Audit public keys

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "alg": "ES256",
      "use": "sig",
      "kid": "projects/alentra/locations/global/keyRings/audit/cryptoKeys/sign/cryptoKeyVersions/3",
      "x": "...",
      "y": "..."
    }
  ]
}

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "alg": "ES256",
      "use": "sig",
      "kid": "projects/alentra/locations/global/keyRings/audit/cryptoKeys/sign/cryptoKeyVersions/3",
      "x": "...",
      "y": "..."
    }
  ]
}

GET https://api.alentra.app/.well-known/alentra-audit-jwks.json · Public · CORS-readable

Returns Alentra’s current audit-signing public key and explicitly retained verification keys. Use the key whose kid exactly matches alentra_signature.kid in the audit record. The endpoint is cacheable for five minutes; refresh it when a new kid appears. alentra_signature is a detached audit field, not a JWS object. Its value is a base64url-encoded ASN.1 DER ECDSA signature over the 32-byte record digest.

object[]

Show EC signing key

string

EC.

string

P-256.

string

ES256.

string

sig.

string

Exact Google Cloud KMS crypto-key-version resource recorded on audit signatures.

string

Base64url P-256 X coordinate.

string

Base64url P-256 Y coordinate.

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "alg": "ES256",
      "use": "sig",
      "kid": "projects/alentra/locations/global/keyRings/audit/cryptoKeys/sign/cryptoKeyVersions/3",
      "x": "...",
      "y": "..."
    }
  ]
}

The public key proves that the holder of Alentra’s configured signing key signed the canonical audit hash. It is separate from the symmetric key used to encrypt private data. The endpoint makes no claim about whether a particular deployed key version is software- or hardware-protected. See Get an audit record and offline verification.

Overview

Sessions

Audits

Discovery

Webhooks