Hub API and SDK

TKeeper Hub exposes REST endpoints for keys, signing, approvals, operations, policies, inventory, audit and Keeper peer maintenance. Use the Download Hub OpenAPI specification to generate a client for your language. The contract includes the native Keeper schemas; SDK generation does not require a Keeper checkout.

Connect a client

Set the SDK base URL to your Hub origin. Send your existing SSO access JWT in Authorization: Bearer <token>. Hub verifies the token and forwards the same user credential to Keeper. /auth/config is public and returns OIDC discovery settings.

curl --fail-with-body \
  --header "Authorization: Bearer $SSO_ACCESS_TOKEN" \
  "$HUB_ORIGIN/v1/session"

Generate the SDK from the downloaded contract with an OpenAPI 3.1-compatible generator. Check that the client preserves nullable fields, all documented success responses, response headers and empty 204 bodies. Dynamic authority configuration and JSON Schema fields remain open objects; use describeAuthority to discover the installed command's schema.

Operations and retries

Refresh, rotate, destroy, sign and compose require a nonblank Idempotency-Key of up to 128 characters. Repeating the same action and body with that key replays the saved result; reusing it for a different request returns 409. After an unknown transport outcome, check the operation before submitting another mutation.

Approval-dependent commands can return 202 with an OperationView instead of the native command result. Handle both response types. Only the owner can execute or cancel the saved operation. Inspect its state: an execution response with HTTP 200 can contain FAILED.

Operation events use text/event-stream. Read SSE separately from JSON and resume with the last received version in Last-Event-ID. Connections are limited to 30 seconds and the bearer token's remaining lifetime.

Dates and request limits

Hub dates are RFC 3339 UTC strings. Native WebAuthn JSON expiresAt uses Unix milliseconds; X-EXPIRES-AT uses Unix seconds. Reading or retrying preparation does not extend an approval deadline.

HTTP bodies are limited to 12 MiB; native Keeper command JSON is limited to 10 MiB. Registry metadata filters use separate query pairs: metadata.<key>=value.

MCP

MCP is a separate protocol at /mcp, using the same bearer authentication. Discover tools and their input schemas through tools/list, following nextCursor. See the Hub MCP reference.

REST endpoints

Search and expand the endpoints below to inspect parameters, request bodies and responses.

Search endpoints

Session

GET/auth/configRead public OIDC discovery settings

Responses

200 Successful response

application/json object

{
  "issuer": "string",
  "clientId": "string",
  "audience": "string",
  "scopes": [
    "string"
  ],
  "authorizationEndpoint": "string",
  "tokenEndpoint": "string",
  "jwksUri": "string",
  "endSessionEndpoint": "string",
  "revocationEndpoint": "string"
}

503 SSO discovery is unavailable.

application/json object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/sessionRead the verified bearer identity

Responses

200 Successful response

application/json object

{
  "issuer": "string",
  "subject": "string",
  "permissions": [
    "string"
  ],
  "displayName": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

Approvers

GET/v1/approversList native registry approvers

Parameters

Name	In	Type	Required	Description
`id`	query	string	No	-
`type`	query	enum(SIGNATURE, WEBAUTHN)	No	-
`cursor`	query	string	No	nextCursor from the preceding page; must belong to id when that filter is set.
`limit`	query	integer	No	-
`metadata`	query	object	No	Exploded map of complete dotted query names, for example metadata.team=finance. Pass {"metadata.team":"finance"} as the map value. Each name must occur once.

Responses

200 Matching versions; nextCursor is null on the final page.

application/json object

{
  "items": [
    {
      "id": "string",
      "ref": "string",
      "credential": {
        "version": 1,
        "type": "SIGNATURE",
        "algorithm": "string",
        "publicKey64": "string"
      },
      "metadata": {
        "key": "string"
      },
      "createdAt": 1,
      "updatedAt": 1,
      "metadataRevision": 1
    }
  ],
  "nextCursor": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/approversRegister a machine signature approver

Request Body

Required: Yes

application/json object

{
  "id": "string",
  "credential": {
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  }
}

Responses

200 Existing identical immutable credential.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

201 Created immutable credential.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/approvers/{ref}Read an immutable approver reference

Parameters

Name	In	Type	Required	Description
`ref`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

PUT/v1/approvers/{ref}/metadataReplace metadata using the current revision

Parameters

Name	In	Type	Required	Description
`If-Match`	header	string	Yes	Quoted ETag from the current approver record. Missing/stale preconditions are rejected by Keeper.
`ref`	path	string	Yes	-

Request Body

Required: Yes

application/json object

{
  "metadata": {
    "key": "string"
  }
}

Responses

200 Successful response

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/approvers/capabilitiesRead registration and metadata permissions

Responses

200 Successful response

application/json object

{
  "canRegister": true,
  "canEditMetadata": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/approvers/invitationsList invitations in this issuer and Keeper cluster

Requires tkeeper.approvers.register. Tokens and browser options are omitted.

Responses

200 Successful response

application/json object

{
  "items": [
    {
      "invitationId": "string",
      "expiresAt": "2026-01-01T00:00:00Z",
      "metadata": {
        "key": "string"
      },
      "state": "PENDING",
      "serverTime": "2026-01-01T00:00:00Z"
    }
  ],
  "nextCursor": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/approvers/invitationsCreate an invitation and native passkey options

Requires tkeeper.approvers.register. Metadata is assigned by the administrator. Creation returns the secret token once. Recipient must authenticate in the same issuer; subject may restrict the intended recipient.

