Publish Pub Keyset

View as Markdown

Publish one JWK for the given tenant and kid. Publishers (e.g. SPIRE) use this to advertise a public key for verification or encryption.

Direction: Publish (send)

Channel

spiffe-exchange/v1/pub-keysets/tenant/{tenant_domain}/kid/{kid}

Parameters

ParameterDescription
tenant_domainTenant domain identifier (e.g. tenant namespace or domain name).
kidKey ID (kid) for this key; aligns with JWS/JWE header kid.

Message: JWK (RFC 7517)

Content Type: application/json

Payload

NameTypeRequiredDescription
ktystringYesKey type (e.g. RSA, EC, OKP). Values: RSA, EC, OKP
usestringNoPublic key use (sig, enc, or omitted). Values: sig, enc
key_opsarray<string>NoKey operations (e.g. verify, encrypt).
algstringNoAlgorithm (e.g. ES256, RS256, EdDSA).
kidstringNoKey ID; should match the topic kid when present.
nstringNoRSA modulus (Base64url).
estringNoRSA public exponent (Base64url).
crvstringNoElliptic curve (e.g. P-256, P-384).
xstringNoEC x coordinate (Base64url).
ystringNoEC y coordinate (Base64url).
1{
2 "kty": "RSA",
3 "use": "sig",
4 "key_ops": [
5 "string"
6 ],
7 "alg": "string",
8 "kid": "string",
9 "n": "string",
10 "e": "string",
11 "crv": "string",
12 "x": "string",
13 "y": "string"
14}