### Question:
KeysApiController implements KeysApi { @Override @PreAuthorize("hasAuthority('DELETE_AUTH_CERT') or hasAuthority('DELETE_SIGN_CERT')") @AuditEventMethod(event = DELETE_CSR) public ResponseEntity<Void> deleteCsr(String keyId, String csrId) { try { tokenCertificateService.deleteCsr(csrId); } catch (KeyNotFoundException | CsrNotFoundException e) { throw new ResourceNotFoundException(e); } catch (ActionNotPossibleException e) { throw new ConflictException(e); } return new ResponseEntity<>(HttpStatus.NO_CONTENT); } @Autowired  KeysApiController(KeyService keyService,
            KeyConverter keyConverter,
            ClientConverter clientConverter,
            TokenCertificateService tokenCertificateService,
            ServerConfService serverConfService,
            CsrFilenameCreator csrFilenameCreator,
            PossibleActionConverter possibleActionConverter); @Override @PreAuthorize("hasAuthority('VIEW_KEYS')") ResponseEntity<Key> getKey(String keyId); @Override @PreAuthorize("hasAuthority('EDIT_KEY_FRIENDLY_NAME')") @AuditEventMethod(event = UPDATE_KEY_NAME) ResponseEntity<Key> updateKey(String id, KeyName keyName); @SuppressWarnings("squid:S3655") // see reason below @Override @PreAuthorize("(hasAuthority('GENERATE_AUTH_CERT_REQ') and " + "#csrGenerate.keyUsageType == T(org.niis.xroad.restapi.openapi.model.KeyUsageType).AUTHENTICATION)" + " or (hasAuthority('GENERATE_SIGN_CERT_REQ') and " + "#csrGenerate.keyUsageType == T(org.niis.xroad.restapi.openapi.model.KeyUsageType).SIGNING)") @AuditEventMethod(event = GENERATE_CSR) ResponseEntity<Resource> generateCsr(String keyId, CsrGenerate csrGenerate); @Override @PreAuthorize("hasAuthority('DELETE_AUTH_CERT') or hasAuthority('DELETE_SIGN_CERT')") @AuditEventMethod(event = DELETE_CSR) ResponseEntity<Void> deleteCsr(String keyId, String csrId); @Override @PreAuthorize("hasAuthority('VIEW_KEYS')") ResponseEntity<List<PossibleAction>> getPossibleActionsForCsr(String id, String csrId); @Override @PreAuthorize("hasAuthority('VIEW_KEYS')") ResponseEntity<List<PossibleAction>> getPossibleActionsForKey(String keyId); @Override @PreAuthorize("hasAnyAuthority('DELETE_KEY', 'DELETE_AUTH_KEY', 'DELETE_SIGN_KEY')") @AuditEventMethod(event = DELETE_KEY) ResponseEntity<Void> deleteKey(String keyId, Boolean ignoreWarnings); @Override @PreAuthorize("hasAnyAuthority('GENERATE_AUTH_CERT_REQ', 'GENERATE_SIGN_CERT_REQ')") ResponseEntity<Resource> downloadCsr(String keyId, String csrId, CsrFormat csrFormat);  }### Answer:
@Test @WithMockUser(authorities = { "DELETE_AUTH_CERT" }) public void deleteCsr() { try { keysApiController.deleteCsr(GOOD_SIGN_KEY_ID, KEY_NOT_FOUND_CSR_ID); fail("should have thrown exception"); } catch (ResourceNotFoundException expected) { } ResponseEntity<Void> response = keysApiController.deleteCsr(GOOD_SIGN_KEY_ID, GOOD_CSR_ID); assertEquals(HttpStatus.NO_CONTENT, response.getStatusCode()); }