> ## Documentation Index
> Fetch the complete documentation index at: https://docs.judit.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials Vault for Courts

> Register, query, update and delete lawyer credentials for courts securely on the Judit API. Access lawsuits under secrecy and sources that require login.

export const VaultAnimation = () => <iframe sandbox="allow-scripts" scrolling="no" style={{
  width: '100%',
  height: '540px',
  border: 'none',
  borderRadius: '12px',
  display: 'block',
  margin: '20px 0'
}} srcDoc={`<!doctype html><html><head><meta charset="utf-8"><style>*{margin:0;padding:0;box-sizing:border-box}html,body{width:100%;height:100%;overflow:hidden;background:#090c0d}canvas{display:block;width:100%;height:100%}</style></head><body><canvas id="c"></canvas><script>(function(){
var A='#4FD1C5',J='#1FC16B',T='#E0A82E',P='#C084FC',M='#7A8599';
var BG='#090c0d',TXT='#e5e7eb',NF='#111827',PT2='#0a1020';
var TOTAL=30.0;
var XP={cli:0.09,judit:0.38,cofre:0.65,court:0.90};
var NW=86,NH=42;
var FLOWS=[
  {id:'reg',title:'① Credential Registration',sub:'Configure once per court',col:A,ts:1,te:14,act:['cli','cofre','court'],steps:[
    {fr:'cli',to:'court',label:'validates credential',note:'creates user/password in the portal',col:T,ts:1.5,te:2.3,yp:0.35},
    {fr:'cli',to:'cofre',label:'POST /credentials',note:'{system_name, customer_key, password}',col:P,ts:3.2,te:4.0,yp:0.52},
    {fr:'cofre',to:'cli',label:'CREDENTIAL_CREATED',note:'encrypted credential',col:P,ts:4.5,te:5.3,yp:0.68}]},
  {id:'use',title:'② Using in a Query',sub:'Reference customer_key in the request',col:J,ts:16,te:29,act:['cli','judit','cofre','court'],steps:[
    {fr:'cli',to:'judit',label:'POST /requests',note:'{customer_key}',col:A,ts:16.5,te:17.3,yp:0.28},
    {fr:'judit',to:'cofre',label:'fetches credential',note:'',col:P,ts:17.8,te:18.6,yp:0.40},
    {fr:'cofre',to:'judit',label:'credential found',note:'',col:P,ts:19.1,te:19.9,yp:0.52},
    {fr:'judit',to:'court',label:'authenticated access',note:'secret lawsuit',col:T,ts:20.4,te:21.2,yp:0.64},
    {fr:'court',to:'judit',label:'restricted data',note:'',col:J,ts:21.7,te:22.5,yp:0.76},
    {fr:'judit',to:'cli',label:'response_data',note:'',col:J,ts:23.0,te:23.8,yp:0.88}]}
];
var NODES=[{id:'cli',label:'Your App',col:A},{id:'judit',label:'Judit API',col:J},{id:'cofre',label:'Vault',col:P},{id:'court',label:'Court',col:T}];
var cv=document.getElementById('c');
function setup(){var dpr=Math.min(window.devicePixelRatio||1,2),r=cv.getBoundingClientRect(),W=r.width||window.innerWidth,H=r.height||window.innerHeight;cv.width=Math.max(1,W*dpr);cv.height=Math.max(1,H*dpr);var ctx=cv.getContext('2d');ctx.setTransform(dpr,0,0,dpr,0,0);return{ctx:ctx,w:W,h:H};}
function ease(t){return t<0.5?2*t*t:1-Math.pow(-2*t+2,2)/2;}
function rr(ctx,x,y,w,h,r){ctx.beginPath();ctx.moveTo(x+r,y);ctx.arcTo(x+w,y,x+w,y+h,r);ctx.arcTo(x+w,y+h,x,y+h,r);ctx.arcTo(x,y+h,x,y,r);ctx.arcTo(x,y,x+w,y,r);ctx.closePath();}
function gx(n,w){return n==='cli'?w*XP.cli:n==='judit'?w*XP.judit:n==='cofre'?w*XP.cofre:w*XP.court;}
function eg(fr,to,w){var fx=gx(fr,w),tx=gx(to,w),d=tx>fx?1:-1;return{x1:fx+d*NW/2,x2:tx-d*NW/2,d:d};}
function dPkt(ctx,x,y,lbl,col){var pw=Math.max(36,lbl.length*6+14),ph=20;ctx.save();ctx.shadowColor=col;ctx.shadowBlur=18;rr(ctx,x-pw/2,y-ph/2,pw,ph,5);ctx.fillStyle=col;ctx.fill();ctx.shadowBlur=0;ctx.fillStyle=PT2;ctx.font='bold 9px monospace';ctx.textAlign='center';ctx.textBaseline='middle';ctx.fillText(lbl,x,y+0.5);ctx.restore();}
