> ## Documentation Index > Fetch the complete documentation index at: https://developer.hellgate.io/llms.txt > Use this file to discover all available pages before exploring further. # Update settings > Upload your Apple identity so Guardian can generate CSRs, serve the domain-association file, and validate merchant sessions. Provide your `merchant_identifier`, a `display_name`, the byte-exact `domain_association_content` Apple issued, and the `csr_common_name` to embed in generated CSRs. The upload is a partial update: fields you omit keep their current values, and no field is individually required. All four must be set before the dependent flows work. Available only on `self_managed` instances. On Starfish-operated (`sf_operated`) instances the Apple identity and certificates are managed by Starfish, and this endpoint returns `409` with the classifier `APPLE_PAY_CERT_MANAGEMENT_UNAVAILABLE`. ## OpenAPI ````yaml /products/guardian/openapi.yaml put /api/wallet/apple-pay/settings openapi: 3.1.0 info: title: Guardian API version: '1.0' contact: name: Starfish GmbH & Co. KG email: support@hellgate.io url: https://hellgate.io/cpa/guardian license: name: Hellgate API Terms url: https://hellgate.io/terms-and-conditions servers: - url: https://{instance}.{env}.on-hellgate.cloud description: Managed instance of Guardian variables: instance: default: my-instance description: Your unique instance slug, provided during onboarding. env: default: eu1 description: Deployment environment (currently eu1). security: [] tags: - name: pci description: Management of card payment credentials under the ruling of PCI DSS. - name: network description: Management of network tokens and cryptograms for secure transactions. - name: generic description: Management of generic tokens and their schemas for various use cases. - name: metadata description: Inquiries for card metadata based on PAN, PCI tokens, or network tokens. - name: wallet description: >- Management of wallet tokens ingested from device wallets such as Google Pay. - name: apikey description: Management of API keys for service access. - name: webhook description: Management of webhooks for event notifications. - name: types description: Management of types for generic token schemas. paths: /api/wallet/apple-pay/settings: put: tags: - wallet summary: Update settings description: > Upload your Apple identity so Guardian can generate CSRs, serve the domain-association file, and validate merchant sessions. Provide your `merchant_identifier`, a `display_name`, the byte-exact `domain_association_content` Apple issued, and the `csr_common_name` to embed in generated CSRs. The upload is a partial update: fields you omit keep their current values, and no field is individually required. All four must be set before the dependent flows work. Available only on `self_managed` instances. On Starfish-operated (`sf_operated`) instances the Apple identity and certificates are managed by Starfish, and this endpoint returns `409` with the classifier `APPLE_PAY_CERT_MANAGEMENT_UNAVAILABLE`. operationId: wallet_apple_pay_settings_update requestBody: content: application/json: schema: $ref: '#/components/schemas/apple_pay_settings_request' responses: '200': description: Success response content: application/json: schema: $ref: '#/components/schemas/apple_pay_settings' '401': $ref: '#/components/responses/401_UnauthorizedError' '403': $ref: '#/components/responses/403_ForbiddenError' '409': $ref: '#/components/responses/409_ConflictError' '422': $ref: '#/components/responses/422_ValidationError' security: - bearerAuth: [] - APIKey: [] components: schemas: apple_pay_settings_request: type: object description: > The Apple identity Guardian uses on a `self_managed` instance. Every field is optional per request; omitted fields keep their current values. properties: merchant_identifier: type: string description: Your Apple Pay merchant identifier. example: merchant.com.example display_name: type: string description: The merchant display name shown in the Apple Pay sheet. example: Example Store domain_association_content: example: 7B227073704964223A2242463632... type: string description: >- The byte-exact body of the Apple-issued domain-association file, served verbatim at `/.well-known/apple-developer-merchantid-domain-association.txt`. csr_common_name: type: string description: >- The common name (CN) to embed in the certificate signing requests Guardian generates. example: Example Store apple_pay_settings: title: Apple Pay Settings type: object properties: mode: type: string description: > The operating mode of this instance. `self_managed` means you upload and manage your own Apple identity and certificates; `sf_operated` means Starfish operates the Apple Developer relationship and mounts the identity and certificates. enum: - self_managed - sf_operated merchant_identifier: type: string nullable: true example: merchant.com.example display_name: type: string nullable: true example: Example Store domain_association_content: example: 7B227073704964223A2242463632... type: string nullable: true description: >- The body of the domain-association file served at `/.well-known/apple-developer-merchantid-domain-association.txt`. csr_common_name: type: string nullable: true example: Example Store created_at: example: '2026-02-01T09:00:00Z' type: string format: date-time nullable: true updated_at: example: '2026-02-01T09:00:00Z' type: string format: date-time nullable: true required: - mode ErrorGeneric: type: object properties: code: $ref: '#/components/schemas/ErrorStatusCode' classifier: $ref: '#/components/schemas/ErrorClassifier' message: $ref: '#/components/schemas/ErrorMessage' ErrorValidation: type: object properties: code: $ref: '#/components/schemas/ErrorStatusCode' classifier: $ref: '#/components/schemas/ErrorClassifier' message: $ref: '#/components/schemas/ErrorMessage' validation_errors: type: array items: type: object properties: path: example: $.source.account_number type: string description: Json-path in the request which points to the validation error message: example: is required type: string description: Human readable validation message ErrorStatusCode: type: integer description: The corresponding HTTP status code for the error ErrorClassifier: type: string description: Technical code that helps to identify the error ErrorMessage: type: string description: Human readable representation of the error responses: 401_UnauthorizedError: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 401 message: No valid means of authentication was provided classifier: UNAUTHORIZED 403_ForbiddenError: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 403 message: Not allowed to access this resource or feature classifier: FORBIDDEN 409_ConflictError: description: Conflict content: application/json: schema: $ref: '#/components/schemas/ErrorGeneric' example: code: 409 message: Conflict classifier: CONFLICT 422_ValidationError: description: Validation error content: application/json: schema: $ref: '#/components/schemas/ErrorValidation' example: code: 422 classifier: VALIDATION_ERROR message: Validation error validation_errors: - path: json-path message: human readable error message securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian. APIKey: type: apiKey name: x-api-key in: header description: >- Deprecated. Long-lived instance API key, sent as `x-api-key`. Existing integrations continue to work, but new ones should use the OAuth2 bearer token instead. ````