---
title: "Public keys for signed policy bundles"
method: GET
path: "/.well-known/decionis-policy-bundle-jwks.json"
---

# Public keys for signed policy bundles

`GET /.well-known/decionis-policy-bundle-jwks.json`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/.well-known/decionis-policy-bundle-jwks.json`
- Auth: none required

The Ed25519 public keys, as a JWKS, that sign policy bundles for the
edge evaluator. An edge evaluator release pins these keys at build
time; during a signing-key rotation the previous key stays listed until
the bundles signed with it have expired. The `kid` in a signed bundle's
protected header names the key to use.

## Response `200`

The current verification keys

- PolicyBundleJwks
  - `keys` object[], required
    - `kty` 'OKP', required
    - `crv` 'Ed25519', required
    - `x` string, required
    - `kid` string, required
    - `alg` 'EdDSA', required
    - `use` 'sig', required

## Other responses

- `404`: Policy bundle signing is not configured for this environment

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)