---
title: "Get Flows encryption key status"
method: GET
path: "/v1/whatsapp/flows/encryption-key"
tags: ["WhatsApp Flows"]
---

# Get Flows encryption key status

`GET /v1/whatsapp/flows/encryption-key`

Read the RSA business public key registered on the phone number for WhatsApp Flows
endpoint encryption. Only one key is active per phone number at a time. Flows that
use flow_action: data_exchange (an endpoint-backed flow) stop working at runtime
until the endpoint serves the matching private key, and Meta rejects publish with
error code 139002 ("Missing Flows Signed Public Key") when no key is registered.
`registered` reflects whether a key is present, never `signatureStatus` alone:
Meta reports an unregistered key as MISMATCH rather than a null/absent value.

## Query parameters

- `accountId` string, required

## Response `200`

Encryption key status retrieved

- object
  - `publicKey` string, nullable — The registered RSA public key in PEM format, or null when none is registered.
  - `signatureStatus` 'VALID' | 'MISMATCH', nullable — VALID (key matches Meta's records) or MISMATCH (no key registered, or the key does not match); null when unknown.
  - `registered` boolean — Whether a key is currently registered. Derived from publicKey, not signatureStatus.

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `403` — The API key is a restricted key (zrk_ prefix) and may not perform this operation. Three cases. (1) The operation's resource group (see the operation's x-resource-group) is disabled on the key: fix it by creating a key with the group enabled in the dashboard API keys tab and revoking the old one. (2) The operation is admin-plane (x-resource-group admin-plane: API keys, invites, connected apps, member identity), which is never grantable to restricted keys; the error reads "Restricted API keys cannot manage API keys, invites, or member identity." and the fix is a full-access key or the dashboard, never a new restricted key. (3) On webhook subscription writes, delivery-log reads and replays, a named event maps to a resource group the key does not hold, so a restricted key can never create or edit a subscription broader than itself (a no-messages key cannot subscribe to, test-fire, redeliver or read logs for message.* events).
- `404` — WhatsApp account not found
- `502` — Meta rejected the request

## Changes

- **2026-09-04** `2d81890d21d5` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/zernio/apis/zernio-api/changes/v1/whatsapp/flows/encryption-key/get.md)

---

[API](https://skmtc.dev/zernio/apis/zernio-api.md) · [All operations](https://skmtc.dev/zernio/apis/zernio-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/zernio/zernio-api/revisions/2d81890d21d5/schema)