---
title: "Prove possession of a pending keystore encryption key"
method: POST
path: "/agent/v1/whoami/encryption-key/activate"
tags: ["Org"]
---

# Prove possession of a pending keystore encryption key

`POST /agent/v1/whoami/encryption-key/activate`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/whoami/encryption-key/activate`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

vault-agent-envelopes D2 (consult round 1): a `keystore_v1` key is published PENDING and becomes a directory recipient only when its publisher answers the ECDH key-confirmation challenge returned by the publish (`activation.{challenge_id, epk}`). The proof is HMAC-SHA256 over a fixed JCS message keyed by the X25519 shared secret with the server's ephemeral key — computable only by a holder of the private half; the server stored `sha256(expected)` and learns no key material. Wrong or expired proof never activates (403 POSSESSION_PROOF_INVALID / 410 ACTIVATION_EXPIRED — republish for a fresh challenge). On success the key is synced into every org's desired-recipient state and any key-holder's next vault operation wraps each vault to it. Self-only; same credential gate as publish. The SDK does this in the same invocation as the publish.

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `challenge_id` string, uuid, required
  - `proof` string, required: base64url possession proof.

## Response `200`

Key active — now a recipient in every org directory the principal is a member of

- object
  - `principal_id` string, uuid
  - `encryption_key_id` string, uuid
  - `ek_fingerprint` string
  - `custody_scheme` string
  - `state` 'active'
  - `next_actions` object[]

## Other responses

- `403`: POSSESSION_PROOF_INVALID
- `409`: KEY_NOT_PENDING — no pending keystore key with an outstanding challenge
- `410`: ACTIVATION_EXPIRED — republish the key for a fresh challenge

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)