function draw(ctx,w,h,t){
  var ct=t%TOTAL;
  ctx.fillStyle=BG;ctx.fillRect(0,0,w,h);
  var fl=null;for(var i=0;i<FLOWS.length;i++){if(ct>=FLOWS[i].ts&&ct<FLOWS[i].te){fl=FLOWS[i];break;}}
  var nodeY=h*0.21;
  for(var i=0;i<NODES.length;i++){var n=NODES[i],lx=gx(n.id,w),ia=!fl||(fl.act.indexOf(n.id)>=0);ctx.save();ctx.strokeStyle=n.col;ctx.globalAlpha=ia?0.35:0.07;ctx.lineWidth=1;ctx.setLineDash([4,7]);ctx.beginPath();ctx.moveTo(lx,nodeY+NH/2);ctx.lineTo(lx,h*0.95);ctx.stroke();ctx.restore();}
  if(fl){ctx.save();ctx.fillStyle=fl.col;ctx.font='bold 13px Inter,system-ui,sans-serif';ctx.textAlign='center';ctx.textBaseline='middle';ctx.fillText(fl.title,w/2,h*0.055);ctx.fillStyle=M;ctx.font='10.5px Inter,system-ui,sans-serif';ctx.fillText(fl.sub,w/2,h*0.118);ctx.restore();}
  if(fl){for(var si=0;si<fl.steps.length;si++){var s=fl.steps[si],sy=h*s.yp,e=eg(s.fr,s.to,w),x1=e.x1,x2=e.x2,d=e.d,clx=(x1+x2)/2;var state=ct<s.ts?'pre':ct>s.te?'done':'live',alpha=state==='pre'?0.10:state==='done'?0.55:1.0;ctx.save();ctx.globalAlpha=alpha;ctx.strokeStyle=s.col;ctx.lineWidth=1.5;ctx.setLineDash([]);ctx.beginPath();ctx.moveTo(x1,sy);ctx.lineTo(x2,sy);ctx.stroke();ctx.fillStyle=s.col;ctx.beginPath();ctx.moveTo(x2,sy);ctx.lineTo(x2-d*7,sy-4);ctx.lineTo(x2-d*7,sy+4);ctx.closePath();ctx.fill();ctx.fillStyle=TXT;ctx.font='bold 10px monospace';ctx.textAlign='center';ctx.textBaseline='bottom';ctx.fillText(s.label,clx,sy-4);if(s.note){ctx.fillStyle=M;ctx.font='9px monospace';ctx.fillText(s.note,clx,sy-16);}ctx.restore();if(state==='live'){var p=ease((ct-s.ts)/(s.te-s.ts));dPkt(ctx,x1+(x2-x1)*p,sy+14,s.label,s.col);}}}
  for(var i=0;i<NODES.length;i++){var nd=NODES[i],px=gx(nd.id,w),ia=!fl||(fl.act.indexOf(nd.id)>=0);ctx.save();ctx.globalAlpha=ia?1:0.18;if(ia){ctx.shadowColor=nd.col;ctx.shadowBlur=14;}rr(ctx,px-NW/2,nodeY-NH/2,NW,NH,8);ctx.fillStyle=NF;ctx.fill();ctx.shadowBlur=0;ctx.strokeStyle=ia?nd.col:'rgba(255,255,255,0.10)';ctx.lineWidth=ia?1.8:1;ctx.stroke();ctx.fillStyle=ia?nd.col:M;ctx.font='bold 11px Inter,system-ui,sans-serif';ctx.textAlign='center';ctx.textBaseline='middle';ctx.fillText(nd.label,px,nodeY);ctx.restore();}
  for(var f=0;f<FLOWS.length;f++){var ia=fl&&fl.id===FLOWS[f].id;ctx.save();ctx.beginPath();ctx.arc(w/2+(f-0.5)*24,h*0.965,ia?5:3,0,Math.PI*2);ctx.fillStyle=ia?FLOWS[f].col:'rgba(255,255,255,0.18)';ctx.fill();ctx.restore();}
}
var dim,t0;
function loop(){var t=(performance.now()-t0)/1000;draw(dim.ctx,dim.w,dim.h,t);requestAnimationFrame(loop);}
window.addEventListener('load',function(){dim=setup();t0=performance.now();loop();});
window.addEventListener('resize',function(){dim=setup();});
cv.addEventListener('click',function(e){var r=cv.getBoundingClientRect(),cx=e.clientX-r.left,cy=e.clientY-r.top;for(var f=0;f<FLOWS.length;f++){var dx=cx-(dim.w/2+(f-(FLOWS.length-1)/2)*24),dy=cy-dim.h*0.962;if(dx*dx+dy*dy<=144){t0=performance.now()-FLOWS[f].ts*1000;break;}}});
cv.addEventListener('mousemove',function(e){var r=cv.getBoundingClientRect(),cx=e.clientX-r.left,cy=e.clientY-r.top,over=false;for(var f=0;f<FLOWS.length;f++){var dx=cx-(dim.w/2+(f-(FLOWS.length-1)/2)*24),dy=cy-dim.h*0.962;if(dx*dx+dy*dy<=144){over=true;break;}}cv.style.cursor=over?'pointer':'default';});
})()</script></body></html>`} />;

