Skip to content
Updawg

`POST /v1/orgs/{org}/signing-keys/endorse`.

POST
/v1/orgs/{org}/signing-keys/endorse
curl --request POST \
  --url https://api.updawg.net/v1/orgs/example/signing-keys/endorse \
  --header 'Content-Type: application/json' \
  --data '{ "endorsement": { "signature": "example", "statement": "example" }, "proof": { "signature": "example", "statement": "example" } }'

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
org
required
string

Organization slug.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
endorsement
One of:

Your active key endorsing the next one, from updawgctl endorse. Required; optional here only so a missing one is answered after the permission check.

object
signature
required

Base64 Ed25519 signature over updawg-endorsement-v1\0 and statement.

string
statement
required

The statement’s canonical JSON, exactly as signed.

string
proof
One of:

The next key proving its holder can sign with it, from updawgctl prove-key. Required, for the reason a hand-over requires one.

object
signature
required

Base64 Ed25519 signature over updawg-endorsement-v1\0 and statement.

string
statement
required

The statement’s canonical JSON, exactly as signed.

string

Example generated

{
  "endorsement": {
    "signature": "example",
    "statement": "example"
  },
  "proof": {
    "signature": "example",
    "statement": "example"
  }
}

Responses

Section titled “Responses”

200

Section titled “200”

Your next key is the active one, endorsed by the one before, which is retiring. Hosts adopt it at their next certificate renewal; jobs wait for it in updawgctl sign from now on. Retire the previous key once every host pins the new one.

Media typeapplication/json
object
from
required

The key it replaced, now retiring.

string
key
required

The new active key.

string

Example generated

{
  "from": "example",
  "key": "example"
}

400

Section titled “400”

No endorsement or proof, or one that does not hold: wrong organization, too old, about different keys, or a signature that does not verify under your active key.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

401

Section titled “401”

No session.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

403

Section titled “403”

Not permitted for this role. Or the plan does not include customer-held signing keys (Enterprise): plan-required.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

404

Section titled “404”

No such organization, or not yours — one answer for both.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

409

Section titled “409”

No active key, Updawg holds it (rotate it, or hand over to yours), the endorsement is by a key that is not the active one, or the next key is already one of the organization’s.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

421

Section titled “421”

The organization’s data is in another region (wrong-region, DAWG-159). detail names that region’s API; send the request there.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

429

Section titled “429”

Over the organization’s request limit. Retry-After says when to try again; RateLimit-Limit is the burst.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}