---
title: "Get delegated access encryption public key for an environment"
method: GET
path: "/sdk/{environmentId}/waas/delegatedAccess/encryptionPublicKey"
tags: ["Waas"]
---

# Get delegated access encryption public key for an environment

`GET /sdk/{environmentId}/waas/delegatedAccess/encryptionPublicKey`

Fetches the encryption public key used for delegated access in a WAAS environment.
By default, returns only the latest active key.

## Path parameters

- `environmentId` string, required

## Response `200`

Encryption public key fetched successfully

- DelegatedAccessEncryptionPublicKeyResponse
  - `key` DelegatedAccessEncryptionPublicKey, required
    - `id` string, required
    - `projectEnvironmentId` string, required
    - `kid` string, required — Short identifier referenced in webhook envelopes so the developer knows which private key to use
    - `alg` 'RSA-OAEP-256' | 'HYBRID-RSA-AES-256', required — Algorithm for how this key is used
    - `publicKeyPemB64` string, required — Developer's public key material, PEM encoded then base64'd
    - `status` 'pending' | 'active' | 'revoked', required — Lifecycle status of this key
    - `type` 'dynamic' | 'external', required
    - `expiresAt` string, date-time, nullable — Optional expiry for planned rotations
    - `revokedAt` string, date-time, nullable — Timestamp when the key was revoked
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `message` string, required — Message describing the operation result

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

---

[API](https://skmtc.net/dynamic/apis/dashboard-api.md) · [All operations](https://skmtc.net/dynamic/apis/dashboard-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/dynamic/dashboard-api/versions/aac826315d90/schema)