TKeeperDevelopers
LibraryGitHub

OpenAPI

LLM index

Download OpenAPI specification describes the main HTTP routes, request and response models, errors, authentication headers, permissions, and algorithm enums. The mandate module documents its issuance endpoints and credential header.

Use it to check the wire format when building a client. Report discrepancies between the SDK, server, and specification as API contract bugs.

Approvals

POST/v1/keeper/approvals/preparePrepare WebAuthn approvals for an operation

Requires primary authentication and the permission for the enclosed operation. Evaluates the operation and current policies without consuming its approval nonce. The operation must contain keeperId, nonce, timestamp, and an empty proofs list. Returns a signed challenge binding and browser options for each WebAuthn credential. Authority requirements may pin signature or WebAuthn credentials through approver refs.

Request Body

Required: Yes

application/json object

{
  "type": "string",
  "operation": {}
}

Responses

200 Operation-bound WebAuthn challenge and browser options

application/json object

{
  "hashForSigning64": "string",
  "binding": {
    "payload": {
      "keeperId": 1,
      "operationType": "string",
      "hashForSigning64": "string",
      "generation": 1,
      "requirementsHash64": "string",
      "challenge": "string",
      "issuedAt": 1,
      "expiresAt": 1
    },
    "signature": {
      "version": 1,
      "algorithm": "string",
      "fingerprint": "string",
      "signature64": "string"
    }
  },
  "webAuthn": [
    {
      "fingerprint": "string",
      "publicKey": {}
    }
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Approvers

GET/v1/keeper/approversList all matching approver versions

Requires tkeeper.approvers.read. Filters use exact matches and combine with AND. Metadata filters are query parameters named metadata.<key>, for example metadata.team=treasury. URL-encode query names and values. Duplicate query parameters are rejected. Versions sort by full ref. Pagination is not a snapshot; concurrent registrations and metadata changes can affect subsequent pages. The cursor is the last returned full ref.

Parameters

NameInTypeRequiredDescription
idquerystringNo-
typequeryenum(SIGNATURE, WEBAUTHN)No-
cursorquerystringNonextCursor from the preceding page; must belong to id when that filter is set.
limitqueryintegerNo-

Responses

200 Matching versions; nextCursor is null on the final page.

application/json object

{
  "items": [
    {
      "id": "string",
      "ref": "string",
      "credential": {
        "version": 1,
        "type": "SIGNATURE",
        "algorithm": "string",
        "publicKey64": "string"
      },
      "metadata": {
        "key": "string"
      },
      "createdAt": 1,
      "updatedAt": 1,
      "metadataRevision": 1
    }
  ],
  "nextCursor": "string"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
POST/v1/keeper/approversRegister a signature approver version

Requires tkeeper.approvers.register independently of read and metadata permissions. Available on any initialized, unsealed Keeper. Validates and normalizes the public key with the installed signature providers before computing the immutable ref. A new credential under the same id creates another version. An identical registration returns the existing record without replacing its metadata. A normalized key already registered under another id is a conflict. Registration does not grant approval rights. Duplicate JSON keys, unknown fields, null metadata, and scalar coercions are rejected. Every current member must be ready and independently authorize and prepare the request. Success requires persistence on every member. A 503 can leave durable reservations or a fully confirmed delivery that surviving members complete after writer failure.

Request Body

Required: Yes

application/json object

{
  "id": "string",
  "credential": {
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  }
}

Responses

200 Exact approver version with its current metadata.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

201 Exact approver version with its current metadata.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

409 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

503 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/approvers/{ref}Read an exact approver version

Requires tkeeper.approvers.read. Reads this Keeper's replica of the distributed core registry.

Parameters

NameInTypeRequiredDescription
refpathstringYesURL-encoded full ref, including id, sha256 tag, and lowercase digest. Bare ids are invalid.

Responses

200 Exact approver version with its current metadata.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

404 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
PUT/v1/keeper/approvers/{ref}/metadataReplace metadata with revision checking

Requires tkeeper.approvers.metadata independently of read and register permissions. Replaces the complete metadata map; an empty map clears it. Ref, credential, and createdAt remain unchanged. Requires exactly one strong quoted numeric If-Match value matching metadataRevision. Weak validators, wildcards, lists, and stale revisions return 412; a missing If-Match returns 428. Each successful update increments metadataRevision. Every current member must be ready and independently authorize and prepare the change. Success requires persistence on every member; delivery of fully confirmed changes survives writer failure.

Parameters

NameInTypeRequiredDescription
refpathstringYesURL-encoded full ref, including id, sha256 tag, and lowercase digest. Bare ids are invalid.
If-MatchheaderstringYes-

Request Body

Required: Yes

application/json object

{
  "metadata": {
    "key": "string"
  }
}

Responses

200 Exact approver version with its current metadata.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

404 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

412 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

428 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

503 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
POST/v1/keeper/approvers/webauthn/registration/finishVerify and register a WebAuthn approver

Requires primary authentication and the invitation in the request body, with no additional permission. The recipient may have a different JWT subject from the registrar. The writer independently validates a forwarded primary token. Operation mandates cannot authorize finish. The public registrationId cannot replace the invitation. Accepts standard browser credential JSON. Every current member independently verifies the ceremony and prepares the same immutable record before commit. Success requires persistence on every member. An identical completed retry within the session deadline returns 200; a different response for that session is rejected. New confirmations cannot be issued after the deadline. An already complete all-member confirmation remains deliverable after expiry or writer failure. Partial signed reservations retain their protective locks until coordinated settlement; TTL does not remove them.

Request Body

Required: Yes

application/json object

{
  "invitation": "string",
  "credential": {
    "id": "string",
    "rawId": "string",
    "type": "public-key",
    "response": {
      "clientDataJSON": "string",
      "attestationObject": "string",
      "transports": [
        "string"
      ]
    }
  }
}

Responses

200 Exact approver version with its current metadata.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

201 Exact approver version with its current metadata.

application/json object

{
  "id": "string",
  "ref": "string",
  "credential": {
    "version": 1,
    "type": "SIGNATURE",
    "algorithm": "string",
    "publicKey64": "string"
  },
  "metadata": {
    "key": "string"
  },
  "createdAt": 1,
  "updatedAt": 1,
  "metadataRevision": 1
}

400 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

503 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
POST/v1/keeper/approvers/webauthn/registration/optionsStart WebAuthn approver registration

Requires primary authentication and tkeeper.approvers.register. Every current member must be ready. The session pins the actor, id, metadata, configured RP, origins and deadline, and is mirrored to every member before success. Returns a single-use bearer invitation for the credential holder to finish with their own valid primary token, including through another peer. TTL defaults to five minutes and cannot exceed ten minutes. The RP and exact frontend origins must be configured on every member. Registration requires ES256, user presence and user verification.

Request Body

Required: Yes

application/json object

{
  "id": "string",
  "metadata": {
    "key": "string"
  }
}

Responses

200 Registrar-bound session, bearer invitation and browser creation options with Base64url binary fields.

application/json object

{
  "registrationId": "string",
  "invitation": "string",
  "expiresAt": 1,
  "publicKey": {}
}

429 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

503 Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Audit

POST/v1/keeper/audit/verifyVerify one signed audit line

Request Body

Required: Yes

application/json object

{
  "event": {
    "id": "string",
    "peerId": 1,
    "integrityKeyVersion": 1,
    "timestamp": 1,
    "event": "string"
  },
  "signature": "string"
}

Responses

200 Verification result

application/json object

{
  "valid": true
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
POST/v1/keeper/audit/verify/batchVerify a batch of signed audit lines

Request Body

Required: Yes

application/json object

{
  "logs": []
}

Responses

200 Verification results by event id

application/json object

{
  "key": {
    "valid": true
  }
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Inventory

GET/v1/keeper/compliance/inventoryList asset inventory

Parameters

NameInTypeRequiredDescription
logicalIdquerystringNo-
historicalquerybooleanNo-
lastSeenquerystringNo-
assetOwnerquerystringNo-
limitqueryinteger:int32No-

Responses

200 Asset inventory page

application/json object

{
  "inventory": {
    "generatedAt": 1,
    "peerId": 1,
    "threshold": 1,
    "totalPeers": 1,
    "items": [
      {
        "logicalId": "string",
        "status": "ACTIVE",
        "currentGeneration": 1,
        "authorities": [
          {
            "id": "string",
            "oci": "string"
          }
        ],
        "createdAt": 1,
        "updatedAt": 1,
        "hasActiveKey": true,
        "tampered": true
      }
    ]
  },
  "nextCursor": "string",
  "hasMore": true
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Consistency

POST/v1/keeper/consistency/fixTry to repair key consistency

Parameters

NameInTypeRequiredDescription
keyIdquerystringYes-

Responses

200 Consistency verdict

application/json object

{
  "verdict": "OK",
  "targetGeneration": 1,
  "versions": {
    "key": {
      "activeGen": 1,
      "pendingGen": 1
    }
  }
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

