> Markdown version of https://docs.laavat.io/gui/pki/change-requests/ from the LAAVAT PKI and Signing Platform documentation. All pages: https://docs.laavat.io/llms.txt

# PKI Change Requests

PKI Change Requests provide a controlled way to add and modify CA product operations, and to modify, delete, or change the state of certificate profiles. All changes require approval before they take effect.

## Why Change Requests?

Certificate profiles may be shared across multiple products. Direct modifications could have unintended side effects. The change request workflow ensures:

- Changes are reviewed before being applied
- An audit trail of all modifications
- Protection against accidental changes

## Change Types

### Add Operation

Adds a new operation to an existing CA product. The operation creates the key material it needs. When creating an add-operation request:

1. Select the target CA product
2. Enter a name and description for the new operation
3. Select the **profile** the operation issues certificates against
4. Define the approval rule (allowed groups, approval groups, blanket groups)
5. Submit for approval

> **Note: Only IssueCertificate can be added**
> `IssueCertificate` is the only operation type that can be added through a PKI change request, so the operation type is not shown as a choice in the GUI. A **profile is mandatory**. Unlike product operations, PKI operations do not carry a token.

### Modify Operation

Modifies an existing operation on a CA product. When creating a modify-operation request:

1. Select the target CA product
2. Select the operation to modify
3. Update the name, description, profile, and approval rule
4. Submit for approval

> **Note: Operation type and token are fixed**
> The operation type and token of an existing operation cannot be changed. They are carried over unchanged and are therefore not shown in the GUI.

### Modify Profile

Allows modifying the fields of an existing profile. When creating a modify request:

1. Select the target profile from the list
2. The current profile fields are loaded for editing
3. Modify the desired fields (DN, algorithms, validity, key usage, etc.)
4. Submit for approval

> **Note**
> Only profiles in **Ready** state are available for modification. Profiles in other states are filtered out.

### Set Profile to Be Deleted

Marks a profile for deletion. This changes the profile state to **ToBeDeleted**.

- Only profiles in **Ready** state that are **not used by any product** are shown
- The profile is not immediately deleted; it is marked for deletion
- A separate delete action can permanently remove profiles in ToBeDeleted state

> **Warning**
> Deleting a profile is irreversible. Ensure the profile is no longer needed before proceeding.

### Set Profile to Ready

Restores a profile to **Ready** state from **ToBeDeleted** state.

- Only profiles currently in **ToBeDeleted** state are shown
- This effectively cancels a pending deletion

## Approval Flow

1. **Create** - User creates a change request and submits it for approval
2. **Review** - An approver reviews the requested changes
3. **Approve/Reject** - The approver can approve or reject the request
4. **Applied** - Approved changes are automatically applied to the profile

## Fields

| Field | Description |
|-------|-------------|
| Name | A descriptive name for the change request |
| Description | Optional details about why the change is needed |
| Change Type | The type of change (Add Operation, Modify Operation, Modify Profile, Set Profile To Be Deleted, Set Profile To Ready) |
| Profile | The target profile to be changed (profile change types) |
| CA Product | The target CA product (Add Operation and Modify Operation) |
| Operation | The target operation (Modify Operation only) |

For the full PKI documentation, see the [Certificate Management Guide](https://docs.laavat.io/usage/productguide/pki/).