Request Body

Required: Yes

application/json object

{
  "metadata": {
    "key": "string"
  },
  "subject": "string"
}

Responses

200 Successful response

application/json object

{
  "invitationId": "string",
  "expiresAt": "2026-01-01T00:00:00Z",
  "metadata": {
    "key": "string"
  },
  "state": "PENDING",
  "serverTime": "2026-01-01T00:00:00Z"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/approvers/invitations/{token}Inspect an invitation available to the authenticated recipient

Parameters

Name	In	Type	Required	Description
`token`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "invitationId": "string",
  "expiresAt": "2026-01-01T00:00:00Z",
  "metadata": {
    "key": "string"
  },
  "state": "PENDING",
  "serverTime": "2026-01-01T00:00:00Z"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/approvers/meRead immutable credentials enrolled by this identity

Responses

200 Successful response

application/json object

{
  "items": [
    {
      "id": "string",
      "ref": "string",
      "credential": {
        "version": 1,
        "type": "SIGNATURE",
        "algorithm": "string",
        "publicKey64": "string"
      },
      "metadata": {
        "key": "string"
      },
      "createdAt": 1,
      "updatedAt": 1,
      "metadataRevision": 1
    }
  ],
  "nextCursor": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/approvers/webauthn/registration/finishFinish an invitation and bind the credential to the recipient

Requires recipient authentication, without an additional registration permission. Hub forwards the current recipient JWT. A successful immutable binding is issuer/subject scoped; a different credential/account cannot reuse the claimed invitation.

Request Body

Required: Yes

application/json object

{
  "invitationToken": "string",
  "credential": {
    "id": "string",
    "rawId": "string",
    "type": "public-key",
    "response": {
      "clientDataJSON": "string",
      "attestationObject": "string",
      "transports": [
        "string"
      ],
      "authenticatorData": "string"
    }
  }
}

Responses

200 Exact idempotent finish replay.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

201 Credential registered and bound.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/approvers/webauthn/registration/optionsRead cached invitation passkey options

Recipient uses their current Hub bearer. Metadata/id are not accepted here. Reading the saved challenge does not renew its deadline.

Request Body

Required: Yes

application/json object

{
  "invitationToken": "string"
}

Responses

200 Successful response

application/json object

{
  "registrationId": "string",
  "expiresAt": 1,
  "publicKey": {
    "challenge": "string",
    "rp": {
      "id": "string",
      "name": "string"
    },
    "user": {
      "id": "string",
      "name": "string",
      "displayName": "string"
    },
    "pubKeyCredParams": [
      {
        "type": "public-key",
        "alg": 1
      }
    ]
  },
  "serverTime": "2026-01-01T00:00:00Z"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

System

GET/v1/capabilitiesRead permission and cluster capability discovery

Responses

200 Successful response

application/json object

{
  "pages": {
    "key": true
  },
  "actions": {
    "key": true
  },
  "features": [
    "string"
  ],
  "authorityTypes": [
    "string"
  ],
  "builtinAuthorities": [
    "string"
  ],
  "platforms": [
    "string"
  ],
  "configurationStatus": "string",
  "configurationWarnings": [
    "string"
  ],
  "serverTime": "2026-01-01T00:00:00Z",
  "cluster": {
    "threshold": 1,
    "totalPeers": 1,
    "readyPeers": 1,
    "configuredPeers": 1,
    "status": "string",
    "quorumReady": true,
    "allPeersReady": true,
    "requestPeerReady": true,
    "authentication": {
      "id": "string",
      "header": "string",
      "clientId": "string",
      "audience": "string"
    }
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/audit-sinksRead protected native audit destinations

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Audit sink status

application/json object

{
  "enabled": true,
  "sinks": [
    {
      "id": "string",
      "available": true
    }
  ]
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/authorizationRead native authentication configuration

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Control-plane authentication configuration

application/json object | object

{
  "id": "TOKEN",
  "header": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/system/auto-unsealRun the configured automatic unseal provider

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Unseal progress

application/json object | object

{
  "ready": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/capabilitiesRead installed native signing algorithms

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Runtime control-plane capabilities

application/json object

{
  "algorithms": [
    "string"
  ]
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/configRead native cluster configuration

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Current Keeper configuration

application/json object

{
  "threshold": 1,
  "total": 1,
  "features": [
    "core",
    "ecies",
    "mandate"
  ],
  "authorities": [
    "arbitrary",
    "custom"
  ],
  "sealProvider": "shamir"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/system/consistency/fixRepair one key consistency

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.
`keyId`	query	string	Yes	-

Responses

200 Consistency verdict

application/json object

{
  "verdict": "OK",
  "targetGeneration": 1,
  "versions": {
    "key": {
      "activeGen": 1,
      "pendingGen": 1
    }
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/controlsRead native control-plane system information

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Cluster status

application/json object

{
  "id": "string",
  "state": "READY",
  "threshold": 1,
  "totalPeers": 1,
  "peers": {
    "key": "READY"
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/healthCheck peer liveness

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

204 Service is up

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/system/initializeInitialize a peer

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Request Body

Required: Yes

application/json object

{
  "peerId": 1,
  "threshold": 1,
  "total": 1
}

Responses

200 Provider initialization data

application/json object

{
  "threshold": 1,
  "total": 1,
  "shares64": [
    "string"
  ]
}

204 Initialized without provider payload

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/system/integrity/rotateRotate native integrity key material

All Keeper peers must be restarted after successful integrity-key rotation before key operations resume. This endpoint does not restart processes.

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

204 Integrity key rotated

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/meRead native current authentication data

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Authenticated subject

application/json object

{
  "subject": "string",
  "actor": "string",
  "permissions": [
    "string"
  ]
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/peer-idRead native peer numeric id

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Peer id

application/json object

{
  "serviceId": 1,
  "result": 1
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/peersInspect configured Keeper peers and cluster readiness

Peer IDs are routing selectors for peer-specific endpoints. Readiness, loaded modules, algorithms and permissions independently constrain actions. Protected audit summaries are omitted without the native audit-sink permission.

Responses

200 Successful response

application/json object

{
  "items": [
    {
      "id": "string",
      "name": "string",
      "state": "string",
      "managed": true,
      "features": [
        "string"
      ],
      "authorities": [
        "string"
      ],
      "platforms": [
        "string"
      ],
      "configurationState": "string",
      "configurationMismatches": [
        "string"
      ],
      "dangerousFeatures": [
        "string"
      ],
      "actions": {
        "key": true
      },
      "ready": true
    }
  ],
  "serverTime": "2026-01-01T00:00:00Z",
  "configurationStatus": "string",
  "mismatches": [
    "string"
  ],
  "dangerousFeatures": [
    "string"
  ],
  "cluster": {
    "threshold": 1,
    "totalPeers": 1,
    "readyPeers": 1,
    "configuredPeers": 1,
    "status": "string",
    "quorumReady": true,
    "allPeersReady": true,
    "requestPeerReady": true,
    "authentication": {
      "id": "string",
      "header": "string",
      "clientId": "string",
      "audience": "string"
    }
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/pingRead peer short status

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Readiness flag

application/json object

{
  "ready": true,
  "peerId": 1,
  "threshold": 1,
  "total": 1
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/readinessCheck peer readiness

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

204 Keeper is unsealed

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

503 Peer is not ready, is sealed, or requires restart. Native readiness failure has no body; Hub infrastructure failures may contain ApiError.

