API ReferenceTenant Identity

Retrieve SPIFFE JWKS for current Org

View as Markdown

SPIFFE trust-domain JWKS — same key material as the OIDC JWKS but with use: jwt-svid for SPIFFE-native verifiers. No authentication required.

Not-configured and malformed-body behavior matches the OIDC JWKS endpoint.

Path parameters

orgstringRequired
Name of the Org
siteIDstringRequiredformat: "uuid"
ID of the Site

Response

SPIFFE JWKS document.
keyslist of objects

RFC 7517 JWK members. NICo currently emits only EC keys (kty: EC, crv: P-256, alg: ES256); the schema is intentionally open-ended so that future algorithms can be added without a spec change.

Errors

404
Not Found Error
500
Internal Server Error
502
Bad Gateway Error
503
Service Unavailable Error