ControlPlane

GET/v1/keeper/control/audit/sinksGet audit sink status

Responses

200 Audit sink status

application/json object

{
  "enabled": true,
  "sinks": [
    {
      "id": "string",
      "available": true
    }
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/control/auth/configGet control-plane authentication configuration

Responses

200 Control-plane authentication configuration

application/json object | object

{
  "id": "TOKEN",
  "header": "string"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/control/capabilitiesGet capabilities exposed by installed cryptographic platforms

Responses

200 Runtime control-plane capabilities

application/json object

{
  "algorithms": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/control/identitiesList active identities the caller may sign with

Requires primary authentication and an initialized, unsealed Keeper. Includes only active, untampered identities with key material and tkeeper.key.{keyId}.sign permission. No inventory permission is required. The result does not authorize a command; signing still evaluates the current authority, policy and approval requirements.

Parameters

NameInTypeRequiredDescription
lastSeenquerystringNoKey id returned as nextCursor by the previous page.
limitqueryintegerNo-

Responses

200 Permitted signing identities

application/json object

{
  "items": [
    {
      "keyId": "string",
      "algorithm": "string",
      "generation": 1,
      "authorities": [
        "string"
      ]
    }
  ],
  "nextCursor": "string"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/control/identities/authorityDescribe an authority attached to a permitted identity

Requires primary authentication and an initialized, unsealed Keeper. The identity must be active, untampered and have key material. Only an authority attached to its current generation may be described. commandSchema describes the complete command object, including type, authorityId and artifact; it does not evaluate policy.

Parameters

NameInTypeRequiredDescription
keyIdquerystringYes-
authorityIdquerystringYes-

Responses

200 Attached authority and command schema

application/json object

{
  "id": "string",
  "type": "string",
  "version": "string",
  "description": "string",
  "commandSchema": {}
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/control/meGet authenticated subject

Responses

200 Authenticated subject

application/json object

{
  "subject": "string",
  "actor": "string",
  "permissions": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/control/systemGet control-plane cluster status

Responses

200 Cluster status

application/json object

{
  "id": "string",
  "state": "READY",
  "threshold": 1,
  "totalPeers": 1,
  "peers": {
    "key": "READY"
  }
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Keys

POST/v1/keeper/destroyDestroy one key generation

Destroys a historical key generation. Mono mode is local-only and allows any non-current generation. Threshold mode coordinates across peers and requires the generation to be at least two generations behind the active one.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "generation": 1,
  "approvals": {
    "keeperId": 0,
    "nonce": "",
    "timestamp": 1,
    "proofs": []
  }
}

Responses

204 Generation destroyed

- -

299 Threshold destroy committed by quorum, but not all peers

- -

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/publicKeyGet public key

Read-only key operation that remains available in recovery mode for generation comparison.

Parameters

NameInTypeRequiredDescription
keyIdquerystringYes-
generationqueryinteger:int32No-
tweakquerystringNo-

Responses

200 Public key

application/json object

{
  "data64": "string"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

ECIES

POST/v1/keeper/ecies/decryptDecrypt ECIES ciphertext

Decrypts in the current quorum mode. Mono mode decrypts locally. Threshold mode collects peer partial decrypts and verifies DLEQ proofs.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "algorithm": "AES_GCM",
  "generation": 1,
  "ciphertext64": "string"
}

Responses

200 Plaintext

application/json object

{
  "plaintext64": "string",
  "imposters": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
POST/v1/keeper/ecies/encryptEncrypt with ECIES public key

Encryption uses the public key and does not require peer participation.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "algorithm": "AES_GCM",
  "plaintext64": "string",
  "tweak": "string"
}

Responses

200 Ciphertext

application/json object

{
  "ciphertext64": "string",
  "generation": 1
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

DryRun

POST/v1/keeper/emulateEvaluate an authority command without executing it

Requires the optional `dry-run` feature. Resolves the key authority and evaluates its policy without signing, consuming approvals, or mutating key state. `ALLOW_WITH_REQUIREMENTS` includes every four-eye approval requirement needed by the authority policy.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "command": {
    "type": "arbitrary",
    "authorityId": "string",
    "artifact": {
      "scheme": "string",
      "hash": "NONE",
      "data64": "string"
    }
  }
}

Responses

200 Authority policy evaluation

application/json object

{
  "decision": "ALLOW",
  "matches": [
    {
      "id": "string",
      "effect": "ALLOW"
    }
  ],
  "approvalRequirements": [
    {
      "policyId": "string",
      "source": "string",
      "threshold": 1,
      "approvers": {
        "key": {
          "id": "string",
          "algorithm": "string",
          "publicKey64": "string",
          "metadata": {
            "key": "string"
          }
        }
      }
    }
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Expiration

GET/v1/keeper/expiresList expiring key policy entries

Supply either a positive `windowSec`, or `to` with optional `from`. `windowSec` cannot be combined with `from` or `to`, and `from` cannot exceed `to`.