- -

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/system/recoveryRecover a key share

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "helperIds": [
    1
  ]
}

Responses

200 All non-destroyed generations are present and verified on the target peer

application/json object

{
  "keyId": "string",
  "algorithm": "string",
  "targetPeerId": 1,
  "currentGeneration": 1,
  "recoveredGenerations": [
    1
  ],
  "helpers": [
    1
  ]
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/system/sealSeal a peer

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

204 Keeper sealed

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/system/statusRead peer store state

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Responses

200 Keeper status

application/json object

{
  "sealedBy": "string",
  "state": "UNINITIALIZED",
  "progress": {
    "ready": true
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/system/unsealSubmit unseal shares

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Request Body

Required: Yes

application/json object | object

Responses

200 Unseal progress

application/json object | object

{
  "ready": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

Compliance

POST/v1/compliance/audit/verifyVerify one signed audit record

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Request Body

Required: Yes

application/json object

{
  "event": {
    "id": "string",
    "peerId": 1,
    "integrityKeyVersion": 1,
    "timestamp": 1,
    "event": "string"
  },
  "signature": "string"
}

Responses

200 Verification result

application/json object

{
  "valid": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/compliance/audit/verify-batchVerify a batch of signed audit records

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Request Body

Required: Yes

application/json object

{
  "logs": [
    {
      "event": {
        "id": "string",
        "peerId": 1,
        "integrityKeyVersion": 1,
        "timestamp": 1,
        "event": "string"
      },
      "signature": "string"
    }
  ]
}

Responses

200 Verification results by event id

application/json object

{
  "key": {
    "valid": true
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/compliance/inventoryList native key inventory

Parameters

Name	In	Type	Required	Description
`logicalId`	query	string	No	-
`historical`	query	boolean	No	-
`lastSeen`	query	string	No	-
`assetOwner`	query	string	No	-
`limit`	query	integer:int32	No	-

Responses

200 Asset inventory page

application/json object

{
  "inventory": {
    "generatedAt": 1,
    "peerId": 1,
    "threshold": 1,
    "totalPeers": 1,
    "items": [
      {
        "logicalId": "string",
        "status": "ACTIVE",
        "currentGeneration": 1,
        "authorities": [
          {
            "id": "string",
            "oci": "string"
          }
        ],
        "createdAt": 1,
        "updatedAt": 1,
        "hasActiveKey": true,
        "tampered": true
      }
    ]
  },
  "nextCursor": "string",
  "hasMore": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

Expirations

GET/v1/expirationsList upcoming native expiration entries

Parameters

Name	In	Type	Required	Description
`type`	query	enum(apply, process)	Yes	-
`limit`	query	integer:int32	No	-
`cursor`	query	string	No	-
`windowSec`	query	integer:int64	No	-
`from`	query	integer:int64	No	-
`to`	query	integer:int64	No	-

Responses

200 Expiration page

application/json object

{
  "items": [
    {
      "type": "APPLY",
      "logicalId": "string",
      "generation": 1,
      "expiresAt": 1
    }
  ],
  "next": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/expirations/applyList entries in an apply-expiration window

Parameters

Name	In	Type	Required	Description
`limit`	query	integer:int32	No	-
`cursor`	query	string	No	-
`windowSec`	query	integer:int64	Yes	-

Responses

200 Expiration page

application/json object

{
  "items": [
    {
      "type": "APPLY",
      "logicalId": "string",
      "generation": 1,
      "expiresAt": 1
    }
  ],
  "next": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/expirations/expiredList already expired native entries

Parameters

Name	In	Type	Required	Description
`type`	query	enum(apply, process)	Yes	-
`limit`	query	integer:int32	No	-
`cursor`	query	string	No	-

Responses

200 Expiration page

application/json object

{
  "items": [
    {
      "type": "APPLY",
      "logicalId": "string",
      "generation": 1,
      "expiresAt": 1
    }
  ],
  "next": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/expirations/processList entries in a process-expiration window

Parameters

Name	In	Type	Required	Description
`limit`	query	integer:int32	No	-
`cursor`	query	string	No	-
`windowSec`	query	integer:int64	Yes	-

Responses

200 Expiration page

application/json object

{
  "items": [
    {
      "type": "APPLY",
      "logicalId": "string",
      "generation": 1,
      "expiresAt": 1
    }
  ],
  "next": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

Identities

GET/v1/identitiesList identities available for signing

Hub wraps native results as {isError,result} and preserves their HTTP status. A native error also uses this wrapper; Hub failures use ApiError.

Parameters

Name	In	Type	Required	Description
`lastSeen`	query	string	No	Key id returned as nextCursor by the previous page.
`limit`	query	integer	No	-

Responses

200 Successful response

application/json object

{
  "isError": true,
  "result": {
    "items": [
      {
        "keyId": "string",
        "algorithm": "string",
        "generation": 1,
        "authorities": [
          "string"
        ]
      }
    ],
    "nextCursor": "string"
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Native error wrapped in result, or a Hub/infrastructure error.

application/json object | object | object

{
  "isError": true,
  "result": {
    "items": [
      {
        "keyId": "string",
        "algorithm": "string",
        "generation": 1,
        "authorities": [
          "string"
        ]
      }
    ],
    "nextCursor": "string"
  }
}

GET/v1/identities/{keyId}/authorities/{authorityId}Read an installed authority and its native command JSON Schema

Hub wraps native results as {isError,result} and preserves their HTTP status. A native error also uses this wrapper; Hub failures use ApiError.

