Skip to content
Kindgi

List the keys this deployment signs exports with

GET
/v1/export-signing-keys
curl --request GET \
  --url https://example.com/v1/export-signing-keys \
  --header 'Authorization: Bearer <token>'

The public keys of the deployment’s export signing key, active first: what a verifier pins. An export’s embedded publicKey only proves its bytes weren’t changed; this list says who signed them. Empty when the deployment doesn’t sign exports. Any authenticated caller may read it.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

The keys.

Media typeapplication/json
object
data
required

Active first. Empty when the deployment doesn’t sign exports.

Array<object>

A public key this deployment signs exports with.

object
keyId
required

Derived from the public key (ex_ and 16 base64url characters), so the same key keeps its id.

string
algorithm
required

An Ed25519 key signs ed25519; an EC P-256 key (a KMS without Ed25519) signs ecdsa-p256-sha256.

string
Allowed values: ed25519 ecdsa-p256-sha256
publicKeyPem
required

PEM SPKI.

string
fingerprint
required

sha256: and the hex SHA-256 of the raw public key: to pin it, or compare by eye.

string
/^sha256:[0-9a-f]{64}$/
active
required

Whether new exports are signed with it.

boolean
Example
{
  "data": [
    {
      "algorithm": "ed25519"
    }
  ]
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}