Parameters

NameInTypeRequiredDescription
typequeryenum(apply, process)Yes-
limitqueryinteger:int32No-
cursorquerystringNo-
windowSecqueryinteger:int64No-
fromqueryinteger:int64No-
toqueryinteger:int64No-

Responses

200 Expiration page

application/json object

{
  "items": [
    {
      "type": "APPLY",
      "logicalId": "string",
      "generation": 1,
      "expiresAt": 1
    }
  ],
  "next": "string"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/expires/applyList keys with apply policy expiring in a window

Parameters

NameInTypeRequiredDescription
limitqueryinteger:int32No-
cursorquerystringNo-
windowSecqueryinteger:int64Yes-

Responses

200 Expiration page

application/json object

{
  "items": [
    {
      "type": "APPLY",
      "logicalId": "string",
      "generation": 1,
      "expiresAt": 1
    }
  ],
  "next": "string"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/expires/expiredList expired key policy entries

Parameters

NameInTypeRequiredDescription
typequeryenum(apply, process)Yes-
limitqueryinteger:int32No-
cursorquerystringNo-

Responses

200 Expiration page

application/json object

{
  "items": [
    {
      "type": "APPLY",
      "logicalId": "string",
      "generation": 1,
      "expiresAt": 1
    }
  ],
  "next": "string"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/expires/processList keys with process policy expiring in a window

Parameters

NameInTypeRequiredDescription
limitqueryinteger:int32No-
cursorquerystringNo-
windowSecqueryinteger:int64Yes-

Responses

200 Expiration page

application/json object

{
  "items": [
    {
      "type": "APPLY",
      "logicalId": "string",
      "generation": 1,
      "expiresAt": 1
    }
  ],
  "next": "string"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Integrity

POST/v1/keeper/integrity/rotateRotate audit integrity key

Rotates this peer's audit and internal-response integrity key. Restart every peer after rotation so process-local peer key pins are re-enrolled.

Responses

204 Integrity key rotated

- -

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

System

GET/v1/keeper/peerIdGet local peer id

Responses

200 Peer id

application/json object

{
  "serviceId": 1,
  "result": 1
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/pingLightweight readiness status

Responses

200 Readiness flag

application/json object

{
  "ready": true,
  "peerId": 1,
  "threshold": 1,
  "total": 1
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/system/healthLiveness probe

Responses

204 Service is up

- -

POST/v1/keeper/system/initInitialize keeper

Writes keeper identity and quorum settings into the sealed store. `threshold=1,total=1` initializes mono mode. `threshold>1` initializes threshold/MPC mode.

Request Body

Required: Yes

application/json object

{
  "peerId": 1,
  "threshold": 1,
  "total": 1
}

Responses

200 Provider initialization data

application/json object

{
  "threshold": 1,
  "total": 1,
  "shares64": [
    "string"
  ]
}

204 Initialized without provider payload

- -

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/system/readyReadiness probe

Responses

204 Keeper is unsealed

- -

503 Keeper is not ready

- -

POST/v1/keeper/system/sealSeal keeper

Responses

204 Keeper sealed

- -

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/system/statusGet keeper status

Responses

200 Keeper status

application/json object

{
  "sealedBy": "string",
  "state": "UNINITIALIZED",
  "progress": {
    "ready": true
  }
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v1/keeper/system/unsealUnseal with the configured automatic seal provider

Responses

200 Unseal progress

application/json object | object

{
  "ready": true
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
POST/v1/keeper/system/unsealSubmit unseal shares

Request Body

Required: Yes

application/json object | object

Responses

200 Unseal progress

application/json object | object

{
  "ready": true
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
GET/v2/keeper/configGet quorum settings, loaded features, authority types and seal provider

Requires primary authentication without an additional permission. Available after initialization, including while sealed or waiting for a promotion restart. Threshold and total reflect the current stored quorum. Features are sorted, distinct ids of loaded KeeperModule implementations; cryptographic platforms and build aggregation projects are not features. Does not return private provider or server configuration.

