Register a public key for effect receipts, presence attestations, edge usage reports or signed signals
Registers only the public half of the Ed25519 key a system of record
signs effect receipts with, or a presence provider signs presence
attestations with, under the issuer it names in iss. purpose
(default effect_receipt) says which: a key only ever verifies its
own purpose, so an effect-receipt key never verifies an attestation
and an attestation key never verifies a receipt. An edge
installation registers its usage-report key with purpose
usage_report and its installation id as issuer. A producer of
signed signals (a card-presence provider's Tap to Authenticate, say)
registers its key with purpose signed_signal and the producer id
the signals name as iss as issuer; an admitted presence
provider's JWKS keys sign its signals without registration.
Private key material is rejected. Registering the same kid again
replaces the key (and its purpose) and clears its revocation.
Requires policy:write or org:* scope.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Request Body
application/json
Optional when the authenticated API key is already bound to an organization.
uuidThe kid the provider puts in its receipts' protected header.
1 <= length <= 200The iss the provider puts in its receipts or attestations; one under this key with another issuer does not verify.
1 <= length <= 500The public half of an Ed25519 key. A d member is rejected.
length <= 200What the key verifies. A key is only ever used for its own purpose. usage_report: an edge installation's monthly usage reports (POST /v1/edge/usage-reports); register it with the installation id as issuer, which the reports name as iss. signed_signal: a producer's signed standing signals (evidence.signals on enforce-and-bind); register it with the producer id as issuer, which the signals name as iss.
"effect_receipt"Value in
- "effect_receipt"
- "presence_attestation"
- "usage_report"
- "signed_signal"
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/execution/provider-keys" \ -H "Content-Type: application/json" \ -d '{ "kid": "string", "issuer": "string", "algorithm": "EdDSA", "public_jwk": { "kty": "OKP", "crv": "Ed25519", "x": "string" } }'{ "service": "decionis", "kid": "string", "issuer": "string", "algorithm": "EdDSA", "purpose": "effect_receipt", "label": "string", "created_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z"}List active and revoked provider keys, with their purpose GET
Previous Page
Revoke, but retain, a provider key DELETE
A revoked key verifies no further receipts or attestations, and a grant admitted by an attestation under it can no longer be claimed. Its metadata remains, so what was recorded against it stays explicable.