---
title: "Get JSON Web Key Set (JWKS) with all the keys that can be used to verify tokens (public keys)"
method: GET
path: "/signing-keys/keys"
tags: ["signing_keys"]
---

# Get JSON Web Key Set (JWKS) with all the keys that can be used to verify tokens (public keys)

`GET /signing-keys/keys`

Required permissions
None

## Response `200`

(empty)

- object
  - `keys` JSONWebKey[]
    - `Algorithm` string — Key algorithm, parsed from `alg` header.
    - `CertificateThumbprintSHA1` integer[] — X.509 certificate thumbprint (SHA-1), parsed from `x5t` header.
    - `CertificateThumbprintSHA256` integer[] — X.509 certificate thumbprint (SHA-256), parsed from `x5t#S256` header.
    - `Certificates` Certificate[] — X.509 certificate chain, parsed from `x5c` header.
      - `AuthorityKeyId` integer[]
      - `BasicConstraintsValid` boolean — BasicConstraintsValid indicates whether IsCA, MaxPathLen, and MaxPathLenZero are valid.
      - `CRLDistributionPoints` string[] — CRL Distribution Points
      - `DNSNames` string[] — Subject Alternate Name values. (Note that these values may not be valid if invalid values were contained within a parsed certificate. For example, an element of DNSNames may not be a valid DNS domain name.)
      - `EmailAddresses` string[]
      - `ExcludedDNSDomains` string[]
      - `ExcludedEmailAddresses` string[]
      - `ExcludedIPRanges` IPNet[]
        - `IP` string
        - `Mask` integer[] — See type [IPNet] and func [ParseCIDR] for details.
      - `ExcludedURIDomains` string[]
      - `ExtKeyUsage` ExtKeyUsage[]
      - `Extensions` Extension[] — Extensions contains raw X.509 extensions. When parsing certificates, this can be used to extract non-critical extensions that are not parsed by this package. When marshaling certificates, the Extensions field is ignored, see ExtraExtensions.
        - `Critical` boolean
        - `Id` integer[]
        - `Value` integer[]
      - `ExtraExtensions` Extension[] — ExtraExtensions contains extensions to be copied, raw, into any marshaled certificates. Values override any extensions that would otherwise be produced based on the other fields. The ExtraExtensions field is not populated when parsing certificates, see Extensions.
        - `Critical` boolean
        - `Id` integer[]
        - `Value` integer[]
      - `IPAddresses` string[]
      - `InhibitAnyPolicy` integer — InhibitAnyPolicy and InhibitAnyPolicyZero indicate the presence and value of the inhibitAnyPolicy extension. The value of InhibitAnyPolicy indicates the number of additional certificates in the path after this certificate that may use the anyPolicy policy OID to indicate a match with any other policy. When parsing a certificate, a positive non-zero InhibitAnyPolicy means that the field was specified, -1 means it was unset, and InhibitAnyPolicyZero being true mean that the field was explicitly set to zero. The case of InhibitAnyPolicy==0 with InhibitAnyPolicyZero==false should be treated equivalent to -1 (unset).
      - `InhibitAnyPolicyZero` boolean — InhibitAnyPolicyZero indicates that InhibitAnyPolicy==0 should be interpreted as an actual maximum path length of zero. Otherwise, that combination is interpreted as InhibitAnyPolicy not being set.
      - `InhibitPolicyMapping` integer — InhibitPolicyMapping and InhibitPolicyMappingZero indicate the presence and value of the inhibitPolicyMapping field of the policyConstraints extension. The value of InhibitPolicyMapping indicates the number of additional certificates in the path after this certificate that may use policy mapping. When parsing a certificate, a positive non-zero InhibitPolicyMapping means that the field was specified, -1 means it was unset, and InhibitPolicyMappingZero being true mean that the field was explicitly set to zero. The case of InhibitPolicyMapping==0 with InhibitPolicyMappingZero==false should be treated equivalent to -1 (unset).
      - `InhibitPolicyMappingZero` boolean — InhibitPolicyMappingZero indicates that InhibitPolicyMapping==0 should be interpreted as an actual maximum path length of zero. Otherwise, that combination is interpreted as InhibitAnyPolicy not being set.
      - `IsCA` boolean
      - `Issuer` Name — Name represents an X.509 distinguished name. This only includes the common elements of a DN. Note that Name is only an approximation of the X.509 structure. If an accurate representation is needed, asn1.Unmarshal the raw subject or issuer as an [RDNSequence].
        - `Country` string[]
        - `ExtraNames` AttributeTypeAndValue[] — ExtraNames contains attributes to be copied, raw, into any marshaled distinguished names. Values override any attributes with the same OID. The ExtraNames field is not populated when parsing, see Names.
          - `Type` integer[]
          - `Value` unknown
        - `Locality` string[]
        - `Names` AttributeTypeAndValue[] — Names contains all parsed attributes. When parsing distinguished names, this can be used to extract non-standard attributes that are not parsed by this package. When marshaling to RDNSequences, the Names field is ignored, see ExtraNames.
          - `Type` integer[]
          - `Value` unknown
        - `SerialNumber` string
        - `StreetAddress` string[]
      - `IssuingCertificateURL` string[]
      - `KeyUsage` integer — KeyUsage represents the set of actions that are valid for a given key. It's a bitmap of the KeyUsage* constants.
      - `MaxPathLen` integer — MaxPathLen and MaxPathLenZero indicate the presence and value of the BasicConstraints' "pathLenConstraint". When parsing a certificate, a positive non-zero MaxPathLen means that the field was specified, -1 means it was unset, and MaxPathLenZero being true mean that the field was explicitly set to zero. The case of MaxPathLen==0 with MaxPathLenZero==false should be treated equivalent to -1 (unset). When generating a certificate, an unset pathLenConstraint can be requested with either MaxPathLen == -1 or using the zero value for both MaxPathLen and MaxPathLenZero.