Parameters

Name	In	Type	Required	Description
`keyId`	path	string	Yes	-
`authorityId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "isError": true,
  "result": {
    "id": "string",
    "type": "string",
    "version": "string",
    "description": "string",
    "commandSchema": {}
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Native error wrapped in result, or a Hub/infrastructure error.

application/json object | object | object

{
  "isError": true,
  "result": {
    "id": "string",
    "type": "string",
    "version": "string",
    "description": "string",
    "commandSchema": {}
  }
}

Keys

POST/v1/keysCreate key material

Hub fixes the DKG mode. CREATE runs directly. REFRESH/ROTATE use a saved mandate and Idempotency-Key. If approvals are required, response is 202; otherwise Keeper executes immediately. Omitting policy on REFRESH/ROTATE removes the previous policy.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "algorithm": "string",
  "authorities": [
    {
      "id": "string",
      "oci": "string"
    }
  ],
  "mode": "CREATE"
}

Responses

204 Lifecycle operation completed

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/keys/{keyId}/publicRead a key generation public key

Parameters

Name	In	Type	Required	Description
`generation`	query	integer:int32	No	-
`tweak`	query	string	No	-
`keyId`	path	string	Yes	-

Responses

200 Public key

application/json object

{
  "data64": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/keys/authorities/resolveResolve a digest-pinned authority in the configured registry

Requires a key mutation permission. The OCI origin and repository must match the configured Hub registry. Returns authority id/type without granting authority catalogue permissions.

Parameters

Name	In	Type	Required	Description
`oci`	query	string	Yes	-

Responses

200 Successful response

application/json object

{
  "id": "string",
  "type": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/keys/capabilitiesRead key-specific permitted actions

Parameters

Name	In	Type	Required	Description
`keyId`	query	string \| null	No	-

Responses

200 Successful response

application/json object

{
  "canCreate": true,
  "canImport": true,
  "canRefresh": true,
  "canRotate": true,
  "canDestroy": true,
  "canSign": true,
  "canReadPublic": true,
  "canVerify": true,
  "canEncrypt": true,
  "canDecrypt": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/keys/destroyDestroy an explicit historical key generation

Current generation cannot be destroyed. The supplied historical generation remains fixed for approval and execution.

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	Yes	Required, nonblank owner-scoped key. Repeating the same action and business body replays the saved result. Reuse for a different request returns 409. A transport failure is not permission to submit another mutation.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "generation": 1,
  "approvals": {
    "keeperId": 0,
    "nonce": "",
    "timestamp": 1,
    "proofs": []
  }
}

Responses

202 Waiting for approval receipts or an existing operation still in progress.

application/json object

{
  "operationId": "string",
  "type": "string",
  "state": "WAITING_APPROVALS",
  "version": 1,
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "request": {},
  "expiresAt": "2026-01-01T00:00:00Z",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "responseStatus": 1,
  "response": {},
  "errorCode": "string",
  "errorMessage": "string",
  "responseHeaders": {
    "key": [
      "string"
    ]
  },
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "owner": {
    "issuer": "string",
    "subject": "string"
  },
  "keeperOrigin": "string",
  "approvalWorkflow": true
}

204 Generation destroyed

- -

299 Threshold destroy committed by quorum, but not all peers

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/keys/importImport key material through the native trusted dealer

value64 contains private key material. Native Keeper returns 204 for its Unit result. Do not log or persist the request body.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "algorithm": "string",
  "authorities": [
    {
      "id": "string",
      "oci": "string"
    }
  ],
  "value64": "string"
}

Responses

204 Key imported; no response body.

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/keys/quorum/promotePromote quorum on a configured peer

Parameters

Name	In	Type	Required	Description
`peerId`	query	string	No	ID from listKeeperPeers. Omit for the configured request peer. Only explicitly configured peer IDs are accepted; origins and arbitrary URLs are rejected.

Request Body

Required: Yes

application/json object

{
  "threshold": 1,
  "total": 1
}

Responses

200 Promotion completed; restart the keeper before normal operations

application/json object

{
  "peerId": 1,
  "threshold": 1,
  "total": 1,
  "promotedKeys": 1,
  "restartRequired": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/keys/refreshRefresh key material

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	Yes	Required, nonblank owner-scoped key. Repeating the same action and business body replays the saved result. Reuse for a different request returns 409. A transport failure is not permission to submit another mutation.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "algorithm": "string",
  "authorities": [
    {
      "id": "string",
      "oci": "string"
    }
  ],
  "mode": "REFRESH"
}

Responses

202 Waiting for approval receipts or an existing operation still in progress.

application/json object

{
  "operationId": "string",
  "type": "string",
  "state": "WAITING_APPROVALS",
  "version": 1,
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "request": {},
  "expiresAt": "2026-01-01T00:00:00Z",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "responseStatus": 1,
  "response": {},
  "errorCode": "string",
  "errorMessage": "string",
  "responseHeaders": {
    "key": [
      "string"
    ]
  },
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "owner": {
    "issuer": "string",
    "subject": "string"
  },
  "keeperOrigin": "string",
  "approvalWorkflow": true
}

204 Lifecycle operation completed

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/keys/rotateRotate key material

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	Yes	Required, nonblank owner-scoped key. Repeating the same action and business body replays the saved result. Reuse for a different request returns 409. A transport failure is not permission to submit another mutation.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "algorithm": "string",
  "authorities": [
    {
      "id": "string",
      "oci": "string"
    }
  ],
  "mode": "ROTATE"
}

Responses

202 Waiting for approval receipts or an existing operation still in progress.

application/json object

{
  "operationId": "string",
  "type": "string",
  "state": "WAITING_APPROVALS",
  "version": 1,
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "request": {},
  "expiresAt": "2026-01-01T00:00:00Z",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "responseStatus": 1,
  "response": {},
  "errorCode": "string",
  "errorMessage": "string",
  "responseHeaders": {
    "key": [
      "string"
    ]
  },
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "owner": {
    "issuer": "string",
    "subject": "string"
  },
  "keeperOrigin": "string",
  "approvalWorkflow": true
}

204 Lifecycle operation completed

- -

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

Operations

GET/v1/operationsList visible operation summaries

Filters apply before pagination. Operations are visible to their owner, bound approval participants and users with tkeeper.operations.read.all. Global read does not grant approval, execution or cancellation. Cursor is opaque; preserve it unchanged.

