---
title: "Transparency-log public keys (JWKS)"
method: GET
path: "/api/v1/audit/public-key"
---

# Transparency-log public keys (JWKS)

`GET /api/v1/audit/public-key`

## Request

- Base URL: `https://app.axiorank.com`
- URL: `https://app.axiorank.com/api/v1/audit/public-key`
- Auth: none required

The Ed25519 public keys (active + retired) that sign audit receipts and signed tree heads. PUBLIC and unauthenticated by design: pin a key by `kid` out-of-band, then verify a receipt against it offline with the open-source `@axiorank/audit-verify` package. That independence from AxioRank is the whole point.

## Response `200`

A JWKS of the log signing keys.

- PublicKeyResponse: JWKS of the transparency-log signing keys (active + retired). Pin a key by kid.
  - `keys` object[], required
    - `kid` string, required
    - `kty` 'OKP', required
    - `crv` 'Ed25519', required
    - `x` string, required
    - `alg` 'EdDSA'
    - `use` 'sth' | 'provenance' | 'approver' | 'tool-log-sth'
    - `status` 'active' | 'retired'

---

[API](https://skmtc.dev/axiorank/apis/axiorank-gateway-api.md) · [All operations](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/revisions/d8a7a33656e4?raw)