---
title: "Read the org's encryption-key directory"
method: GET
path: "/orgs/v1/{org_id}/encryption-keys"
tags: ["Org"]
---

# Read the org's encryption-key directory

`GET /orgs/v1/{org_id}/encryption-keys`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/orgs/v1/{org_id}/encryption-keys`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - API key in header `x-admin-key`

The org's directory of envelope-capable principals (vault-human-envelopes design D7): every active human member with a published key. Readable by any active member; an admin key reads too. Public-key material only — reads stay authorized to avoid a directory-harvest surface.

## Path parameters

- `org_id` string, uuid, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

The directory

- object
  - `org_id` string, uuid
  - `keys` object[]
    - `principal_id` string, uuid
    - `display_name` string, nullable
    - `public_key` string: The raw 32-byte X25519 public key, base64url-encoded, no padding — what a client wraps K_repo to (paired with ek_fingerprint, its identity).
    - `ek_fingerprint` string
    - `suite` string
    - `created_at` string, date-time
    - `signing_pubkey` string, nullable: vault-multi-writer rev 47. Canonical base64url-encoded 32-byte Ed25519 public key — this principal's OPTIONAL vault-writer signing half, or `null` if never published. Unlike `whoami`, the directory exposes the FULL key (not just its fingerprint): a client deciding who to add as a vault writer needs the real key.
    - `signing_fingerprint` string, nullable: vault-multi-writer rev 47. `vk_<32 hex>` derived from `signing_pubkey`; `null` alongside a `null` `signing_pubkey`.
    - `signing_possession_verified_at` string, date-time, nullable: vault-multi-writer rev 47. When this principal's `possession_signature` for the signing half was verified; `null` alongside a `null` `signing_pubkey`.

## Other responses

- `403`: Not a member of this org

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)