Parameters

Name	In	Type	Required	Description
`limit`	query	integer:int32	No	-
`view`	query	enum(all, needs_approval)	No	-
`state`	query	enum(WAITING_APPROVALS, READY, EXECUTING, SUCCEEDED, FAILED, OUTCOME_UNKNOWN, CANCELLED, EXPIRED)	No	-
`search`	query	string	No	-
`cursor`	query	string	No	-

Responses

200 Successful response

application/json object

{
  "items": [
    {
      "operationId": "string",
      "type": "string",
      "state": "WAITING_APPROVALS",
      "version": 1,
      "expiresAt": "2026-01-01T00:00:00Z",
      "createdAt": "2026-01-01T00:00:00Z",
      "updatedAt": "2026-01-01T00:00:00Z",
      "responseStatus": 1,
      "errorCode": "string",
      "approvalExpiresAt": "2026-01-01T00:00:00Z",
      "serverTime": "2026-01-01T00:00:00Z",
      "owner": {
        "issuer": "string",
        "subject": "string"
      },
      "keyId": "string",
      "mode": "string",
      "needsMyApproval": true,
      "receivedByMe": true
    }
  ],
  "nextCursor": "string",
  "pendingCount": 1,
  "approvalParticipant": true,
  "canReadAll": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/operations/{operationId}Read a visible saved operation

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "operationId": "string",
  "type": "string",
  "state": "WAITING_APPROVALS",
  "version": 1,
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "request": {},
  "expiresAt": "2026-01-01T00:00:00Z",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "responseStatus": 1,
  "response": {},
  "errorCode": "string",
  "errorMessage": "string",
  "responseHeaders": {
    "key": [
      "string"
    ]
  },
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "owner": {
    "issuer": "string",
    "subject": "string"
  },
  "keeperOrigin": "string",
  "approvalWorkflow": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/operations/{operationId}/cancelCancel a pending saved operation as its owner

Cancellation changes the Hub workflow and does not revoke a copied native mandate before its TTL.

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "operationId": "string",
  "type": "string",
  "state": "WAITING_APPROVALS",
  "version": 1,
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "request": {},
  "expiresAt": "2026-01-01T00:00:00Z",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "responseStatus": 1,
  "response": {},
  "errorCode": "string",
  "errorMessage": "string",
  "responseHeaders": {
    "key": [
      "string"
    ]
  },
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "owner": {
    "issuer": "string",
    "subject": "string"
  },
  "keeperOrigin": "string",
  "approvalWorkflow": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/operations/{operationId}/eventsStream durable operation events with resume

Parameters

Name	In	Type	Required	Description
`Last-Event-ID`	header	string	No	Decimal signed int64 operation version, at least -1. Omit to replay from the beginning.
`operationId`	path	string	Yes	-

Responses

200 UTF-8 SSE stream. Each event has name operation, id equal to its decimal version and data containing OperationEvent JSON. The stream ends after at most 30 seconds or bearer expiry; reconnect using the last received event id.

text/event-stream string

"event: operation\nid: 2\ndata: {\"eventId\":\"event-2\",\"operationId\":\"operation-1\",\"type\":\"sign\",\"state\":\"WAITING_APPROVALS\",\"version\":2,\"occurredAt\":\"2026-10-18T12:00:00Z\",\"eventType\":\"APPROVAL_SUBMITTED\",\"actor\":null}\n\n"

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/operations/{operationId}/executeExecute a saved operation once as its owner

{} commits the collected receipts atomically. Only the owner can execute. A Keeper rejection returns an OperationView with state=FAILED; this HTTP 200 does not mean the native command succeeded. Execution is not automatically retried, including an unknown transport outcome.

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Request Body

Required: Yes

application/json object

{
  "proofs": []
}

Responses

200 Successful response

application/json object

{
  "operationId": "string",
  "type": "string",
  "state": "WAITING_APPROVALS",
  "version": 1,
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "request": {},
  "expiresAt": "2026-01-01T00:00:00Z",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "responseStatus": 1,
  "response": {},
  "errorCode": "string",
  "errorMessage": "string",
  "responseHeaders": {
    "key": [
      "string"
    ]
  },
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "owner": {
    "issuer": "string",
    "subject": "string"
  },
  "keeperOrigin": "string",
  "approvalWorkflow": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/operations/{operationId}/historyRead durable operation events after a version

Parameters

Name	In	Type	Required	Description
`afterVersion`	query	integer:int64	No	-
`limit`	query	integer:int32	No	-
`operationId`	path	string	Yes	-

Responses

200 Successful response

application/json array<object>

[
  {
    "eventId": "string",
    "operationId": "string",
    "type": "string",
    "state": "WAITING_APPROVALS",
    "version": 1,
    "occurredAt": "2026-01-01T00:00:00Z",
    "eventType": "STATE_CHANGED",
    "actor": {
      "issuer": "string",
      "subject": "string"
    }
  }
]

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

Approvals

GET/v1/operations/{operationId}/approvalsRead receipt progress and caller actions

Receipt counts do not imply cryptographic validity. Keeper validates final proofs only at execution. An unknown approvalExpiresAt remains null and must not be replaced by mandate expiry.

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "canApprove": true,
  "reason": "OPERATION_NOT_AVAILABLE",
  "canExecute": true,
  "canCancel": true,
  "expiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "credentials": [
    {
      "ref": "string",
      "fingerprint": "string",
      "displayName": "string"
    }
  ],
  "requirements": [
    {
      "threshold": 1,
      "total": 1,
      "approvers": [
        {
          "type": "SIGNATURE",
          "key": {
            "algorithm": "string",
            "publicKey64": "string",
            "webAuthn": {
              "credentialId": "string",
              "rpId": "string",
              "origins": [
                "string"
              ],
              "userHandle": "string"
            }
          },
          "received": true,
          "ref": "string",
          "fingerprint": "string",
          "displayName": "string"
        }
      ],
      "received": 1,
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "receivedByMe": true,
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "canPrepare": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/operations/{operationId}/approvals/preparePrepare native WebAuthn approvals as the owner

Reuses the saved request, generation and approval context. Preparation does not extend the original approval window.

