Page tree
Skip to end of metadata
Go to start of metadata

This article describes extensions to the Personal Messaging API that are specific to 1.1 - Nexus Personal Desktop App. For the full API description, see Hermod API


Expand/Collapse All

API commands 

 Sign

Personal Desktop App supports both JWS and PKCS7 signatures. Not all the message properties that are described in the API documentation are supported by Personal Desktop App.

 Authenticate

Since Authenticate is a specific application of the Sign command. Therefore, the same applies as for the Sign command.

 Startpinreset

This command is only used with Personal Desktop App.

Parameters

ParameterDescription

“smartcardid”

Defines which profile in Personal Desktop App that is targeted.

Response Parameters

ParameterDescription

“nonce”

This value is generated by Personal Desktop App and sent to the server to be encrypted by adminkey and returned using the Epin command as proof of adminkey possession.
 Endpinreset

This command is only used with Personal Desktop App.

Parameters

ParameterDescription

“encryptednonce”

Encrypted nonce that was sent in Spin command to Hermod.

“smartcardid”

Defines which profile in Personal Desktop App that is targeted.

“newadminkey”

Optional.

If present, instead of initiating a PIN reset, it actually changes previous adminkey to the current one.

Hexencoded adminkey, which means 48 lowercase ASCI characters encoding 24 bytes of the new key.



 Certificate

This command is used to import certificates.

Parameters

ParameterDescription

“smartcardid”

If the intended profile has it’s smartcardid different from profileid, you need to use smartcardid to identify it.
 Ping

This command is used to gather information about the device and the profile.

Parameters

ParameterDescription

“deviceinfo”:”true”/”false”

If true, the response will contain a set named deviceinfo with the following content:

  • “operatingsystem” - version of Windows 10
  • “name” - computer name
  • “model” - version of Personal Desktop App
“profileinfo”:”true”/”false”

If true, the response will contain an array with each set having the following content:

  • “profileid”
  • “displayname”
  • “certs” - Comma separated list of cert hashes
“profileid”

Used if you want to receive profileinfo. Use a specific profileid to gather all profiles associated with it in a given installation.

 Provision

The Provision command has many parameters that are specific to Personal Desktop App.

desktopExtensions is used to transfer data between Personal Desktop App and the server, without Hermod validating or checking it in any way. It has the form of an array with “key” and “data”, where key is as listed here after the colon and data given in the description.

Parameters:

ParameterDescription

“vscinfo”:”smartcardid”


“vscinfo”:”adminkey”
“vscinfo”:”oldadminkey”
“desktopExtensions”:”provisionreader”

“CreateTPM” means that Personal Desktop App attempts to create the virtual smartcard. This is only possible, if the running account has admin privileges.

“FreeTPM” means that Personal Desktop App attempts to find a virtual smart card that is available for use and then assign it to the profile. It also changes the adminkey from the oldadminkey to the “adminkey” and initiates a PIN reset operation.

“#TPM” works similarly as FreeTPM, but where # is an index of the virtual smart card to use.

“desktopExtensions”:”singleprofile”If set to true, provisioning is only allowed if there is no other profile created on the machine.
“desktopExtensions”:”deletedisabled”If this is set to true, the profile cannot be deleted locally and the only way to delete it is via remote delete command.
 Delete

The Delete command is used to delete a profile. Hermod also deletes the mailbox associated with the desktop.

Parameters:

ParameterDescription

"profileid”

Must match with the smartcardid.

“vscinfo”:”oldadminkey“

Old adminkey to change from.

“vscinfo”:”adminkey“

Adminkey to change to.

“vscinfo”:”smartcardid”

The ID of the profile to be deleted.

"confirmed“:“true“/“false“

If true, Hermod deletes the associated mailbox upon receiving OK from this message