Signer API Reference

Operations

GET /

Responses:

POST /api/v1/anchors/{anchorId}/keys

Add a new signing key to a trust anchor

Adds a new public signing key to the specified trust anchor, recording the addition in the audit log. Returns 201 Created with the updated allowed key IDs and audit log reference. Returns 404 if the anchor is not found. Requires KeyManagement authorization.

Parameters:

Responses:

GET /api/v1/anchors/{anchorId}/keys/history

Get the full key history for a trust anchor

Returns the complete key lifecycle history for a trust anchor including all added, revoked, and expired keys with their timestamps and revocation reasons. Requires KeyManagement authorization.

Parameters:

Responses:

GET /api/v1/anchors/{anchorId}/keys/warnings

Get rotation warnings for a trust anchor

Returns active rotation warnings for a trust anchor such as keys approaching expiry or requiring rotation. Includes the warning type, message, and critical deadline timestamp. Requires KeyManagement authorization.

Parameters:

Responses:

POST /api/v1/anchors/{anchorId}/keys/{keyId}/revoke

Revoke a signing key from a trust anchor

Revokes a specific signing key from a trust anchor with a mandatory reason and optional effective timestamp. Records the revocation in the audit log. Returns the updated allowed and revoked key lists. Requires KeyManagement authorization.

Parameters:

Responses:

GET /api/v1/anchors/{anchorId}/keys/{keyId}/validity

Check if a key was valid at a specific time

Checks whether a specific key was in a valid (non-revoked, non-expired) state at the given timestamp. Defaults to the current time if no signedAt is provided. Used for retrospective signature verification. Requires KeyManagement authorization.

Parameters:

Responses:

GET /api/v1/buildinfo

API alias for /buildinfo.json (same payload).

Responses:

GET /api/v1/ceremonies

List ceremonies with optional filters

Returns a paginated list of signing ceremonies optionally filtered by state, operation type, initiator, or tenant. Supports limit and offset for pagination. Requires ceremony:read authorization.

Parameters:

Responses:

POST /api/v1/ceremonies

Create a new signing ceremony

Initiates a new M-of-N dual-control signing ceremony for key management operations such as key generation, rotation, revocation, or recovery. Returns 201 Created with the ceremony record including required approval threshold and expiry. Requires ceremony:create authorization.

Responses:

GET /api/v1/ceremonies/{ceremonyId}

Get a ceremony by ID

Returns the full ceremony record including operation type, state, approvals received, approval threshold, and expiry. Returns 404 if the ceremony is not found. Requires ceremony:read authorization.

Parameters:

Responses:

DELETE /api/v1/ceremonies/{ceremonyId}

Cancel a pending ceremony

Cancels a pending or partially approved signing ceremony with an optional reason. Returns 204 No Content on success. Returns 409 Conflict if the ceremony has already been executed, expired, or cancelled. Requires ceremony:cancel authorization.

Parameters:

Responses:

POST /api/v1/ceremonies/{ceremonyId}/approve

Submit an approval for a ceremony

Submits a signed approval for a dual-control ceremony. Requires a valid base64-encoded approval signature and optional signing key ID. Returns 409 Conflict on duplicate approval or terminal ceremony state. Requires ceremony:approve authorization.

Parameters:

Responses:

POST /api/v1/ceremonies/{ceremonyId}/execute

Execute an approved ceremony

Executes a fully approved signing ceremony once the approval threshold has been reached. Performs the key operation and records the execution. Returns 409 Conflict if the ceremony is not fully approved, already executed, expired, or cancelled. Requires ceremony:execute authorization.

Parameters:

Responses:

POST /api/v1/signer/sign/dsse

Signs exactly one DSSE payload shape with the configured KMS or keyless mode: either predicateType plus predicate, or directPayload. A predicate request supplies exactly one producer identity as either typed producer or the legacy scannerImageDigest fallback. A direct payload requires typed producer and forbids predicateType, predicate, and scannerImageDigest. Subject and PoE are required for both shapes. Requires proof of entitlement in JWT or mTLS format and returns the signed envelope, certificate chain, and signing policy metadata.

Parameters:

Responses:

POST /api/v1/signer/verify/dsse

Verifies a DSSE envelope signature against the configured signing key. Accepts the full bundle or a raw DSSE envelope. Returns a verification result indicating whether the signature matches the configured key ID.

Responses:

GET /api/v1/signer/verify/referrers

Verifies the release integrity of a container image or artifact by digest using the OCI referrers API. Returns whether the artifact has a trusted signature from the configured release signer.

Parameters:

Responses:

GET /buildinfo.json

Image build provenance (module, gitSha, gitCommitTime, imageBuiltAt, branch) for drift detection.

Responses:

GET /doctor/checks

Responses:

POST /internal/plugins/probe

Probe Signer crypto provider readiness.

Responses:

GET /internal/plugins/status

Return canonical Signer crypto provider plugin status.

Responses: