# Get the signing key policy

`GET /v1/signing-keys/policy` · permission `signing-keys:read`

Returns the environment's signing key policy: the algorithm of new keys, the automatic rotation interval and the key storage. If the policy was never written, the defaults are returned (`RS256`, 180 days, `wrapped`) with `ETag: "0"` and `updated_at: null`. The `ETag` response header carries the version to send as `If-Match` when [updating the policy](/docs/api/management/signing-keys/update-policy).

## Request

This operation takes no path, query or body fields. The environment comes from the credential.

## Response

`200 OK` with the policy and the `ETag` header. `next_rotation_at` is the next automatic rotation (activation of the active key plus the interval); it is `null` when there is no active key.

```json
{
  "algorithm": "RS256",
  "rotation_interval_days": 180,
  "storage": "wrapped",
  "next_rotation_at": "2027-03-04T09:30:00.123456Z",
  "updated_at": null
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 501 | `not_implemented` | The operation is not available in this deployment yet; retrying does not change the result. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -i https://api.eu.keenauth.com/v1/signing-keys/policy \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```