Get a Signing key

View .md OpenAPI spec Open in Claude Open in ChatGPT

Deprecated

GET

/v1/keys/{kid}

const url = 'https://app.caprid.com/v1/keys/example';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://app.caprid.com/v1/keys/example \
  --header 'Authorization: Bearer <token>'

GET /v1/namespaces/{namespace}/keys/{kid} for the API key’s only Namespace.

Authorizations

Parameters

Path Parameters

kid

required

string

Responses

200

The key.

application/json

A Signing key in JSON Web Key form, with the scope extension moq relays understand. k is the secret. Anyone holding it can sign tokens within the scope.

object

alg

required

string

Allowed value: HS256

key_ops

required

Array<string>

kty

required

string

Allowed value: oct

required

The HMAC secret, base64url without padding.

string

kid

required

string

scope

required

What a Signing key may sign. put is publish and get is subscribe, as in the token claims. Both are relative to root.

object

root

string

put

Array<string>

get

Array<string>

Example

{
  "alg": "HS256",
  "key_ops": [
    "sign",
    "verify"
  ],
  "kty": "oct",
  "kid": "acme_backend",
  "scope": {
    "root": "acme"
  }
}

400

Sent with a session, or with an API key that doesn’t reach exactly one Namespace. Use the route the message names instead. This route also returns 400 for anything that route would refuse with 400.

application/json

object

error

required

string

Example

{
  "error": "this API key reaches 2 Namespaces, so this route can't tell which one you mean; use /v1/namespaces/{namespace}/keys"
}

401

No valid credential. Missing, expired and revoked credentials all get the same response, and so does an API key whose trial has lapsed. An Agent token from before a claim gets a 401 too, once the claim has made the trial a person’s, with a message saying to get a new token.

application/json

object

error

required

string

Example

{
  "error": "the requested grants exceed the key's scope"
}

Headers

WWW-Authenticate

string

Example

Bearer realm="switchboard"

403

Sent with an API key limited to some Namespaces, to a Namespace outside its limit, or to a route that acts on the Organization as a whole. A limited key can never create API keys.

application/json

object

error

required

string

Example

{
  "error": "this API key is limited to the Namespaces acme-staging, and acme isn't one of them"
}

404

No such thing, or not yours. Another customer’s Organization or Namespace is a 404 too, so nobody can tell which ones exist.

application/json

object

error

required

string

Example

{
  "error": "the requested grants exceed the key's scope"
}