---
title: "Public keys for execution grants and claim attestations"
method: GET
path: "/.well-known/decionis-execution-grant-jwks.json"
---

# Public keys for execution grants and claim attestations

`GET /.well-known/decionis-execution-grant-jwks.json`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/.well-known/decionis-execution-grant-jwks.json`
- Auth: none required

The Ed25519 public keys, as a JWKS, that sign execution grants and
claim attestations. A deploy target or a downstream system of record
verifies either offline against this set; during a signing-key
rotation the previous key stays listed until the grants signed with
it have drained. The `kid` in a token's protected header names the
key to use.

## Response `200`

The current verification keys

- ExecutionGrantJwks
  - `keys` object[], required
    - `kty` 'OKP', required
    - `crv` 'Ed25519', required
    - `x` string, required
    - `kid` string, required
    - `alg` 'EdDSA', required
    - `use` 'sig', required

## Other responses

- `404`: Execution-grant signing is not configured for this environment

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)