List keys
Publishes the keys attestations are signed with, as a JSON Web Key Set (RFC 7517; Ed25519 keys as RFC 8037 writes them).
GET /v1/principal/keys
| Address | https://api.hanzo.ai/v1/principal/keys |
| Method | GET |
| Operation | get_principal_keys |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Publishes the keys attestations are signed with, as a JSON Web Key Set (RFC 7517; Ed25519 keys as RFC 8037 writes them). Open to anyone: a verifier verifying an agent's statement fetches this once and verifies offline.
A key a rotation retired stays here and signs nothing, so a statement signed before the rotation verifies until it expires.
Request
GET /v1/principal/keys takes no parameters and no body — the credential is the whole request.
Response
| Status | Body | Meaning |
|---|---|---|
200 | principal.JWKS | ok |
default | problem-details | refused |
200 body — 7 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
keys | body | principal.JWK[] | — | |
keys[].alg | body | string | — | Alg is EdDSA. |
keys[].crv | body | string | — | Crv is Ed25519. |
keys[].kid | body | string | — | Kid names the key; a statement's header carries it. |
keys[].kty | body | string | — | Kty is OKP, an octet key pair. |
keys[].use | body | string | — | Use is sig. |
keys[].x | body | string | — | X is the public key, base64url without padding. |
Failure carries the platform error shape — see Errors.
Examples
hanzo has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK.
import { Configuration, PrincipalApi } from 'hanzoai';
const api = new PrincipalApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getPrincipalKeys();from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import PrincipalApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = PrincipalApi(client).get_principal_keys()cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)
resp, _, err := client.PrincipalAPI.GetPrincipalKeys(context.Background()).Execute()
if err != nil {
return err
}use hanzo_client::apis::{configuration::Configuration, principal_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = principal_api::get_principal_keys(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.PrincipalApi;
ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));
var result = new PrincipalApi(client).getPrincipalKeys();The method above is the one at the current release of the document. [email protected] (npm) and [email protected] (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. SDKs →
curl https://api.hanzo.ai/v1/principal/keys \
-H "Authorization: Bearer $HANZO_API_KEY"MCP declares no tool for principal — tools/list on https://api.hanzo.ai/v1/mcp names the products it does reach. Use HTTP or an SDK.
How is this guide?