---
title: "List signature verification keys"
method: GET
path: "/audit/.well-known/jwks.json"
tags: ["audit"]
---

# List signature verification keys

`GET /audit/.well-known/jwks.json`

## Request

- Base URL: `https://openapi.indykite.com` (the document declares no server; this is the origin it was published from)
- URL: `https://openapi.indykite.com/audit/.well-known/jwks.json`
- Auth: none declared
- TypeScript: <https://skmtc.dev/indykite/apis/indykite-audit-api/docs/audit/.well-known/jwks.json/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the JWKS used to verify a project's batch, manifest and checkpoint signatures:
every key that ever signed for the project, current and retired, by kid. Public - no
auth required. The keys carry no "alg": signatures are ECDSA P-256/SHA-256 with the
ASN.1 DER encoding (see the batch/manifest response's alg field), not the raw R||S
encoding a JOSE "ES256" verifier expects. A project with no signed data yet has no keys.
The first key of a project, or a key added by a rotation, can take up to 2 minutes to
be listed here.

## Query parameters

- `project_id` string, required

## Response `200`

OK

- object

## Other responses

- `400`: Bad Request
- `500`: Internal Server Error
- `503`: Too many keys loaded at once; retry after the Retry-After header

---

[API](https://skmtc.dev/indykite/apis/indykite-audit-api.md) - [All operations](https://skmtc.dev/indykite/apis/indykite-audit-api/llms.txt) - [OpenAPI document](https://skmtc.dev/indykite/apis/indykite-audit-api/revisions/f920d863976d?raw)