GEgetaxonflow
Audit Verification

Publish the current public signing key

Returns the current public Ed25519 verification key so an external auditor can re-verify any record's signature offline. Read-only.

When no signing key is configured, configured is false and public_key is empty: records are hash-chained but unsigned, and the verify endpoints report that honestly.

Authority (#2914). Authentication alone is not enough: this route requires COMPLIANCE READ AUTHORITY over the organization. Present a validated per-user token (X-User-Token, or Authorization: Bearer) whose role is admin, owner or policy_admin, or call from an internal service asserting X-Axonflow-Admin-Authority: true. A Community-mode deployment is exempt: it has no authentication and resolves every caller to one local operator. Anything else is 403.

Community SaaS (try.getaxonflow.com) refuses these routes, by design. The hosted evaluation stack runs with authentication enabled, so the Community-mode exemption above does not apply to it, and its evaluator accounts hold no entitled role. Verification there is a 403. Granting evaluators access would widen, on a public shared stack, the exact exposure this change closes. Verify audit records on a deployment you operate.

get/api/v1/audit/signing-key

Request

Headers

Authorizationstring required
Example:Basic bXktb3JnOkFYT04tVjIteHh4

OAuth2-style Basic authentication header. Format: Basic base64(clientId:clientSecret)

  • clientId: Your organization identifier (required)
  • clientSecret: Authentication credential (optional for community mode)

Not required when DEPLOYMENT_MODE=community.

Response

Current public signing key (or that none is configured)

algorithmstring required
signing_key_idstring

Identifier of the current signing key (empty when none configured).

public_keystring

Base64 Ed25519 public key (empty when none configured).

configuredboolean required

False when no signing key is configured (records are hash-chained but unsigned).

verification_notestring

How to verify a record offline with this key.

Example response

{
  "algorithm": "ed25519"
}

Changes

No recorded changes to this operation across all 1 revision of this API.