      - `MaxPathLenZero` boolean — MaxPathLenZero indicates that BasicConstraintsValid==true and MaxPathLen==0 should be interpreted as an actual maximum path length of zero. Otherwise, that combination is interpreted as MaxPathLen not being set.
      - `NotBefore` string, date-time
      - `OCSPServer` string[] — RFC 5280, 4.2.2.1 (Authority Information Access)
      - `PermittedDNSDomains` string[]
      - `PermittedDNSDomainsCritical` boolean — Name constraints
      - `PermittedEmailAddresses` string[]
      - `PermittedIPRanges` IPNet[]
        - `IP` string
        - `Mask` integer[] — See type [IPNet] and func [ParseCIDR] for details.
      - `PermittedURIDomains` string[]
      - `Policies` string[] — Policies contains all policy identifiers included in the certificate. See CreateCertificate for context about how this field and the PolicyIdentifiers field interact. In Go 1.22, encoding/gob cannot handle and ignores this field.
      - `PolicyIdentifiers` ObjectIdentifier[] — PolicyIdentifiers contains asn1.ObjectIdentifiers, the components of which are limited to int32. If a certificate contains a policy which cannot be represented by asn1.ObjectIdentifier, it will not be included in PolicyIdentifiers, but will be present in Policies, which contains all parsed policy OIDs. See CreateCertificate for context about how this field and the Policies field interact.
        - integer[]
      - `PolicyMappings` PolicyMapping[] — PolicyMappings contains a list of policy mappings included in the certificate.
        - `IssuerDomainPolicy` string — IssuerDomainPolicy contains a policy OID the issuing certificate considers equivalent to SubjectDomainPolicy in the subject certificate.
        - `SubjectDomainPolicy` string — SubjectDomainPolicy contains a OID the issuing certificate considers equivalent to IssuerDomainPolicy in the subject certificate.
      - `PublicKey` unknown
      - `PublicKeyAlgorithm` integer
      - `Raw` integer[]
      - `RawIssuer` integer[]
      - `RawSubject` integer[]
      - `RawSubjectPublicKeyInfo` integer[]
      - `RawTBSCertificate` integer[]
      - `RequireExplicitPolicy` integer — RequireExplicitPolicy and RequireExplicitPolicyZero indicate the presence and value of the requireExplicitPolicy field of the policyConstraints extension. The value of RequireExplicitPolicy indicates the number of additional certificates in the path after this certificate before an explicit policy is required for the rest of the path. When an explicit policy is required, each subsequent certificate in the path must contain a required policy OID, or a policy OID which has been declared as equivalent through the policy mapping extension. When parsing a certificate, a positive non-zero RequireExplicitPolicy means that the field was specified, -1 means it was unset, and RequireExplicitPolicyZero being true mean that the field was explicitly set to zero. The case of RequireExplicitPolicy==0 with RequireExplicitPolicyZero==false should be treated equivalent to -1 (unset).
      - `RequireExplicitPolicyZero` boolean — RequireExplicitPolicyZero indicates that RequireExplicitPolicy==0 should be interpreted as an actual maximum path length of zero. Otherwise, that combination is interpreted as InhibitAnyPolicy not being set.
      - `SerialNumber` string
      - `Signature` integer[]
      - `SignatureAlgorithm` integer
      - `Subject` Name — Name represents an X.509 distinguished name. This only includes the common elements of a DN. Note that Name is only an approximation of the X.509 structure. If an accurate representation is needed, asn1.Unmarshal the raw subject or issuer as an [RDNSequence].
        - `Country` string[]
        - `ExtraNames` AttributeTypeAndValue[] — ExtraNames contains attributes to be copied, raw, into any marshaled distinguished names. Values override any attributes with the same OID. The ExtraNames field is not populated when parsing, see Names.
          - `Type` integer[]
          - `Value` unknown
        - `Locality` string[]
        - `Names` AttributeTypeAndValue[] — Names contains all parsed attributes. When parsing distinguished names, this can be used to extract non-standard attributes that are not parsed by this package. When marshaling to RDNSequences, the Names field is ignored, see ExtraNames.
          - `Type` integer[]
          - `Value` unknown
        - `SerialNumber` string
        - `StreetAddress` string[]
      - `SubjectKeyId` integer[]
      - `URIs` URL[]
      - `UnhandledCriticalExtensions` ObjectIdentifier[] — UnhandledCriticalExtensions contains a list of extension IDs that were not (fully) processed when parsing. Verify will fail if this slice is non-empty, unless verification is delegated to an OS library which understands all the critical extensions. Users can access these extensions using Extensions and can remove elements from this slice if they believe that they have been handled.
        - integer[]
      - `UnknownExtKeyUsage` ObjectIdentifier[]
        - integer[]
      - `Version` integer
    - `CertificatesURL` string, url
    - `Key` unknown
    - `KeyID` string — Key identifier, parsed from `kid` header.
    - `Use` string — Key use, parsed from `use` header.

## Other responses

- `500` — InternalServerError is a general error indicating something went wrong internally.

---

[API](https://skmtc.net/grafana/apis/http-api.md) · [All operations](https://skmtc.net/grafana/apis/http-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/grafana/http-api/revisions/df55ba1718ba/schema)