Skip to main content
POST
Create a new signer

Authorizations

x-api-key
string
header
required

Headers

x-idempotency-key
string<uuid>
required

Unique key to ensure request idempotency. If the same key is used within a certain time window, the original response will be returned instead of executing the request again.

Body

application/json

Request to create a new signer

name
string
required

The signer name

Example:

"Marc"

public_key
string
required

The signer public key. For KEY_TYPE_ES256 this must be a base64-encoded X.509 SubjectPublicKeyInfo (PKIX) for an ECDSA P-256 key. Both PEM-wrapped (with BEGIN/END PUBLIC KEY headers) and raw DER encodings are accepted.

For KEY_TYPE_WEBAUTHN this must be a base64-encoded COSE public key. Only ES256 (EC2 / P-256, COSE alg -7) and RS256 (RSA, 2048-bit minimum, COSE alg -257) keys are supported; other algorithms and curves are rejected. See the WebAuthn & Passkey Signing guide for how each signatures[] entry is then built.

key_type
enum<string>
required

Type of the key

Available options:
ES256,
WEBAUTHN

Response

Signer already registered to you. The submitted public key already belongs to one of your existing signers, so no new signer was created. The response carries that signer's persisted id, public_key and key_type (use the returned key_type to sign — it is authoritative and may differ from the one submitted); name echoes the request. Registration is idempotent: re-running setup returns a usable id instead of an error. A public key held by a different client returns 409 and no details about that signer.

A signer is a public key that can sign intents and it is part of a signer group

id
string
required

KSUID is a 27-character globally unique ID that combines a timestamp with a random component. Used for all entity identifiers in the Dakota platform.

Required string length: 27
Pattern: ^[0-9A-Za-z]{27}$
Example:

"1NFHrqBHb3cTfLVkFSGmHZqdDPi"

name
string
required

The signer name

Example:

"Marc"

public_key
string
required

The signer public key. For KEY_TYPE_ES256 this must be a base64-encoded X.509 SubjectPublicKeyInfo (PKIX) for an ECDSA P-256 key. Both PEM-wrapped (with BEGIN/END PUBLIC KEY headers) and raw DER encodings are accepted.

For KEY_TYPE_WEBAUTHN this must be a base64-encoded COSE public key. Only ES256 (EC2 / P-256, COSE alg -7) and RS256 (RSA, 2048-bit minimum, COSE alg -257) keys are supported; other algorithms and curves are rejected. See the WebAuthn & Passkey Signing guide for how each signatures[] entry is then built.

key_type
enum<string>
required

Type of the key

Available options:
ES256,
WEBAUTHN
client_id
string

KSUID is a 27-character globally unique ID that combines a timestamp with a random component. Used for all entity identifiers in the Dakota platform.

Required string length: 27
Pattern: ^[0-9A-Za-z]{27}$
Example:

"1NFHrqBHb3cTfLVkFSGmHZqdDPi"

removed_at
integer<int64>

Epoch seconds at which this signer was removed from the containing signer group. Present only for entries in a group's removed_members (i.e. when include_removed=true); absent for active members.