---
title: "List the caller's own source-access wrappers (blobs included)"
method: GET
path: "/agent/v1/source-access/wrappers"
tags: ["Org"]
---

# List the caller's own source-access wrappers (blobs included)

`GET /agent/v1/source-access/wrappers`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/source-access/wrappers`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Owning-principal-only, structurally: returns the caller's live wrappers for their active encryption key, ciphertext included (the unwrap ceremony needs the blobs), plus the key identity the wrapper AAD binds to. Never returns `code_verifier_hash`, and no read surface anywhere returns another principal's wrapper ciphertext.

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

The caller's wrapper set

- object
  - `principal_id` string, uuid
  - `encryption_key` object, nullable
    - `encryption_key_id` string, uuid
    - `ek_fingerprint` string
    - `public_key` string
    - `suite` string
    - `custody_scheme` 'legacy_direct_prf_v1' | 'wrapped_legacy_scalar_v1' | 'wrapped_random_v1': EXPLICIT custody scheme — readers select the key path from this, never from wrapper count, and wrapped custody never falls back to legacy derivation.
    - `state` 'pending' | 'active'
    - `created_at` string, date-time
  - `wrappers` object[]
    - `wrapper_id` string, uuid
    - `encryption_key_id` string, uuid
    - `kind` 'webauthn_prf' | 'recovery_code'
    - `state` 'pending' | 'active': Only `active` wrappers can unwrap; `pending` rows are visible to the owner for ceremony resume and expire on their own.
    - `format_version` string
    - `credential_subject` string, nullable: The backing passkey's credential id (`webauthn_prf` only; server-derived from the verified assertion).
    - `wrapper_ciphertext` string: `swrap2_`-prefixed opaque AEAD blob. Returned only to the owning principal; the platform cannot open it.
    - `blob_sha256` string
    - `created_at` string, date-time
    - `activated_at` string, date-time, nullable

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)