---
title: "Publish the current public signing key"
method: GET
path: "/api/v1/audit/signing-key"
tags: ["Audit Verification"]
---

# Publish the current public signing key

`GET /api/v1/audit/signing-key`

## Request

- Base URL: `https://agent.getaxonflow.com`
- URL: `https://agent.getaxonflow.com/api/v1/audit/signing-key`
- Auth: none declared. Required headers: `Authorization`
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/docs/api/v1/audit/signing-key/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the current public Ed25519 verification key so an external
auditor can re-verify any record's signature offline. Read-only.

When no signing key is configured, `configured` is `false` and
`public_key` is empty: records are hash-chained but unsigned, and the
verify endpoints report that honestly.

**Authority (#2914).** Authentication alone is not enough: this route
requires COMPLIANCE READ AUTHORITY over the organization. Present a
validated per-user token (`X-User-Token`, or `Authorization: Bearer`)
whose role is `admin`, `owner` or `policy_admin`, or call from an
internal service asserting `X-Axonflow-Admin-Authority: true`. A
Community-mode deployment is exempt: it has no authentication and
resolves every caller to one local operator. Anything else is `403`.

**Community SaaS (`try.getaxonflow.com`) refuses these routes, by
design.** The hosted evaluation stack runs with authentication enabled,
so the Community-mode exemption above does not apply to it, and its
evaluator accounts hold no entitled role. Verification there is a `403`.
Granting evaluators access would widen, on a public shared stack, the
exact exposure this change closes. Verify audit records on a deployment
you operate.

## Headers

- `Authorization` string, required

## Response `200`

Current public signing key (or that none is configured)

- AuditSigningKeyResponse: The current public Ed25519 verification key (or that none is configured).
  - `algorithm` string, required
  - `signing_key_id` string: Identifier of the current signing key (empty when none configured).
  - `public_key` string: Base64 Ed25519 public key (empty when none configured).
  - `configured` boolean, required: False when no signing key is configured (records are hash-chained but unsigned).
  - `verification_note` string: How to verify a record offline with this key.

## Other responses

- `401`: Missing authenticated org context
- `403`: Authenticated, but without compliance read authority over this organization (#2914). See the authority note in the description.

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/revisions/34d30fcb7fa1?raw)