Responses

200 Current Keeper configuration

application/json object

{
  "threshold": 1,
  "total": 1,
  "features": [
    "core",
    "ecies",
    "mandate"
  ],
  "authorities": [
    "arbitrary",
    "custom"
  ],
  "sealProvider": "shamir"
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Recovery

POST/v1/keeper/recovery/recoverRebuild key-scoped state on this peer

Call this endpoint on the damaged keeper. The keeper asks exactly `threshold` remote helpers for the key description, requires them to agree on the algorithm and current generation, and selects the matching recovery flow locally. Available only when the artifact includes the corresponding recovery feature and every participating keeper runs with `keeper.recovery=true`. Supports any configured quorum with `1 < threshold < total`. All non-destroyed generations must belong to one crypto platform; mixed ECC/PQC rotation history fails closed without installing a partial recovery. After all operator-selected helpers agree, the target discards and atomically rebuilds the logical key's shares, metadata, policies, destroy state, public side-state, and derived indexes.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "helperIds": [
    1
  ]
}

Responses

200 All non-destroyed generations are present and verified on the target peer

application/json object

{
  "keyId": "string",
  "algorithm": "string",
  "targetPeerId": 1,
  "currentGeneration": 1,
  "recoveredGenerations": [
    1
  ],
  "helpers": [
    1
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Composition

POST/v2/keeper/composeSign and compose an artifact

Uses the same request, permission, authority, policy, approval, and signing checks as `/v2/keeper/sign`. EVM, TRON, XRP, and Solana commands return signed transactions. AP2 and MC Intent commands return payment credentials. Types without a composer, including Bitcoin and X.509, return `CalculatedSignature`. Composition does not broadcast or submit the result.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "command": {
    "type": "arbitrary",
    "authorityId": "string",
    "artifact": {
      "scheme": "string",
      "hash": "NONE",
      "data64": "string"
    }
  },
  "tweak": "string",
  "approvals": {
    "keeperId": 0,
    "nonce": "",
    "timestamp": 1,
    "proofs": []
  }
}

Responses

200 Composed artifact or raw signature fallback

application/json object | object | object | object

{
  "type": "evm.transaction",
  "rawTransaction": "string",
  "transactionHash": "string",
  "generation": 1,
  "imposters": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

DKG

POST/v2/keeper/dkgCreate, rotate, or refresh a key generation

Runs the key lifecycle operation in the current quorum mode. Mono mode manages full key material locally. Threshold mode runs distributed key generation across peers.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "algorithm": "string",
  "authorities": [
    {
      "id": "string",
      "oci": "string"
    }
  ],
  "mode": "CREATE"
}

Responses

204 Lifecycle operation completed

- -

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Quorum

POST/v2/keeper/quorum/promotePromote mono keeper into threshold quorum

Promotes a mono keeper into a threshold quorum. Target peers must already be initialized, unsealed, and configured with the requested threshold and total. The promoted keeper becomes peer 1 and must be restarted before normal operations continue.

Request Body

Required: Yes

application/json object

{
  "threshold": 1,
  "total": 1
}

Responses

200 Promotion completed; restart the keeper before normal operations

application/json object

{
  "peerId": 1,
  "threshold": 1,
  "total": 1,
  "promotedKeys": 1,
  "restartRequired": true
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

Signing

POST/v2/keeper/signSign in the current quorum mode

Materializes the command, evaluates key controls, and signs using the current quorum mode. Mono mode signs locally. Threshold mode uses FROST or GG20.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "command": {
    "type": "arbitrary",
    "authorityId": "string",
    "artifact": {
      "scheme": "string",
      "hash": "NONE",
      "data64": "string"
    }
  },
  "tweak": "string",
  "approvals": {
    "keeperId": 0,
    "nonce": "",
    "timestamp": 1,
    "proofs": []
  }
}

Responses

200 Signature result

application/json object

{
  "type": "string",
  "signature64": "string",
  "generation": 1,
  "imposters": [
    "string"
  ]
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}
POST/v2/keeper/sign/verifyVerify signature

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "generation": 1,
  "command": {
    "type": "arbitrary",
    "artifact": {
      "scheme": "string",
      "hash": "NONE",
      "data64": "string"
    }
  },
  "signature64": "string"
}

Responses

200 Verification result

application/json object

{
  "valid": true
}

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}

TrustedDealer

POST/v2/keeper/storage/storeImport key material through trusted dealer flow

Imports existing private key material into the current quorum mode. Mono mode stores the key locally. Threshold mode splits the key into peer shares and stores commitments.

Request Body

Required: Yes

application/json object

{
  "keyId": "string",
  "algorithm": "string",
  "authorities": [
    {
      "id": "string",
      "oci": "string"
    }
  ],
  "value64": "string"
}

Responses

200 Key material stored

- -

default Error response

application/json object

{
  "error": "KEEPER_ALREADY_INITIALIZED",
  "details": "string",
  "imposters": [
    "string"
  ],
  "dead": [
    "string"
  ]
}