Skip to main content
POST
Register a signing key

Authorizations

Authorization
string
header
required

A personal access token (POST /v1/auth/tokens) or a machine identity token (POST /v1/projects/{project_id}/identities/{identity_id}/tokens), both prefixed qumo_pat_. A token's scopes cap what it can do; see Scopes and permissions. A personal token names no organization: on a route whose path names no project or organization, pass ?organization_id=.

Path Parameters

id
string<uuid>
required

The project's id.

Body

application/json
name
string
required

Display name, at most 100 characters.

Required string length: 1 - 100
Example:

"api-server"

public_key
object
required

The public half of an Ed25519 key, as a JWK (RFC 8037).

signed_at
integer<int64>
required

When the registration message was signed, in Unix seconds. Must be within five minutes of the server's clock.

Example:

1793700000

signature
string
required

Ed25519 signature, base64url without padding, over qumo-signing-key-registration:<project id>:<signed_at>, made with the private key.

Example:

"U7nt8Hif0wV7QhxuV_MliNzW3oGhkfZYioliloY1SERUTNwuP7wTYHtGfpD-XKQ71U4ELU_sFxa-aSUTgJ98ew"

prefix
string

A path under the project root that confines the key, e.g. cameras for <organization slug>/<project slug>/cameras. Empty or omitted confines it to the whole project. Segments may not be . or .., or contain spaces, control characters or any of * ? # % \ { }.

Maximum string length: 200
Example:

"cameras"

Response

The key was registered.

A registered signing key.

kid
string
required

The key's RFC 7638 JWK thumbprint, the kid your credentials carry.

Example:

"NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"

project_id
string<uuid>
required

The project the key belongs to.

Example:

"9b1d6e2f-4a3c-4f8b-a7e5-0c9d2b4f6e81"

name
string
required

Display name.

Example:

"api-server"

prefix
string
required

Every path a credential signed with this key grants must lie within this prefix: the project root <organization slug>/<project slug>, or a narrower path under it.

Example:

"acme/live/cameras"

public_key
object
required

The public half of an Ed25519 key, as a JWK (RFC 8037).

state
enum<string>
required

Whether managed relays trust the key.

Available options:
active,
revoked
Example:

"active"

created_at
string<date-time>
required

When the key was registered.

Example:

"2026-10-20T14:03:52Z"

revoked_at
string<date-time> | null
required

When the key was revoked, or null.

Example:

null