---
title: "Public JWKS for AAP attestation tokens."
method: GET
path: "/.well-known/jwks.json"
tags: ["Attestation"]
---

# Public JWKS for AAP attestation tokens.

`GET /.well-known/jwks.json`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/.well-known/jwks.json`
- Auth: none required

Returns the set of public keys verifying Mnemom-signed AAP attestation tokens. The active key signs new attestations; retired keys remain in the set for the token-TTL window plus grace. Unauthenticated; cacheable for 5 minutes. cards-as-primitive Phase 5 A1.

## Response `200`

Current key set.

- object
  - `keys` object[], required
    - `kty` 'OKP', required
    - `crv` 'Ed25519', required
    - `x` string, required: base64url-encoded 32-byte Ed25519 public point.
    - `kid` string, required: Key identifier; matches the `kid` claim in tokens this key signs.
    - `alg` 'EdDSA', required
    - `use` 'sig', required
    - `mnemom_ext` object: Mnemom-specific JWK extension carrying rotation state. Standard JOSE verifiers ignore unknown fields; clients that want to surface rotation in the UI read this block.
      - `status` 'active' | 'retired'
      - `activated_at` string, date-time
      - `retired_at` string, date-time
      - `rotation_reason` string

## Other responses

- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.
- `503`: An upstream dependency is currently unavailable. The request was not processed; retry after the cooldown window.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)