---
title: "Confirm a recovery kit for the key's current share generation"
method: POST
path: "/v1/keys/{key_id}/kit"
tags: ["Key Custody"]
---

# Confirm a recovery kit for the key's current share generation

`POST /v1/keys/{key_id}/kit`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/keys/{key_id}/kit`
- Auth: HTTP bearer

The owner attests they hold the offline recovery kit for this 2-of-3 key at
its current share generation (after a refresh, or re-checking a kit they
have). The kit and the recovery code never reach 1Claw. The vault checks
the public key and generation it is bound to, and `kit_proof`: a proof,
made in the browser from the opened kit, that the kit holds share 3 of the
key's current generation (a kit from before a refresh is refused, since the
group key alone cannot tell old shares from new). Audited `kit.downloaded`.

## Path parameters

- `key_id` string, uuid, required

## Request body

- object
  - `generation` integer, required
  - `group_public_key` string, required: Hex, from the kit entry.
  - `kit_proof` string, required: Base64 Schnorr proof of possession of the kit's share 3 for `generation` (`@1claw/tss-wasm` `kit_share_proof`). For a `client_multisig` wallet: hex 65-byte signature by the kit's recovery key over sha256("1claw-multisig-kit-v1" ‖ device address ‖ generation as i32 big-endian) (`multisig_kit_proof`), and `group_public_key` is the device public key. For a 2-of-3 Safe (`key_id` = the Safe's id) the device address is the device owner's lowercase 0x EVM address. Missing, malformed or not matching: 400.

## Response `200`

The key's backup state after confirming

## Other responses

- `400`: Invalid request
- `404`: Resource not found
- `409`: Resource already exists or conflict

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)