integer
All
Index of the key used as the derivation source when keys_diversified is true. For ag_main, this is typically the privacy key (index 2).
file_id
nullable string
All
file_size
nullable integer
All
Request
# Build the JSON payload
PAYLOAD=$(cat <<EOF
{
"name": "Main Office Profile",
"app_name": "KEY-ID-main",
"keys": [
{"value": "your_32_char_hex_master_key_here"},
{"value": "your_32_char_hex__read_key__here"}
]
}
EOF)
# Sign the payload
PAYLOAD_B64=$(printf '%s' "$PAYLOAD" | openssl base64 -A)
SIG=$(printf '%s' "$PAYLOAD_B64" | openssl dgst -sha256 -hmac "$SECRET_KEY" -hex | awk '{print $NF}')
# Send curl request
curl -X POST \
-H "X-ACCT-ID: $ACCOUNT_ID" \
-H "X-PAYLOAD-SIG: $SIG" \
-H "Content-Type: application/json" \
-d "$PAYLOAD" \
"https://api.accessgrid.com/v1/console/credential-profiles"
require 'accessgrid'
account_id = ENV['ACCOUNT_ID']
secret_key = ENV['SECRET_KEY']
client = AccessGrid::Client.new(account_id, secret_key)
profile = client.console.credential_profiles.create(
name: 'Main Office Profile',
app_name: 'KEY-ID-main',
keys: [
{ value: 'your_32_char_hex_master_key_here' },
{ value: 'your_32_char_hex__read_key__here' }
]
)
puts "Profile created: #{profile.id}"
puts "AID: #{profile.aid}"
import AccessGrid from 'accessgrid';
const accountId = process.env.ACCOUNT_ID;
const secretKey = process.env.SECRET_KEY;
const client = new AccessGrid(accountId, secretKey);
const createProfile = async () => {
try {
const profile = await client.console.credentialProfiles.create({
name: 'Main Office Profile',
appName: 'KEY-ID-main',
keys: [
{ value: 'your_32_char_hex_master_key_here' },
{ value: 'your_32_char_hex__read_key__here' }
]
});
console.log(`Profile created: ${profile.id}`);
console.log(`AID: ${profile.aid}`);
} catch (error) {
console.error('Error creating credential profile:', error);
}
};
createProfile();
from accessgrid import AccessGrid
import os
account_id = os.getenv('ACCOUNT_ID')
secret_key = os.getenv('SECRET_KEY')
client = AccessGrid(account_id, secret_key)
profile = client.console.credential_profiles.create(
name='Main Office Profile',
app_name='KEY-ID-main',
keys=[
{'value': 'your_32_char_hex_master_key_here'},
{'value': 'your_32_char_hex__read_key__here'}
]
)
print(f"Profile created: {profile.id}")
print(f"AID: {profile.aid}")
package main
import (
"context"
"fmt"
"os"
"github.com/Access-Grid/accessgrid-go"
)
func main() {
accountID := os.Getenv("ACCOUNT_ID")
secretKey := os.Getenv("SECRET_KEY")
client, err := accessgrid.NewClient(accountID, secretKey)
if err != nil {
fmt.Printf("Error creating client: %v\n", err)
return
}
params := accessgrid.CreateCredentialProfileParams{
Name: "Main Office Profile",
AppName: "KEY-ID-main",
Keys: []accessgrid.KeyParam{
{Value: "your_32_char_hex_master_key_here"},
{Value: "your_32_char_hex__read_key__here"},
},
}
ctx := context.Background()
profile, err := client.Console.CredentialProfiles.Create(ctx, params)
if err != nil {
fmt.Printf("Error creating credential profile: %v\n", err)
return
}
fmt.Printf("Profile created: %s\n", profile.ID)
fmt.Printf("AID: %s\n", profile.AID)
}
using AccessGrid;
using System;
using System.Threading.Tasks;
public async Task CreateProfileAsync()
{
var accountId = Environment.GetEnvironmentVariable("ACCOUNT_ID");
var secretKey = Environment.GetEnvironmentVariable("SECRET_KEY");
var client = new AccessGridClient(accountId, secretKey);
