Get the signing key policy
GET /v1/signing-keys/policy · permission signing-keys:read
Returns the environment's signing key policy: the algorithm of new keys, the automatic rotation interval and the key storage. If the policy was never written, the defaults are returned (RS256, 180 days, wrapped) with ETag: "0" and updated_at: null. The ETag response header carries the version to send as If-Match when updating the policy.
Request
This operation takes no path, query or body fields. The environment comes from the credential.
Response
200 OK with the policy and the ETag header. next_rotation_at is the next automatic rotation (activation of the active key plus the interval); it is null when there is no active key.
{
"algorithm": "RS256",
"rotation_interval_days": 180,
"storage": "wrapped",
"next_rotation_at": "2027-03-04T09:30:00.123456Z",
"updated_at": null
}
Errors
| HTTP | code | When |
|---|---|---|
| 401 | unauthenticated |
The credential is missing, invalid or revoked. |
| 403 | insufficient_permissions |
The credential lacks the required permission. |
| 429 | rate_limited |
The rate limit was exceeded; retry after the Retry-After period. |
| 501 | not_implemented |
The operation is not available in this deployment yet; retrying does not change the result. |
| 503 | service_unavailable |
A dependency is temporarily unavailable; retry after the Retry-After period. |
Example
curl -i https://api.eu.keenauth.com/v1/signing-keys/policy \
-H "Authorization: Bearer $KEENAUTH_SECRET_KEY"