The **Credentials Vault** stores, encrypted, the credentials (CPF/OAB + password) that lawyers use to authenticate in Brazilian courts. With this, Judit can access lawsuits under **judicial secrecy** on behalf of the lawyer, without your application ever storing or transmitting the password.

> 🤖 Base endpoint: `https://crawler.production.judit.io/credentials`. Register once per system/court and reference it later in queries via `credential.customer_key`.

## When to use

<CardGroup cols={2}>
  <Card title="Access to secret lawsuits" icon="lock">
    Required to query civil and labor lawsuits under judicial secrecy.
  </Card>

  <Card title="Multi-tenant for firms" icon="users">
    Use `customer_key` to separate credentials per lawyer/client of the firm.
  </Card>

  <Card title="LGPD/GDPR compliance" icon="shield-halved">
    Passwords are stored encrypted in a dedicated vault — your application never transits the password.
  </Card>

  <Card title="Wildcard credential" icon="asterisk">
    Register `"system_name": "*"` as fallback for courts without a specific credential.
  </Card>
</CardGroup>

<VaultAnimation />

## Endpoint to register your keys in the credentials vault

To start using the credentials vault, you must make a POST request to the `crawler.production.judit.io/credentials` route and register the lawyers' credentials for the courts made available.

### Request Payload

The POST request must include a payload with the following properties:

* `system_name`: The acronym of the [court and system](/en/resource/glossary#credentials-vault-list) for which the new credential will be registered.
  * `Note:` A wildcard credential can be registered using `"system_name": "*"`. If a credential is registered under the wildcard, all courts without their own specific credential will use the wildcard credential.

