Register a public key for effect receipts, presence attestations, edge usage reports or signed signals

Registers only the public half of the Ed25519 key a system of record signs effect receipts with, or a presence provider signs presence attestations with, under the issuer it names in iss. purpose (default effect_receipt) says which: a key only ever verifies its own purpose, so an effect-receipt key never verifies an attestation and an attestation key never verifies a receipt. An edge installation registers its usage-report key with purpose usage_report and its installation id as issuer. A producer of signed signals (a card-presence provider's Tap to Authenticate, say) registers its key with purpose signed_signal and the producer id the signals name as iss as issuer; an admitted presence provider's JWKS keys sign its signals without registration. Private key material is rejected. Registering the same kid again replaces the key (and its purpose) and clears its revocation. Requires policy:write or org:* scope.

post/v1/execution/provider-keys

Request

  • Base URL: https://api.decionis.com
  • URL: https://api.decionis.com/v1/execution/provider-keys
  • Auth: HTTP bearer

Request body

org_idstring uuid

Optional when the authenticated API key is already bound to an organization.

kidstring required

The kid the provider puts in its receipts' protected header.

issuerstring required

The iss the provider puts in its receipts or attestations; one under this key with another issuer does not verify.

algorithm'EdDSA' required
labelstring
purpose'effect_receipt' | 'presence_attestation' | 'usage_report' | 'signed_signal'

What the key verifies. A key is only ever used for its own purpose. usage_report: an edge installation's monthly usage reports (POST /v1/edge/usage-reports); register it with the installation id as issuer, which the reports name as iss. signed_signal: a producer's signed standing signals (evidence.signals on enforce-and-bind); register it with the producer id as issuer, which the signals name as iss.

Response

Public verification key registered

service'decionis' required
kidstring required
issuerstring required
algorithm'EdDSA' required
purpose'effect_receipt' | 'presence_attestation' | 'usage_report' | 'signed_signal' required

What the key verifies. A key is only ever used for its own purpose. usage_report: an edge installation's monthly usage reports (POST /v1/edge/usage-reports); register it with the installation id as issuer, which the reports name as iss. signed_signal: a producer's signed standing signals (evidence.signals on enforce-and-bind); register it with the producer id as issuer, which the signals name as iss.

labelstring nullable required
created_atstring date-time required
revoked_atstring date-time nullable required

Changes

No recorded changes to this operation across all 1 revision of this API.