Skip to main content
GET
cURL

Authorizations

Authorization
string
header
required

Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.

Path Parameters

keyId
string
required

The keyId named in the signature you want to verify, for example default.

Response

The public key.

keyId
string
required
algorithm
string
required

The key's actual algorithm, derived from the key material itself (asymmetricKeyType), not a global config value.

use
enum<string>
required
Available options:
sig
pem
string
required

PEM-encoded SPKI public key (RFC 7468).

jwk
object

Node's native JWK export for this key's algorithm, when available. Ed25519 exports as kty "OKP"; ML-DSA-65 exports as kty "AKP" (the IETF JOSE/COSE key type for ML-DSA, not an identifier this codebase invented). Omitted, not null, when unavailable.