---
title: "Get a delegated signing key"
method: GET
path: "/auth/delegated-keys/{id}"
tags: ["Embedded Wallet Auth"]
---

# Get a delegated signing key

`GET /auth/delegated-keys/{id}`

## Request

- Base URL: `https://api.lightspark.com/grid/2025-10-13`
- URL: `https://api.lightspark.com/grid/2025-10-13/auth/delegated-keys/{id}`
- Auth: HTTP basic

Retrieve a delegated signing key by its system-generated id.

## Path parameters

- `id` string, required

## Response `200`

Successful operation

- DelegatedKey: A delegated signing key for either a card funding source or an agent, backed by an Embedded Wallet internal account. Card keys include `cardId` and `fundingSourceId`; agent keys include `agentId`. Returned from `POST /auth/delegated-keys` (on activation), `GET /auth/delegated-keys` (list), and `GET /auth/delegated-keys/{id}`. The keypair is generated and custodied by Grid; the private key is never returned. While `ACTIVE`, Grid may use the key to authorize Spark token-transaction signing for the selected card funding source or agent in place of a session keypair. `publicKey` is informational metadata identifying the credential.
  - `id` string, required: Grid-issued `DelegatedKey:<uuid>` identifier.
  - `cardId` string: The card this key is delegated for. Present only for card keys.
  - `fundingSourceId` string: The card funding source this key is delegated for. Present only for card keys.
  - `agentId` string: The agent this key is delegated for. Present only for agent keys.
  - `accountId` string, required: The Embedded Wallet internal account this key is delegated for, derived from the card funding source or the agent's customer.
  - `publicKey` string, required: Compressed P-256 public key (hex) of the delegated API keypair.
  - `nickname` string, required: Human-readable label for the delegated key.
  - `status` 'PENDING' | 'ACTIVE' | 'REVOKED', required: Status of a delegated signing key. - `PENDING`: The delegated user exists but the policy-creation leg never completed. The key cannot sign. - `ACTIVE`: The policy is granted and the key may stamp quote executions. - `REVOKED`: The delegated user has been deleted and the key can no longer sign.
  - `createdAt` string, date-time, required: When the delegated key was created.
  - `updatedAt` string, date-time, required: When the delegated key was last updated.

## Other responses

- `401`: Unauthorized
- `404`: Delegated key not found
- `500`: Internal service error

## Changes

> 115 revisions in range; 2 not diffed.

- **2026-10-02** `dfe5a02f2fee`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/lightsparkdev/apis/grid-api/changes/auth/delegated-keys/:id/get.md)

---

[API](https://skmtc.dev/lightsparkdev/apis/grid-api.md) - [All operations](https://skmtc.dev/lightsparkdev/apis/grid-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lightsparkdev/apis/grid-api/revisions/7a1db46ec552?raw)