Signer API Reference

Operations

GET /

Responses:

POST /api/v1/anchors/{anchorId}/keys

Add a new signing key to a trust anchor

Adds a new public signing key to the specified trust anchor, recording the addition in the audit log. Returns 201 Created with the updated allowed key IDs and audit log reference. Returns 404 if the anchor is not found. Requires KeyManagement authorization.

Parameters:

Responses:

GET /api/v1/anchors/{anchorId}/keys/history

Get the full key history for a trust anchor

Returns the complete key lifecycle history for a trust anchor including all added, revoked, and expired keys with their timestamps and revocation reasons. Requires KeyManagement authorization.

Parameters:

Responses:

GET /api/v1/anchors/{anchorId}/keys/warnings

Get rotation warnings for a trust anchor

Returns active rotation warnings for a trust anchor such as keys approaching expiry or requiring rotation. Includes the warning type, message, and critical deadline timestamp. Requires KeyManagement authorization.

Parameters:

Responses:

POST /api/v1/anchors/{anchorId}/keys/{keyId}/revoke

Revoke a signing key from a trust anchor

Revokes a specific signing key from a trust anchor with a mandatory reason and optional effective timestamp. Records the revocation in the audit log. Returns the updated allowed and revoked key lists. Requires KeyManagement authorization.

Parameters:

Responses:

GET /api/v1/anchors/{anchorId}/keys/{keyId}/validity

Check if a key was valid at a specific time

Checks whether a specific key was in a valid (non-revoked, non-expired) state at the given timestamp. Defaults to the current time if no signedAt is provided. Used for retrospective signature verification. Requires KeyManagement authorization.

Parameters:

Responses:

GET /api/v1/buildinfo

API alias for /buildinfo.json (same payload).

Responses:

GET /api/v1/ceremonies

List ceremonies with optional filters

Returns a paginated list of signing ceremonies optionally filtered by state, operation type, initiator, or tenant. Supports limit and offset for pagination. Requires ceremony:read authorization.

Parameters:

Responses:

POST /api/v1/ceremonies

Create a new signing ceremony

Initiates a new M-of-N dual-control signing ceremony for key management operations such as key generation, rotation, revocation, or recovery. Returns 201 Created with the ceremony record including required approval threshold and expiry. Requires ceremony:create authorization.

Responses:

GET /api/v1/ceremonies/{ceremonyId}

Get a ceremony by ID

Returns the full ceremony record including operation type, state, approvals received, approval threshold, and expiry. Returns 404 if the ceremony is not found. Requires ceremony:read authorization.

Parameters:

Responses:

DELETE /api/v1/ceremonies/{ceremonyId}

Cancel a pending ceremony

Cancels a pending or partially approved signing ceremony with an optional reason. Returns 204 No Content on success. Returns 409 Conflict if the ceremony has already been executed, expired, or cancelled. Requires ceremony:cancel authorization.

Parameters:

Responses:

POST /api/v1/ceremonies/{ceremonyId}/approve

Submit an approval for a ceremony

Submits a signed approval for a dual-control ceremony. Requires a valid base64-encoded approval signature and optional signing key ID. Returns 409 Conflict on duplicate approval or terminal ceremony state. Requires ceremony:approve authorization.

Parameters:

Responses:

POST /api/v1/ceremonies/{ceremonyId}/execute

Execute an approved ceremony

Executes a fully approved signing ceremony once the approval threshold has been reached. Performs the key operation and records the execution. Returns 409 Conflict if the ceremony is not fully approved, already executed, expired, or cancelled. Requires ceremony:execute authorization.

Parameters:

Responses:

POST /api/v1/signer/sign/dsse

Signs a payload using DSSE (Dead Simple Signing Envelope) with the configured KMS or keyless signing mode. Requires a proof-of-entitlement (PoE) in JWT or mTLS format. Returns the signed DSSE bundle including envelope, certificate chain, signing identity, provider name, algorithm id, optional crypto profile, and signing policy metadata.

Responses:

POST /api/v1/signer/verify/dsse

Verifies a Signer-produced DSSE bundle over the DSSE PAE bytes. For a full bundle, the endpoint resolves its providerName, algorithmId, and signature keyId through the configured crypto registry and accepts standard base64 or base64url payload/signature encoding. Raw {dsse} or bare-envelope input is supported only by the explicit Development/Testing HMAC signer. Returns verified, the successfully verified key id, and an optional failure reason. Broader third-party certificate-chain/transparency-policy verification remains Attestor-owned.

Responses:

GET /api/v1/signer/verify/referrers

Verifies the release integrity of a container image or artifact by digest using the OCI referrers API. Returns whether the artifact has a trusted signature from the configured release signer.

Parameters:

Responses:

GET /buildinfo.json

Image build provenance (module, gitSha, gitCommitTime, imageBuiltAt, branch) for drift detection.

Responses: