# List the keys this deployment signs exports with

GET

/v1/export-signing-keys

```sh
curl --request GET \
  --url https://example.com/v1/export-signing-keys \
  --header 'Authorization: Bearer <token>'
```

The public keys of the deployment’s export signing key, active first: what a verifier pins. An export’s embedded `publicKey` only proves its bytes weren’t changed; this list says who signed them. Empty when the deployment doesn’t sign exports. Any authenticated caller may read it.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/v0.1.8/reference/api.md#bearerauth)**

## Responses

### 200

The keys.

application/json

object

**data**

required

Active first. Empty when the deployment doesn’t sign exports.

Array\<object>

A public key this deployment signs exports with.

object

**keyId**

required

Derived from the public key (`ex_` and 16 base64url characters), so the same key keeps its id.

string

**algorithm**

required

An Ed25519 key signs `ed25519`; an EC P-256 key (a KMS without Ed25519) signs `ecdsa-p256-sha256`.

string

Allowed values: ed25519 ecdsa-p256-sha256

**publicKeyPem**

required

PEM SPKI.

string

**fingerprint**

required

`sha256:` and the hex SHA-256 of the raw public key: to pin it, or compare by eye.

string

/^sha256:\[0-9a-f]{64}$/

**active**

required

Whether new exports are signed with it.

boolean

##### Example

```json
{
  "data": [
    {
      "algorithm": "ed25519"
    }
  ]
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [Export signed evidence](https://docs.kindgi.com/v0.1.8/guides/observability/export-signed-evidence.md)
- [Every error code](https://docs.kindgi.com/v0.1.8/reference/errors.md)