Non-secret signing-key and sealer custody inventory

GET

/v1/console/keys

curl --request GET \
  --url https://example.com/v1/console/keys \
  --header 'Authorization: Bearer <token>'

• this engine

Returns the non-secret custody inventory of the signing keys and sealers resolved at boot. No key material is returned.

Authorizations

• bearerAuth

Responses

200

OK

Media type application/json

object

keys

required

Array<object>

object

algorithm

string

created

RFC3339 creation timestamp; empty when unknown

string

custody_mode

string

Allowed values: minted byok-env byok-file cmek

fingerprint

Full SHA-256 hex for runtime signing keys; embedded license-key display fingerprint for license

string

kek

Non-secret KEK provider and key identifier

string

origin

Embedded license-key origin

string

present

boolean

prior_count

integer

public_key

Base64-encoded public verification key

string

purpose

required

string

Allowed values: audit catalog policy license eventing sso secret-store

source

string

Allowed values: env file

Example

{
  "keys": [
    {
      "custody_mode": "minted",
      "purpose": "audit",
      "source": "env"
    }
  ]
}

400

Bad request

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

401

Unauthenticated

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Forbidden

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

404

Not found

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

409

Conflict / setup required

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

429

Rate limited

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}