---
title: "Public JWKS of attestation signing keys"
method: GET
path: "/api/v1/attestations/keys"
tags: ["Governance"]
---

# Public JWKS of attestation signing keys

`GET /api/v1/attestations/keys`

## Request

- Base URL: `https://legal.nexusquantum.legal`
- URL: `https://legal.nexusquantum.legal/api/v1/attestations/keys`
- Auth: none required

Returns the JSON Web Key Set (RFC 7517) of the public Ed25519 attestation keys. **PUBLIC — no authentication required.** Anyone (including the client's own regulator) can fetch these keys to verify a signed attestation offline, with no Nexus account and no shared secret. The private key never leaves the server. Cached 5 minutes.

**Includes ALL historical public keys** (no 7-day expiry) so offline verification of old attestations works indefinitely.

## Response `200`

JWKS of ALL public keys — active plus every rotated-out historical key (no expiry), so old attestations remain verifiable indefinitely.

- JWKS: JSON Web Key Set of public attestation keys (RFC 7517). Public by design — any party can verify an attestation offline without a Nexus account or shared secret.
  - `keys` object[], required
    - `kty` string
    - `crv` string
    - `alg` string
    - `kid` string
    - `x` string: base64url-encoded public key.

---

[API](https://skmtc.dev/nexusquantum/apis/nexus-legal-api.md) · [All operations](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/revisions/4084d8d4eb0b?raw)