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "hashForSigning64": "string",
  "binding": {
    "payload": {
      "keeperId": 1,
      "operationType": "string",
      "hashForSigning64": "string",
      "generation": 1,
      "requirementsHash64": "string",
      "challenge": "string",
      "issuedAt": 1,
      "expiresAt": 1
    },
    "signature": {
      "version": 1,
      "algorithm": "string",
      "fingerprint": "string",
      "signature64": "string"
    }
  },
  "webAuthn": [
    {
      "fingerprint": "string",
      "publicKey": {
        "challenge": "string",
        "timeout": 1,
        "rpId": "string",
        "allowCredentials": [
          {
            "type": "public-key",
            "id": "string",
            "transports": [
              "string"
            ]
          }
        ]
      }
    }
  ]
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/operations/{operationId}/approvals/signatureRead machine signing context as the owner

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "operationId": "string",
  "type": "string",
  "operation": {},
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "expiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/operations/{operationId}/approvals/signatureCollect a machine signature receipt as the owner

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Request Body

Required: Yes

application/json object

{
  "fingerprint": "string",
  "signature64": "string"
}

Responses

200 Successful response

application/json object

{
  "canApprove": true,
  "reason": "OPERATION_NOT_AVAILABLE",
  "canExecute": true,
  "canCancel": true,
  "expiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "credentials": [
    {
      "ref": "string",
      "fingerprint": "string",
      "displayName": "string"
    }
  ],
  "requirements": [
    {
      "threshold": 1,
      "total": 1,
      "approvers": [
        {
          "type": "SIGNATURE",
          "key": {
            "algorithm": "string",
            "publicKey64": "string",
            "webAuthn": {
              "credentialId": "string",
              "rpId": "string",
              "origins": [
                "string"
              ],
              "userHandle": "string"
            }
          },
          "received": true,
          "ref": "string",
          "fingerprint": "string",
          "displayName": "string"
        }
      ],
      "received": 1,
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "receivedByMe": true,
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "canPrepare": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/operations/{operationId}/approvals/webauthnCollect a bound human passkey receipt

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Request Body

Required: Yes

application/json object

{
  "approvalId": "string",
  "credential": {
    "id": "string",
    "rawId": "string",
    "type": "public-key",
    "response": {
      "clientDataJSON": "string",
      "authenticatorData": "string",
      "signature": "string",
      "userHandle": "string"
    }
  }
}

Responses

200 Successful response

application/json object

{
  "canApprove": true,
  "reason": "OPERATION_NOT_AVAILABLE",
  "canExecute": true,
  "canCancel": true,
  "expiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "credentials": [
    {
      "ref": "string",
      "fingerprint": "string",
      "displayName": "string"
    }
  ],
  "requirements": [
    {
      "threshold": 1,
      "total": 1,
      "approvers": [
        {
          "type": "SIGNATURE",
          "key": {
            "algorithm": "string",
            "publicKey64": "string",
            "webAuthn": {
              "credentialId": "string",
              "rpId": "string",
              "origins": [
                "string"
              ],
              "userHandle": "string"
            }
          },
          "received": true,
          "ref": "string",
          "fingerprint": "string",
          "displayName": "string"
        }
      ],
      "received": 1,
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "receivedByMe": true,
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "canPrepare": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/operations/{operationId}/approvals/webauthn/optionsPrepare an eligible bound passkey challenge

Parameters

Name	In	Type	Required	Description
`operationId`	path	string	Yes	-

Request Body

Required: Yes

application/json object

{
  "ref": "string"
}

Responses

200 Successful response

application/json object

{
  "approvalId": "string",
  "fingerprint": "string",
  "publicKey": {
    "challenge": "string",
    "timeout": 1,
    "rpId": "string",
    "allowCredentials": [
      {
        "type": "public-key",
        "id": "string",
        "transports": [
          "string"
        ]
      }
    ]
  },
  "expiresAt": 1,
  "serverTime": "2026-01-01T00:00:00Z"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

Policies

GET/v1/policiesList authority catalogue summaries

Parameters

Name	In	Type	Required	Description
`limit`	query	integer:int32	No	-
`cursor`	query	string	No	Opaque cursor returned as nextCursor. Preserve it unchanged.

Responses

200 Successful response

application/json object

{
  "items": [
    {
      "id": "string",
      "type": "string",
      "version": "string",
      "revision": 1,
      "updatedAt": "2026-01-01T00:00:00Z"
    }
  ],
  "nextCursor": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/capabilitiesRead authoring permissions and installed types

Responses

200 Successful response

application/json object

{
  "verdictVersion": "string",
  "read": true,
  "write": true,
  "publish": true,
  "registryConfigured": true,
  "registryUrl": "string",
  "repository": "string",
  "authorityTypes": [
    "string"
  ],
  "maxSourceBytes": 1
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/draftRead an authority draft

Parameters

Name	In	Type	Required	Description
`id`	query	string	Yes	-

Responses

200 Successful response

application/json object

{
  "id": "string",
  "type": "string",
  "version": "string",
  "source": "string",
  "format": "YAML",
  "revision": 1,
  "updatedAt": "2026-01-01T00:00:00Z",
  "updatedByIssuer": "string",
  "updatedBySubject": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

PUT/v1/policies/draftValidate and save an authority draft

Requires tkeeper.policies.publish. Published releases are immutable and digest-pinned. Publishing does not update existing keys.

Parameters

Name	In	Type	Required	Description
`id`	query	string	Yes	-

Request Body

Required: Yes

application/json object

{
  "source": "string",
  "format": "YAML",
  "revision": 0
}

Responses

200 Successful response

application/json object

{
  "id": "string",
  "type": "string",
  "version": "string",
  "source": "string",
  "format": "YAML",
  "revision": 1,
  "updatedAt": "2026-01-01T00:00:00Z",
  "updatedByIssuer": "string",
  "updatedBySubject": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

422 Authority document validation failed; errors identifies the failing stage.

application/json object

{
  "valid": true,
  "verdictVersion": "string",
  "authority": {
    "schemaVersion": "verdict.authority/v1",
    "id": "string",
    "type": "string",
    "version": "string",
    "metadata": {},
    "config": {},
    "policy": {}
  },
  "rootVariables": [
    "string"
  ],
  "errors": [
    {
      "stage": "string",
      "message": "string"
    }
  ],
  "warnings": [
    "string"
  ]
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/helpRead Verdict authoring guidance

Responses

200 Successful response

application/json object

{
  "verdictVersion": "string",
  "documentation": "string",
  "rootVariables": {
    "key": [
      "string"
    ]
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/policies/importImport a digest-pinned OCI source as a draft

Requires tkeeper.policies.publish. Published releases are immutable and digest-pinned. Publishing does not update existing keys.