var profile = await client.Console.CredentialProfiles.CreateAsync(new CreateCredentialProfileRequest
{
Name = "Main Office Profile",
AppName = "KEY-ID-main",
Keys = new[]
{
new KeyParam { Value = "your_32_char_hex_master_key_here" },
new KeyParam { Value = "your_32_char_hex__read_key__here" }
}
});
Console.WriteLine($"Profile created: {profile.Id}");
Console.WriteLine($"AID: {profile.Aid}");
}
import com.organization.accessgrid.AccessGridClient;
import com.organization.accessgrid.model.CredentialProfile;
import com.organization.accessgrid.model.CreateCredentialProfileRequest;
import com.organization.accessgrid.model.KeyParam;
import java.util.List;
public class CredentialProfileService {
private final AccessGridClient client;
public CredentialProfileService() {
String accountId = System.getenv("ACCOUNT_ID");
String secretKey = System.getenv("SECRET_KEY");
this.client = new AccessGridClient(accountId, secretKey);
}
public CredentialProfile createProfile() throws AccessGridException {
CreateCredentialProfileRequest request = CreateCredentialProfileRequest.builder()
.name("Main Office Profile")
.appName("KEY-ID-main")
.keys(List.of(
new KeyParam("your_32_char_hex_master_key_here"),
new KeyParam("your_32_char_hex__read_key__here")
))
.build();
CredentialProfile profile = client.console().credentialProfiles().create(request);
System.out.printf("Profile created: %s%n", profile.getId());
System.out.printf("AID: %s%n", profile.getAid());
return profile;
}
}
<?php
require 'vendor/autoload.php';
use AccessGridClient;
$accountId = $_ENV['ACCOUNT_ID'];
$secretKey = $_ENV['SECRET_KEY'];
$client = new Client($accountId, $secretKey);
$profile = $client->console->credentialProfiles->create([
'name' => 'Main Office Profile',
'app_name' => 'KEY-ID-main',
'keys' => [
['value' => 'your_32_char_hex_master_key_here'],
['value' => 'your_32_char_hex__read_key__here']
]
]);
echo "Profile created: {$profile->id}\n";
echo "AID: {$profile->aid}\n";
{:ok, client} = AccessGrid.Client.new(
System.get_env("ACCOUNT_ID"),
System.get_env("SECRET_KEY")
)
{:ok, profile} = AccessGrid.Console.CredentialProfiles.create(client,
name: "Main Office Profile",
app_name: "KEY-ID-main",
keys: [
%{value: "your_32_char_hex_master_key_here"},
%{value: "your_32_char_hex__read_key__here"}
]
)
IO.puts("Profile created: #{profile.id}")
IO.puts("AID: #{profile.aid}")
Response
{
"id": "a1b2c3d4e5f",
"aid": "F56401",
"name": "Main Office Profile",
"apple_id": "desfire_accessgrid_v1",
"created_at": "2025-01-15T12:00:00Z",
"card_storage": "4K EV1",
"keys": [
{ "ex_id": "00", "label": "Master", "keys_diversified": null, "source_key_index": null },
{ "ex_id": "01", "label": "Generic / Read", "keys_diversified": null, "source_key_index": null }
],
"files": [
{ "ex_id": "00", "file_type": "standard", "file_size": null, "communication_settings": "encrypted_with_mac", "read_rights": "read", "write_rights": "master", "read_write_rights": "master", "change_rights": "no-keys" }
]
}
Delete Credential Profile
Enterprise only
Only available for enterprise customers - soft-deletes a credential profile. The profile can only be deleted when no active card templates reference it and every access pass directly associated with it is in deleted state. Once deleted, the profile no longer appears in listings and cannot be used. Returns 422 with active_pass_template_count and active_pass_count fields if any blockers remain.
