can not download trustlist with test api-token

[EvergreenHZ]

hi, I received a temporary api-token from Covid-Zertifikat@bag.admin.ch for test, and I can download revocationList, activeKIDS and verificationRules successfully, but I can not download the trustlist from https://www.cc-d.bit.admin.ch/trust/v2/keys/updates.
is there something wrong with the url or my temporary api-token? thx.

[goebelUB]

Looking at our code it looks like you need a ?certFormat=ANDROID suffix to your URL.
You may also want to have a look at how the SDK fetches the signing keys (i.e. pagination over all available keys, plus a list of ids of all keys that are "active"). It can be somewhat confusing :)

If that doesn't help, please provide more detailed steps that lead to your error, and the exact error message.

Also, if I recall correctly, the debug (!= release) builds of the Android apps have certificate pinning disabled, and the DEV flavour is configured to trust user-imported CAs. That means you can MITM your own network traffic to see what requests the official app is sending, and compare it with the requests that your app is sending.
To build: ./gradlew verifier:assembleDevDebug (or select the devDebug "Build Variant" in Android Studio).