Request Body

Required: Yes

application/json object

{
  "digest": "string",
  "revision": 0
}

Responses

200 Successful response

application/json object

{
  "id": "string",
  "type": "string",
  "version": "string",
  "source": "string",
  "format": "YAML",
  "revision": 1,
  "updatedAt": "2026-01-01T00:00:00Z",
  "updatedByIssuer": "string",
  "updatedBySubject": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

422 Authority document validation failed; errors identifies the failing stage.

application/json object

{
  "valid": true,
  "verdictVersion": "string",
  "authority": {
    "schemaVersion": "verdict.authority/v1",
    "id": "string",
    "type": "string",
    "version": "string",
    "metadata": {},
    "config": {},
    "policy": {}
  },
  "rootVariables": [
    "string"
  ],
  "errors": [
    {
      "stage": "string",
      "message": "string"
    }
  ],
  "warnings": [
    "string"
  ]
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/policies/publishPublish the expected draft revision to OCI

Requires tkeeper.policies.publish. Published releases are immutable and digest-pinned. Publishing does not update existing keys.

Parameters

Name	In	Type	Required	Description
`id`	query	string	Yes	-

Request Body

Required: Yes

application/json object

{
  "revision": 1
}

Responses

200 Successful response

application/json object

{
  "releaseId": "string",
  "id": "string",
  "type": "string",
  "version": "string",
  "format": "YAML",
  "sourceDigest": "string",
  "registryUrl": "string",
  "repository": "string",
  "digest": "string",
  "state": "PENDING",
  "createdAt": "2026-01-01T00:00:00Z",
  "publishedAt": "2026-01-01T00:00:00Z",
  "createdByIssuer": "string",
  "createdBySubject": "string",
  "oci": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

422 Authority document validation failed; errors identifies the failing stage.

application/json object

{
  "valid": true,
  "verdictVersion": "string",
  "authority": {
    "schemaVersion": "verdict.authority/v1",
    "id": "string",
    "type": "string",
    "version": "string",
    "metadata": {},
    "config": {},
    "policy": {}
  },
  "rootVariables": [
    "string"
  ],
  "errors": [
    {
      "stage": "string",
      "message": "string"
    }
  ],
  "warnings": [
    "string"
  ]
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/registry/policyResolve a configured repository tag

Parameters

Name	In	Type	Required	Description
`tag`	query	string	Yes	-

Responses

200 Successful response

application/json object

{
  "digest": "string",
  "oci": "string",
  "source": {
    "source": "string",
    "format": "YAML"
  }
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/registry/tagsList tags in the configured OCI repository

Parameters

Name	In	Type	Required	Description
`limit`	query	integer:int32	No	-
`cursor`	query	string	No	Opaque cursor returned as nextCursor. Preserve it unchanged.

Responses

200 Successful response

application/json object

{
  "items": [
    "string"
  ],
  "nextCursor": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/templatesList authority authoring templates

Responses

200 Successful response

application/json array<object>

[
  {
    "id": "string",
    "type": "string",
    "source": "string",
    "documentation": "string"
  }
]

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/templates/{id}Read an authority authoring template

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "id": "string",
  "type": "string",
  "source": "string",
  "documentation": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/policies/validateValidate a Verdict authority source

Invalid documents return HTTP 200 with valid=false and diagnostics. Saving/publishing an invalid document returns HTTP 422.

Request Body

Required: Yes

application/json object

{
  "source": "string",
  "format": "YAML"
}

Responses

200 Successful response

application/json object

{
  "valid": true,
  "verdictVersion": "string",
  "authority": {
    "schemaVersion": "verdict.authority/v1",
    "id": "string",
    "type": "string",
    "version": "string",
    "metadata": {},
    "config": {},
    "policy": {}
  },
  "rootVariables": [
    "string"
  ],
  "errors": [
    {
      "stage": "string",
      "message": "string"
    }
  ],
  "warnings": [
    "string"
  ]
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/versionsList immutable authority releases

Parameters

Name	In	Type	Required	Description
`id`	query	string	Yes	-
`limit`	query	integer:int32	No	-
`cursor`	query	string	No	Opaque cursor returned as nextCursor. Preserve it unchanged.

Responses

200 Successful response

application/json object

{
  "items": [
    {
      "releaseId": "string",
      "id": "string",
      "type": "string",
      "version": "string",
      "format": "YAML",
      "sourceDigest": "string",
      "registryUrl": "string",
      "repository": "string",
      "digest": "string",
      "state": "PENDING",
      "createdAt": "2026-01-01T00:00:00Z",
      "publishedAt": "2026-01-01T00:00:00Z",
      "createdByIssuer": "string",
      "createdBySubject": "string",
      "oci": "string"
    }
  ],
  "nextCursor": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/versions/{releaseId}Read an immutable authority release

Parameters

Name	In	Type	Required	Description
`releaseId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "releaseId": "string",
  "id": "string",
  "type": "string",
  "version": "string",
  "format": "YAML",
  "sourceDigest": "string",
  "registryUrl": "string",
  "repository": "string",
  "digest": "string",
  "state": "PENDING",
  "createdAt": "2026-01-01T00:00:00Z",
  "publishedAt": "2026-01-01T00:00:00Z",
  "createdByIssuer": "string",
  "createdBySubject": "string",
  "oci": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/policies/versions/{releaseId}/publishRetry an existing pending OCI publication

Requires tkeeper.policies.publish. Published releases are immutable and digest-pinned. Publishing does not update existing keys.

