Issuer Directory API Reference

Operations

GET /api/v1/buildinfo

API alias for /buildinfo.json (same payload).

Responses:

GET /buildinfo.json

Image build provenance (module, gitSha, gitCommitTime, imageBuiltAt, branch) for drift detection.

Responses:

GET /issuer-directory/issuers

Lists all issuers registered in the directory for the tenant, with an option to include globally shared issuers. Returns an array of issuer records.

Parameters:

Responses:

POST /issuer-directory/issuers

Registers a new issuer in the directory with the provided ID, display name, slug, contact details, and discovery endpoints. Returns 201 Created with the new issuer record.

Responses:

GET /issuer-directory/issuers/{id}

Returns the full issuer record for a specific issuer ID including metadata, contact information, discovery endpoints, and tags. Returns 404 if not found.

Parameters:

Responses:

PUT /issuer-directory/issuers/{id}

Replaces the mutable fields of an existing issuer record. The route ID must match the body ID. Returns 200 with the updated record.

Parameters:

Responses:

DELETE /issuer-directory/issuers/{id}

Permanently removes an issuer and all associated keys and trust records from the directory. Requires Admin authorization. Returns 204 No Content.

Parameters:

Responses:

GET /issuer-directory/issuers/{issuerId}/keys

Lists all cryptographic keys registered for the specified issuer, optionally including globally shared keys. Returns an array of key records with type, format, and expiry.

Parameters:

Responses:

POST /issuer-directory/issuers/{issuerId}/keys

Adds a new cryptographic key to the specified issuer. Supported key types include Ed25519PublicKey, X509Certificate, and DssePublicKey. Returns 201 Created with the new key record.

Parameters:

Responses:

DELETE /issuer-directory/issuers/{issuerId}/keys/{keyId}

Permanently revokes a cryptographic key from the issuer directory. Requires Admin authorization. Returns 204 No Content.

Parameters:

Responses:

POST /issuer-directory/issuers/{issuerId}/keys/{keyId}/rotate

Replaces an existing issuer key with a new key of the specified type and material, retiring the previous key. Returns 200 with the updated key record.

Parameters:

Responses:

GET /issuer-directory/issuers/{issuerId}/trust

Returns the current trust configuration for the specified issuer including weight, effective trust factors, and any inherited global trust settings.

Parameters:

Responses:

PUT /issuer-directory/issuers/{issuerId}/trust

Creates or updates the trust weight assigned to an issuer for use in VEX consensus calculations. Returns 200 with the updated trust view including effective weight.

Parameters:

Responses:

DELETE /issuer-directory/issuers/{issuerId}/trust

Removes the tenant-specific trust override for the specified issuer, reverting to global defaults if present. Requires Admin authorization. Returns 204 No Content.

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/coverage

Admin coverage read model for operator decision-signing (ADR-025 / OSK-P4): groups the tenant’s decision-signing key history by operator subject and derives each operator’s enrolment state (pending | enrolled | re_enroll_required). Admin-scoped; a projection over append-only history that returns no key material.

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/enroll-invite

Admin-initiated operator enrolment invite: returns a deep-link (and QR payload) to the enrolment ceremony pre-filled with the tenant’s issuer namespace and active compliance provider (ADR-025 / OSK-P3). Non-custodial — the link starts a client-side enrol ceremony; no key is minted server-side.

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/keys

Lists the authenticated operator’s decision-signing keys for the issuer, returning public verification material and lifecycle status. Requires a fresh step-up and the authority:signing-keys.enroll scope.

Parameters:

Responses:

POST /issuer-directory/operator-signing-keys/{issuerId}/keys

Enrols an operator decision-signing public key (ADR-025), binding it to the caller’s subject from the token. Non-custodial: only the public key is accepted; private-key material is rejected. Requires a fresh step-up and the authority:signing-keys.enroll scope. Returns 201 with the key record (pending if dual-control is enabled).

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/keys/subjects/{subjectId}

List the public decision-signing keys enrolled for one operator subject. Intended for authenticated service-side key-presence checks; private key material is never returned.

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/keys/{keyId}

Returns one decision-signing key for service verification, including public verification material and lifecycle status. Requires the IssuerDirectory read policy and returns 404 for missing or non-decision-signing keys.

Parameters:

Responses:

DELETE /issuer-directory/operator-signing-keys/{issuerId}/keys/{keyId}

Revokes an operator decision-signing key. The revoked key stays resolvable for verifying past decisions. Requires a fresh step-up and the authority:signing-keys.enroll scope. Returns 204 No Content.

Parameters:

Responses:

POST /issuer-directory/operator-signing-keys/{issuerId}/keys/{keyId}/approve

Dual-control approval: a second approver (authority:signing-keys.admin) promotes a pending operator decision-signing key to active. The approver must differ from the enroller. Returns 200 with the now-active key record.

Parameters:

Responses:

POST /issuer-directory/operator-signing-keys/{issuerId}/keys/{keyId}/rotate

Rotates the caller’s operator decision-signing key, retiring the previous key and binding the replacement to the same subject. Requires a fresh step-up and the authority:signing-keys.enroll scope. Returns 200 with the new key record.

Parameters:

Responses:

POST /issuer-directory/operator-signing-keys/{issuerId}/provider-change-supersede

Retires active, provider-incompatible DecisionSigning keys for Authority-resolved exception-granting subjects. Retained public keys remain historically resolvable; the configured provider-change grace cutoff controls new-decision verification. A stable operationId returns the original immutable receipt on replay.

Parameters:

Responses: