> ## Documentation Index > Fetch the complete documentation index at: https://developer.hellgate.io/llms.txt > Use this file to discover all available pages before exploring further. # Update settings > Upload your Apple identity so Guardian can generate CSRs, serve the domain-association file, and validate merchant sessions. Provide your `merchant_identifier`, a `display_name`, the byte-exact `domain_association_content` Apple issued, and the `csr_common_name` to embed in generated CSRs. The upload is a partial update: fields you omit keep their current values, and no field is individually required. All four must be set before the dependent flows work. Available only on `self_managed` instances. On Starfish-operated (`sf_operated`) instances the Apple identity and certificates are managed by Starfish, and this endpoint returns `409` with the classifier `APPLE_PAY_CERT_MANAGEMENT_UNAVAILABLE`. ## OpenAPI ````yaml /products/guardian/openapi.yaml put /api/wallet/apple-pay/settings openapi: 3.1.0 info: title: Guardian API version: '1.0' contact: name: Starfish GmbH & Co. KG email: hello@starfish.team url: https://hellgate.io/cpa/guardian license: name: Hellgate API Terms url: https://hellgate.io/terms-and-conditions servers: - url: https://{cluster_id}.on-hellgate.cloud description: Guardian service instance variables: cluster_id: default: my-cluster-id description: | Guardian is a service of the Hellgate Cloud Platform. The unique cluster-id is used to connect to your instance. security: [] tags: - name: pci description: Management of card payment credentials under the ruling of PCI DSS. - name: network description: Management of network tokens and cryptograms for secure transactions. - name: generic description: Management of generic tokens and their schemas for various use cases. - name: metadata description: Inquiries for card metadata based on PAN, PCI tokens, or network tokens. - name: wallet description: >- Management of wallet tokens ingested from device wallets such as Google Pay. - name: apikey description: Management of API keys for service access. - name: webhook description: Management of webhooks for event notifications. - name: types description: Management of types for generic token schemas. paths: /api/wallet/apple-pay/settings: put: tags: - wallet summary: Update settings description: > Upload your Apple identity so Guardian can generate CSRs, serve the domain-association file, and validate merchant sessions. Provide your `merchant_identifier`, a `display_name`, the byte-exact `domain_association_content` Apple issued, and the `csr_common_name` to embed in generated CSRs. The upload is a partial update: fields you omit keep their current values, and no field is individually required. All four must be set before the dependent flows work. Available only on `self_managed` instances. On Starfish-operated (`sf_operated`) instances the Apple identity and certificates are managed by Starfish, and this endpoint returns `409` with the classifier `APPLE_PAY_CERT_MANAGEMENT_UNAVAILABLE`. operationId: wallet_apple_pay_settings_update requestBody: content: application/json: schema: $ref: '#/components/schemas/apple_pay_settings_request' responses: '200': description: Success response content: application/json: schema: $ref: '#/components/schemas/apple_pay_settings' '401': $ref: '#/components/responses/401_UnauthorizedError' '403': $ref: '#/components/responses/403_ForbiddenError' '409': $ref: '#/components/responses/409_ConflictError' '422': $ref: '#/components/responses/422_ValidationError' security: - APIKey: [] - AdminToken: [] components: schemas: apple_pay_settings_request: type: object description: > The Apple identity Guardian uses on a `self_managed` instance. Every field is optional per request; omitted fields keep their current values. properties: merchant_identifier: type: string description: Your Apple Pay merchant identifier. example: merchant.com.example display_name: type: string description: The merchant display name shown in the Apple Pay sheet. example: Example Store domain_association_content: type: string description: >- The byte-exact body of the Apple-issued domain-association file, served verbatim at `/.well-known/apple-developer-merchantid-domain-association.txt`. csr_common_name: type: string description: >- The common name (CN) to embed in the certificate signing requests Guardian generates. example: Example Store apple_pay_settings: title: Apple Pay Settings type: object properties: mode: type: string description: > The operating mode of this instance. `self_managed` means you upload and manage your own Apple identity and certificates; `sf_operated` means Starfish operates the Apple Developer relationship and mounts the identity and certificates. enum: - self_managed - sf_operated merchant_identifier: type: string nullable: true example: merchant.com.example display_name: type: string nullable: true example: Example Store domain_association_content: type: string nullable: true description: >- The body of the domain-association file served at `/.well-known/apple-developer-merchantid-domain-association.txt`. csr_common_name: type: string nullable: true example: Example Store created_at: type: string format: date-time nullable: true updated_at: type: string format: date-time nullable: true required: - mode ErrorGeneric: type: object properties: code: $ref: '#/components/schemas/ErrorStatusCode' classifier: $ref: '#/components/schemas/ErrorClassifier' message: $ref: '#/components/schemas/ErrorMessage' ErrorValidation: type: object properties: code: $ref: '#/components/schemas/ErrorStatusCode' classifier: $ref: '#/components/schemas/ErrorClassifier' message: $ref: '#/components/schemas/ErrorMessage' validation_errors: type: array items: type: object properties: path: type: string description: Json-path in the request which points to the validation error message: type: string description: Human readable validation message ErrorStatusCode: type: integer description: The corresponding HTTP status code for the error ErrorClassifier: type: string description: Technical code that helps to identify the error ErrorMessage: type: string description: Human readable representation of the error responses: 401_UnauthorizedError: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 401 message: No valid means of authentication was provided classifier: UNAUTHORIZED 403_ForbiddenError: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 403 message: Not allowed to access this resource or feature classifier: FORBIDDEN 409_ConflictError: description: Conflict content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 409 message: Conflict classifier: CONFLICT 422_ValidationError: description: Validation error content: application/json: schema: $ref: '#/components/schemas/ErrorValidation' example: code: 422 classifier: VALIDATION_ERROR message: Validation error validation_errors: - path: json-path message: human readable error message securitySchemes: APIKey: type: apiKey name: x-api-key in: header AdminToken: type: apiKey name: x-admin-token in: header ````