Skip to content
Updawg

`POST /v1/orgs/{org}/signing-keys/hand-over`.

POST
/v1/orgs/{org}/signing-keys/hand-over
curl --request POST \
  --url https://api.updawg.net/v1/orgs/example/signing-keys/hand-over \
  --header 'Content-Type: application/json' \
  --data '{ "proof": { "signature": "example", "statement": "example" } }'

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
org
required
string

Organization slug.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
proof
One of:

What updawgctl prove-key printed. Required; optional here only so a missing one is answered after the permission check.

object
signature
required

Base64 Ed25519 signature over updawg-endorsement-v1\0 and statement.

string
statement
required

The statement’s canonical JSON, exactly as signed.

string

Example generated

{
  "proof": {
    "signature": "example",
    "statement": "example"
  }
}

Responses

Section titled “Responses”

202

Section titled “202”

Queued. Updawg’s current key endorses yours, and yours becomes the active key; the list shows it when it lands. From then on every job waits for updawgctl sign.

Media typeapplication/json
object
from
required

The key being replaced.

string

Example generated

{
  "from": "example"
}

400

Section titled “400”

No proof, or one that does not prove the key: wrong organization, too old, not the key endorsing itself, or a signature that does not verify.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

401

Section titled “401”

No session.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

403

Section titled “403”

Not permitted for this role. Or the plan does not include customer-held signing keys (Enterprise): plan-required.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

404

Section titled “404”

No such organization, or not yours — one answer for both.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

409

Section titled “409”

No key to endorse yours with, the organization holds its own key already, this key is already one of the organization’s, or an earlier hand-over failed and is waiting for an operator.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

421

Section titled “421”

The organization’s data is in another region (wrong-region, DAWG-159). detail names that region’s API; send the request there.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

429

Section titled “429”

Over the organization’s request limit. Retry-After says when to try again; RateLimit-Limit is the burst.

Media typeapplication/json
object
detail
string | null
status
required
integer format: int32
title
required
string
type
required
string

Example generated

{
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}