---
title: "Register a public key for effect receipts, presence attestations, edge usage reports or signed signals"
method: POST
path: "/v1/execution/provider-keys"
---

# Register a public key for effect receipts, presence attestations, edge usage reports or signed signals

`POST /v1/execution/provider-keys`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/execution/provider-keys`
- Auth: HTTP bearer

Registers only the public half of the Ed25519 key a system of record
signs effect receipts with, or a presence provider signs presence
attestations with, under the issuer it names in `iss`. `purpose`
(default `effect_receipt`) says which: a key only ever verifies its
own purpose, so an effect-receipt key never verifies an attestation
and an attestation key never verifies a receipt. An edge
installation registers its usage-report key with purpose
`usage_report` and its installation id as `issuer`. A producer of
signed signals (a card-presence provider's Tap to Authenticate, say)
registers its key with purpose `signed_signal` and the producer id
the signals name as `iss` as `issuer`; an admitted presence
provider's JWKS keys sign its signals without registration.
Private key material is rejected. Registering the same `kid` again
replaces the key (and its purpose) and clears its revocation.
Requires policy:write or org:* scope.

## Request body

- ExecutionProviderKeyRegistrationRequest
  - `org_id` string, uuid: Optional when the authenticated API key is already bound to an organization.
  - `kid` string, required: The `kid` the provider puts in its receipts' protected header.
  - `issuer` string, required: The `iss` the provider puts in its receipts or attestations; one under this key with another issuer does not verify.
  - `algorithm` 'EdDSA', required
  - `public_jwk` ExecutionProviderPublicOkpJwk, required: The public half of an Ed25519 key. A `d` member is rejected.
    - `kty` 'OKP', required
    - `crv` 'Ed25519', required
    - `x` string, required
    - `kid` string
    - `alg` 'EdDSA'
    - `use` 'sig'
  - `label` string
  - `purpose` 'effect_receipt' | 'presence_attestation' | 'usage_report' | 'signed_signal': What the key verifies. A key is only ever used for its own purpose. `usage_report`: an edge installation's monthly usage reports (`POST /v1/edge/usage-reports`); register it with the installation id as `issuer`, which the reports name as `iss`. `signed_signal`: a producer's signed standing signals (`evidence.signals` on enforce-and-bind); register it with the producer id as `issuer`, which the signals name as `iss`.

## Response `201`

Public verification key registered

- ExecutionProviderKey
  - `service` 'decionis', required
  - `kid` string, required
  - `issuer` string, required
  - `algorithm` 'EdDSA', required
  - `purpose` 'effect_receipt' | 'presence_attestation' | 'usage_report' | 'signed_signal', required: What the key verifies. A key is only ever used for its own purpose. `usage_report`: an edge installation's monthly usage reports (`POST /v1/edge/usage-reports`); register it with the installation id as `issuer`, which the reports name as `iss`. `signed_signal`: a producer's signed standing signals (`evidence.signals` on enforce-and-bind); register it with the producer id as `issuer`, which the signals name as `iss`.
  - `label` string, nullable, required
  - `created_at` string, date-time, required
  - `revoked_at` string, date-time, nullable, required

## Other responses

- `400`: Structured API error
- `401`: Structured API error
- `403`: Structured API error
- `503`: Structured API error

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)