List active and revoked provider keys, with their purpose
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Query Parameters
Optional when the authenticated API key is already bound to an organization.
uuidResponse Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/execution/provider-keys"{ "service": "decionis", "keys": [ { "service": "decionis", "kid": "string", "issuer": "string", "algorithm": "EdDSA", "purpose": "effect_receipt", "label": "string", "created_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z" } ]}Public keys for signed policy bundles GET
The Ed25519 public keys, as a JWKS, that sign policy bundles for the edge evaluator. An edge evaluator release pins these keys at build time; during a signing-key rotation the previous key stays listed until the bundles signed with it have expired. The `kid` in a signed bundle's protected header names the key to use.
Register a public key for effect receipts, presence attestations, edge usage reports or signed signals POST
Registers only the public half of the Ed25519 key a system of record signs effect receipts with, or a presence provider signs presence attestations with, under the issuer it names in `iss`. `purpose` (default `effect_receipt`) says which: a key only ever verifies its own purpose, so an effect-receipt key never verifies an attestation and an attestation key never verifies a receipt. An edge installation registers its usage-report key with purpose `usage_report` and its installation id as `issuer`. A producer of signed signals (a card-presence provider's Tap to Authenticate, say) registers its key with purpose `signed_signal` and the producer id the signals name as `iss` as `issuer`; an admitted presence provider's JWKS keys sign its signals without registration. Private key material is rejected. Registering the same `kid` again replaces the key (and its purpose) and clears its revocation. Requires policy:write or org:* scope.