* `customer_key`: Custom identifier to associate the credential with a client or lawyer. It can be any name or label defined by whoever is registering the credential, making it easier to organize and manage credentials.

* `username`: CPF (Cadastro de Pessoas Físicas — Brazilian individual taxpayer ID) or OAB number (Ordem dos Advogados do Brasil — Brazilian Bar Association), as required by the court's system where the login will be performed.

* `password`: Password registered at the respective court.

Properties required only for courts that enforce two-factor authentication:

* `custom_data`: Optional object intended to store additional information specific to the system or use-case context. It may include custom fields such as a secret required for authentication or other specific settings.

* `secret`: Two-factor authentication token for the system being registered.

`Note:` Registered credentials are encrypted, ensuring data security, and cannot be retrieved afterwards. To modify information already registered, simply create a new record using the same `customer_key` and the same `system_name`. The new registration will automatically replace the existing credential.

Example payload for registering credentials without two-factor authentication:

```json theme={null}

{
  "credentials": [
    {
      "system_name": "PJE TJBA - 1º grau",
      "customer_key": "00000001",
      "username": "999.999.999-99",
      "password": "Senha123"
    },
    {
      "system_name": "ESAJ - TJAC - 1º grau",
      "customer_key": "00000002",
      "username": "999.999.999-99",
      "password": "Senha123"
    }
  ]
}
```

Example payload for registering credentials with two-factor authentication:

```json theme={null}

{
  "credentials": [
    {
      "system_name": "PJE TJBA - 1º grau",
      "customer_key": "00000001",
      "username": "999.999.999-99",
      "password": "Senha123",
      "custom_data": {
				"secret": "<TOKEN>"
			}
    }
  ]
}
```

Example response to the request:

```json theme={null}

[
    {
        "system_name": "ESAJ - TJAC - 1º grau",
        "message": "CREDENTIAL_CREATED"
    },
    {
        "system_name": "PJE TJBA - 1º grau",
        "message": "CREDENTIAL_CREATED"
    }
]
```

## Endpoint to verify registered credentials

To check whether a credential is registered, send a GET request to the `crawler.production.judit.io/credentials` endpoint, including the `customer_key` parameter that corresponds to the credential you want to look up.

The response will return every credential available in the vault associated with the queried `customer_key`. The `credential_status` field indicates the status of each credential:

* active: Credential registered and active.
* not exists: Credential not found in the system.

Below is an example GET request to check whether a credential exists:

```bash theme={null}

curl --location 'https://crawler.production.judit.io/credentials?customer_key=teste_01' \
--header 'api-key: <API-KEY>'

```

Below is an example response for the GET request above:

```json theme={null}

{
    "systems": [
        {
            "name": "*",
            "customer_key": "",
            "credential_status": "not exists"
        },
        {
            "name": "ESAJ - TJAM - 1º grau",
            "customer_key": "teste_01",
            "credential_status": "active"
        },
        {
            "name": "PROJUDI TJGO - 1º grau",
            "customer_key": "teste_01",
            "credential_status": "active"
        }
    ]
}

```

## Endpoint to delete a key from the Credentials Vault

To delete a system from the credentials vault, you must make a DELETE request to the `crawler.production.judit.io/credentials` route.

### Request Payload

The DELETE request must include a payload with the following properties:

* `system_name`: The acronym of the [court and system](/en/resource/glossary#credentials-vault-list) whose credential will be removed.
* `customer_key`: Custom identifier added when the credential was registered.

Example payload to delete a credential:

```json theme={null}

{
	"system_name": "PROJUDI TJGO - 1º grau",
    "customer_key":"teste_01"
}

```

* If the request succeeds, the response will be an empty object.

Keeping credentials up to date at the courts is entirely the user's responsibility. It is therefore up to the user to register the credential at the corresponding court and to monitor its validity and status to ensure that it is not suspended or invalidated.