credential_profile_id
string
All
Request
# Build the JSON payload
PROFILE_ID="a1b2c3d4e5f"
PAYLOAD="{\"credential_profile_id\":\"$PROFILE_ID\"}"
# Sign the payload
PAYLOAD_B64=$(printf '%s' "$PAYLOAD" | openssl base64 -A)
SIG=$(printf '%s' "$PAYLOAD_B64" | openssl dgst -sha256 -hmac "$SECRET_KEY" -hex | awk '{print $NF}')
curl -X DELETE -G \
-H "X-ACCT-ID: $ACCOUNT_ID" \
-H "X-PAYLOAD-SIG: $SIG" \
--data-urlencode "sig_payload=$PAYLOAD" \
"https://api.accessgrid.com/v1/console/credential-profiles/$PROFILE_ID"
require 'accessgrid'
account_id = ENV['ACCOUNT_ID']
secret_key = ENV['SECRET_KEY']
client = AccessGrid::Client.new(account_id, secret_key)
client.console.credential_profiles.delete("a1b2c3d4e5f")
puts "Credential profile deleted"
import AccessGrid from 'accessgrid';
const accountId = process.env.ACCOUNT_ID;
const secretKey = process.env.SECRET_KEY;
const client = new AccessGrid(accountId, secretKey);
const deleteProfile = async () => {
try {
await client.console.credentialProfiles.delete({
credentialProfileId: "a1b2c3d4e5f"
});
console.log('Credential profile deleted');
} catch (error) {
console.error('Error deleting credential profile:', error);
}
};
deleteProfile();
from accessgrid import AccessGrid
import os
account_id = os.getenv('ACCOUNT_ID')
secret_key = os.getenv('SECRET_KEY')
client = AccessGrid(account_id, secret_key)
client.console.credential_profiles.delete(
credential_profile_id="a1b2c3d4e5f"
)
print("Credential profile deleted")
package main
import (
"context"
"fmt"
"os"
"github.com/Access-Grid/accessgrid-go"
)
func main() {
accountID := os.Getenv("ACCOUNT_ID")
secretKey := os.Getenv("SECRET_KEY")
client, err := accessgrid.NewClient(accountID, secretKey)
if err != nil {
fmt.Printf("Error creating client: %v\n", err)
return
}
ctx := context.Background()
err = client.Console.CredentialProfiles.Delete(ctx, "a1b2c3d4e5f")
if err != nil {
fmt.Printf("Error deleting credential profile: %v\n", err)
return
}
fmt.Println("Credential profile deleted")
}
using AccessGrid;
using System;
using System.Threading.Tasks;
public async Task DeleteProfileAsync()
{
var accountId = Environment.GetEnvironmentVariable("ACCOUNT_ID");
var secretKey = Environment.GetEnvironmentVariable("SECRET_KEY");
var client = new AccessGridClient(accountId, secretKey);
await client.Console.CredentialProfiles.DeleteAsync("a1b2c3d4e5f");
Console.WriteLine("Credential profile deleted");
}
import com.organization.accessgrid.AccessGridClient;
public class CredentialProfileService {
private final AccessGridClient client;
public CredentialProfileService() {
String accountId = System.getenv("ACCOUNT_ID");
String secretKey = System.getenv("SECRET_KEY");
this.client = new AccessGridClient(accountId, secretKey);
}
public void deleteProfile() throws AccessGridException {
client.console().credentialProfiles().delete("a1b2c3d4e5f");
System.out.println("Credential profile deleted");
}
}
<?php
require 'vendor/autoload.php';
use AccessGridClient;
$accountId = $_ENV['ACCOUNT_ID'];
$secretKey = $_ENV['SECRET_KEY'];
$client = new Client($accountId, $secretKey);
$client->console->credentialProfiles->delete('a1b2c3d4e5f');
echo "Credential profile deleted\n";
client = AccessGrid.Client.new(
account_id: System.get_env("ACCOUNT_ID"),
api_secret: System.get_env("SECRET_KEY")
)
{:ok, _} = AccessGrid.Console.delete_credential_profile("a1b2c3d4e5f", client: client)
IO.puts("Credential profile deleted")
Response
{
"id": "a1b2c3d4e5f",
"deactivated": true
}