---
title: "Use private_key_jwt with these public keys (ES256 or RS256, up to 5). Every client secret stops working."
method: PUT
path: "/v1/organizations/current/service-accounts/{id}/jwks"
tags: ["organizations"]
---

# Use private_key_jwt with these public keys (ES256 or RS256, up to 5). Every client secret stops working.

`PUT /v1/organizations/current/service-accounts/{id}/jwks`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/organizations/current/service-accounts/{id}/jwks`
- Auth: HTTP bearer

Organization admins only (403 `organization_admin_required`), on a browser session with a fresh proof in the `x-50h-reauth` header (401 `reauth_required`). It needs a person: API keys, connected apps and service accounts get 403 `session_required`. Every change is written to the organization's audit. The assertion's iss and sub are the client id, its aud the token endpoint or the issuer, at most five minutes old, each jti once. Behind the `machineIdentities` sub-flag: 404 `not_found` while it is off. A service account gets tokens from https://auth.50heads.com/token with `grant_type=client_credentials` and its client id and secret (HTTP Basic or the body) or a private_key_jwt assertion; no refresh token, ask again when it expires.

## Path parameters

- `id` string, required

## Request body

- OrganizationServiceAccountJwksRequest
  - `jwks` object, required
    - `keys` object[], required
      - `kty` 'EC' | 'RSA', required
      - `kid` string
      - `alg` 'ES256' | 'RS256'
      - `use` 'sig'
      - `crv` string
      - `x` string
      - `y` string
      - `n` string
      - `e` string

## Response `200`

OK

- OrganizationServiceAccountJwksResponse
  - `serviceAccount` object, required
    - `id` string, required
    - `name` string, required
    - `organizationId` string, required
    - `workspaceId` string, required
    - `workspaceName` string, required
    - `status` 'active' | 'disabled', required
    - `scopes` string[], required
    - `capDailyPence` integer, required
    - `capPerQuestionPence` integer, nullable, required
    - `spentTodayPence` integer, required
    - `clientId` string, required
    - `authMethod` 'client_secret' | 'private_key_jwt', required
    - `secrets` object[], required
      - `id` string, required
      - `hint` string, required
      - `createdAt` string, required
      - `expiresAt` string, nullable, required
      - `lastUsedAt` string, nullable, required
    - `jwks` object, nullable, required
      - `keys` object[], required
        - `kty` 'EC' | 'RSA', required
        - `kid` string
        - `alg` 'ES256' | 'RS256'
        - `use` 'sig'
        - `crv` string
        - `x` string
        - `y` string
        - `n` string
        - `e` string
    - `createdAt` string, required
    - `createdBy` object, nullable, required
      - `id` string, required
      - `name` string, nullable, required
    - `lastUsedAt` string, nullable, required
    - `disabledAt` string, nullable, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `404`: No such question, endpoint or delivery on this account.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/ae7392701fe6?raw)