Create keys
Rotates the attestation signing key: a new Ed25519 key is generated, sealed in KMS beside the others, and signs every statement from now on; every earlier key is retired — still published, its private half destroyed.
POST /v1/principal/keys
| Address | https://api.hanzo.ai/v1/principal/keys |
| Method | POST |
| Operation | post_principal_keys |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Rotates the attestation signing key: a new Ed25519 key is generated, sealed in KMS beside the others, and signs every statement from now on; every earlier key is retired — still published, its private half destroyed. SuperAdmin only, on the audit trail before the new set is written, and followed on the trail by a correction if the write does not take. One rotation runs at a time, and one that finds the set rotated under it since it read it is refused (409). The first call provisions the deployment's first key.
Request
The document declares no body for POST /v1/principal/keys. The handler is typed in cloud but its shape is not yet emitted, so the fields are not listed here — ask MCP's describe for post_principal_keys, which answers from the running route.
Response
| Status | Body | Meaning |
|---|---|---|
201 | principal.JWKS | created |
default | problem-details | refused |
201 body — 7 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
keys | body | principal.JWK[] | — | |
keys[].alg | body | string | — | Alg is EdDSA. |
keys[].crv | body | string | — | Crv is Ed25519. |
keys[].kid | body | string | — | Kid names the key; a statement's header carries it. |
keys[].kty | body | string | — | Kty is OKP, an octet key pair. |
keys[].use | body | string | — | Use is sig. |
keys[].x | body | string | — | X is the public key, base64url without padding. |
Failure carries the platform error shape — see Errors.
Examples
hanzo has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK.
import { Configuration, PrincipalApi } from 'hanzoai';
const api = new PrincipalApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postPrincipalKeys();from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import PrincipalApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = PrincipalApi(client).post_principal_keys()cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)
resp, _, err := client.PrincipalAPI.PostPrincipalKeys(context.Background()).Execute()
if err != nil {
return err
}use hanzo_client::apis::{configuration::Configuration, principal_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = principal_api::post_principal_keys(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.PrincipalApi;
ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));
var result = new PrincipalApi(client).postPrincipalKeys();The method above is the one at the current release of the document. [email protected] (npm) and [email protected] (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. SDKs →
curl -X POST https://api.hanzo.ai/v1/principal/keys \
-H "Authorization: Bearer $HANZO_API_KEY"MCP declares no tool for principal — tools/list on https://api.hanzo.ai/v1/mcp names the products it does reach. Use HTTP or an SDK.
How is this guide?