---
title: "Get trusted workspace key details"
method: POST
path: "/api/workspaces/{workspaceId}/enterprise/keys/trusted-details"
tags: ["workspaces"]
---

# Get trusted workspace key details

`POST /api/workspaces/{workspaceId}/enterprise/keys/trusted-details`

## Request

- Base URL: `https://rstream.io`
- URL: `https://rstream.io/api/workspaces/{workspaceId}/enterprise/keys/trusted-details`
- Auth: HTTP bearer

## Path parameters

- `workspaceId` string, required

## Request body

- TrustedWorkspaceKeyDetailsParams
  - `deviceKeyId` string, required
  - `challenge` string, required
  - `signedAt` string, date-time, required
  - `signature` string, required

## Response `200`

Successful response.

- WorkspaceKeyDetails
  - `enterprise` object, nullable, required
    - `workspaceId` string, required
    - `status` 'active' | 'suspended' | 'disabled', required
    - `billingMode` 'contract' | 'workspace_subscription' | 'manual', required
    - `projectCreationMode` 'enterprise_projects', required
    - `workspaceKeyMode` 'disabled' | 'optional' | 'required', required
    - `settings` object, nullable
      - `contractId` string
      - `notes` string
      - `supportTier` string
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `disabledAt` string, date-time, nullable, required
  - `dedicatedClusters` object[], required
    - `id` string, required
    - `name` string, required
    - `provider` 'aws' | 'gcp' | 'azure' | 'onpremise' | 'other', required
    - `region` string, required
    - `status` 'active' | 'maintenance' | 'disabled', required
    - `domain` string, required
    - `enginePort` integer, required
    - `turnPort` integer, required
    - `turnsPort` integer, required
  - `keys` object, required
    - `enabled` boolean, required
    - `mode` 'disabled' | 'optional' | 'required', required
    - `protectionState` 'disabled' | 'not_setup' | 'active' | 'recovery_required' | 'degraded', required
    - `activeKeyset` object, nullable, required
      - `id` string, required
      - `status` 'pending' | 'active' | 'rotating' | 'retired' | 'revoked', required
      - `keyEpoch` integer, required
      - `fingerprint` string, required
      - `cryptoSuite` string, required
      - `publicEncryptionKey` string, required
      - `publicSigningKey` string, nullable, required
      - `activatedAt` string, date-time, nullable, required
    - `deviceCount` integer, required
    - `pendingDeviceCount` integer, required
    - `recoveryKitCount` integer, required
  - `devices` object[], required
    - `id` string, required
    - `userId` string, required
    - `kind` 'browser' | 'cli' | 'agent' | 'service', required
    - `status` 'pending' | 'active' | 'revoked' | 'lost', required
    - `label` string, nullable, required
    - `browserId` string, nullable, required
    - `publicEncryptionKey` string, required
    - `publicSigningKey` string, nullable, required
    - `webttyPublicKey` string, nullable, required
    - `webttyKeyId` string, nullable, required
    - `webttyKeyAlgorithm` 'webtty-x25519-hpke-v1' | 'webtty-p256-hkdf-sha256-aes-256-gcm-random-nonce-v1', nullable, required
    - `fingerprint` string, required
    - `approvedAt` string, date-time, nullable, required
    - `revokedAt` string, date-time, nullable, required
    - `lostAt` string, date-time, nullable, required
    - `lastUsedAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
  - `recoveryKits` object[], required
    - `id` string, required
    - `status` 'active' | 'revoked' | 'used', required
    - `label` string, nullable, required
    - `fingerprint` string, required
    - `checksum` string, required
    - `createdAt` string, date-time, required
    - `revokedAt` string, date-time, nullable, required
    - `usedAt` string, date-time, nullable, required
  - `deviceEnvelopes` object[], required
    - `id` string, required
    - `keysetId` string, required
    - `recipientKind` 'device' | 'recovery_kit', required
    - `recipientId` string, required
    - `ciphertext` string, required
    - `crypto` object, required
      - `suite` 'p256-hkdf-sha256-aes-256-gcm', required
      - `keyId` string
      - `encapsulatedKey` string
      - `context` Schema0 (unresolved $ref)
    - `createdAt` string, date-time, required
    - `revokedAt` string, date-time, nullable, required
  - `recoveryEnvelopes` object[], required
    - `id` string, required
    - `keysetId` string, required
    - `recipientKind` 'device' | 'recovery_kit', required
    - `recipientId` string, required
    - `ciphertext` string, required
    - `crypto` object, required
      - `suite` 'p256-hkdf-sha256-aes-256-gcm', required
      - `keyId` string
      - `encapsulatedKey` string
      - `context` Schema0 (unresolved $ref)
    - `createdAt` string, date-time, required
    - `revokedAt` string, date-time, nullable, required
  - `protectedAccessUsers` object[], required
    - `userId` string, required
    - `name` string, nullable, required
    - `email` string, email, nullable, required
    - `role` 'owner' | 'admin' | 'member' | 'viewer', required
    - `devices` object[], required
      - `id` string, required
      - `userId` string, required
      - `kind` 'browser' | 'cli' | 'agent' | 'service', required
      - `status` 'pending' | 'active' | 'revoked' | 'lost', required
      - `label` string, nullable, required
      - `browserId` string, nullable, required
      - `publicEncryptionKey` string, required
      - `publicSigningKey` string, nullable, required
      - `webttyPublicKey` string, nullable, required
      - `webttyKeyId` string, nullable, required
      - `webttyKeyAlgorithm` 'webtty-x25519-hpke-v1' | 'webtty-p256-hkdf-sha256-aes-256-gcm-random-nonce-v1', nullable, required
      - `fingerprint` string, required
      - `approvedAt` string, date-time, nullable, required
      - `revokedAt` string, date-time, nullable, required
      - `lostAt` string, date-time, nullable, required
      - `lastUsedAt` string, date-time, nullable, required
      - `createdAt` string, date-time, required
    - `activeDeviceCount` integer, required
    - `pendingDeviceCount` integer, required
    - `lastTrustedAt` string, date-time, nullable, required
    - `lastRequestedAt` string, date-time, nullable, required

## Other responses

- `400`: Request validation failed.
- `401`: Authentication is required.
- `403`: The token is not authorized.
- `404`: Workspace not found.

---

[API](https://skmtc.dev/rstream/apis/rstream-api.md) · [All operations](https://skmtc.dev/rstream/apis/rstream-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rstream/apis/rstream-api/revisions/a840a2c91f22?raw)