Parameters

Name	In	Type	Required	Description
`releaseId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "releaseId": "string",
  "id": "string",
  "type": "string",
  "version": "string",
  "format": "YAML",
  "sourceDigest": "string",
  "registryUrl": "string",
  "repository": "string",
  "digest": "string",
  "state": "PENDING",
  "createdAt": "2026-01-01T00:00:00Z",
  "publishedAt": "2026-01-01T00:00:00Z",
  "createdByIssuer": "string",
  "createdBySubject": "string",
  "oci": "string"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

422 Authority document validation failed; errors identifies the failing stage.

application/json object

{
  "valid": true,
  "verdictVersion": "string",
  "authority": {
    "schemaVersion": "verdict.authority/v1",
    "id": "string",
    "type": "string",
    "version": "string",
    "metadata": {},
    "config": {},
    "policy": {}
  },
  "rootVariables": [
    "string"
  ],
  "errors": [
    {
      "stage": "string",
      "message": "string"
    }
  ],
  "warnings": [
    "string"
  ]
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

GET/v1/policies/versions/{releaseId}/sourceRead the exact immutable source document

Parameters

Name	In	Type	Required	Description
`releaseId`	path	string	Yes	-

Responses

200 Successful response

application/json object

{
  "source": "string",
  "format": "YAML"
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

Signatures

POST/v1/signaturesSign an authority command

Command type determines the artifact shape. Discover the exact installed authority command schema with describeAuthority. New saved operations accept no pre-collected proofs.

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	Yes	Required, nonblank owner-scoped key. Repeating the same action and business body replays the saved result. Reuse for a different request returns 409. A transport failure is not permission to submit another mutation.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "command": {
    "type": "arbitrary",
    "authorityId": "string",
    "artifact": {
      "scheme": "string",
      "hash": "NONE",
      "data64": "string"
    }
  },
  "tweak": "string",
  "approvals": {
    "keeperId": 0,
    "nonce": "",
    "timestamp": 1,
    "proofs": []
  }
}

Responses

200 Signature result

application/json object

{
  "type": "string",
  "signature64": "string",
  "generation": 1,
  "imposters": [
    "string"
  ]
}

202 Waiting for approval receipts or an existing operation still in progress.

application/json object

{
  "operationId": "string",
  "type": "string",
  "state": "WAITING_APPROVALS",
  "version": 1,
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "request": {},
  "expiresAt": "2026-01-01T00:00:00Z",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "responseStatus": 1,
  "response": {},
  "errorCode": "string",
  "errorMessage": "string",
  "responseHeaders": {
    "key": [
      "string"
    ]
  },
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "owner": {
    "issuer": "string",
    "subject": "string"
  },
  "keeperOrigin": "string",
  "approvalWorkflow": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/signatures/composeSign and compose an authority result

Command type determines the artifact shape. Discover the exact installed authority command schema with describeAuthority. New saved operations accept no pre-collected proofs.

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	Yes	Required, nonblank owner-scoped key. Repeating the same action and business body replays the saved result. Reuse for a different request returns 409. A transport failure is not permission to submit another mutation.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "command": {
    "type": "arbitrary",
    "authorityId": "string",
    "artifact": {
      "scheme": "string",
      "hash": "NONE",
      "data64": "string"
    }
  },
  "tweak": "string",
  "approvals": {
    "keeperId": 0,
    "nonce": "",
    "timestamp": 1,
    "proofs": []
  }
}

Responses

200 Composed artifact or raw signature fallback

application/json object | object | object | object

{
  "type": "evm.transaction",
  "rawTransaction": "string",
  "transactionHash": "string",
  "generation": 1,
  "imposters": [
    "string"
  ]
}

202 Waiting for approval receipts or an existing operation still in progress.

application/json object

{
  "operationId": "string",
  "type": "string",
  "state": "WAITING_APPROVALS",
  "version": 1,
  "requirements": [
    {
      "threshold": 1,
      "keys": [
        {
          "algorithm": "string",
          "publicKey64": "string",
          "webAuthn": {
            "credentialId": "string",
            "rpId": "string",
            "origins": [
              "string"
            ],
            "userHandle": "string"
          }
        }
      ],
      "details": {
        "policyId": "string",
        "source": "string",
        "threshold": 1
      }
    }
  ],
  "request": {},
  "expiresAt": "2026-01-01T00:00:00Z",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "responseStatus": 1,
  "response": {},
  "errorCode": "string",
  "errorMessage": "string",
  "responseHeaders": {
    "key": [
      "string"
    ]
  },
  "approvalExpiresAt": "2026-01-01T00:00:00Z",
  "serverTime": "2026-01-01T00:00:00Z",
  "owner": {
    "issuer": "string",
    "subject": "string"
  },
  "keeperOrigin": "string",
  "approvalWorkflow": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/signatures/emulateEvaluate the installed authority policy

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "command": {
    "type": "arbitrary",
    "authorityId": "string",
    "artifact": {
      "scheme": "string",
      "hash": "NONE",
      "data64": "string"
    }
  }
}

Responses

200 Authority policy evaluation

application/json object

{
  "decision": "ALLOW",
  "matches": [
    {
      "id": "string",
      "effect": "ALLOW"
    }
  ],
  "approvalRequirements": [
    {
      "policyId": "string",
      "source": "string",
      "threshold": 1,
      "approvers": {
        "key": {
          "id": "string",
          "algorithm": "string",
          "publicKey64": "string",
          "metadata": {
            "key": "string"
          }
        }
      }
    }
  ]
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

POST/v1/signatures/verifyVerify a signature

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "generation": 1,
  "command": {
    "type": "arbitrary",
    "artifact": {
      "scheme": "string",
      "hash": "NONE",
      "data64": "string"
    }
  },
  "signature64": "string"
}

Responses

200 Verification result

application/json object

{
  "valid": true
}

401 Missing, invalid or expired Hub bearer token, or a native Keeper authentication rejection. Inspect X-Hub-Session before asking the user to sign in again.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}

default Request rejected, native Keeper error, or infrastructure failure. A proxy/server failure can have an empty body.

application/json object | object

{
  "status": 1,
  "code": "string",
  "message": "string",
  "outcome": "NOT_SENT"
}