---
title: "Get a mablnet publisher keystore document"
method: GET
path: "/link/mablnet/keystore"
tags: ["LinkMablnet"]
---

# Get a mablnet publisher keystore document

`GET /link/mablnet/keystore`

Returns the signed keystore document (publisher public keys) a supervisor uses to verify manifest signatures. Defaults to the latest keystore; pass `keystore_version` to fetch a specific one — a supervisor does this when a manifest's `requiredKeystoreVersion` exceeds its local keystore version. Like the manifest, the body is an opaque Ed25519-signed document returned with field values preserved.
Conditional refetch via `If-None-Match` / `ETag`, identical to the manifest endpoint.

## Query parameters

- `keystore_version` integer

## Headers

- `If-None-Match` string

## Response `200`

Keystore document in body; current ETag in headers.

- MablnetKeystoreEnvelope — Transport envelope carrying a signed mablnet publisher keystore as opaque bytes (structure: `manifest-format.md` § Keystore document format). Same rationale as `MablnetManifestEnvelope` — base64 of the exact signed bytes so the signature survives the api's JSON layer untouched.
  - `keystore` string, required — Base64 of the exact signed keystore bytes. Decode, then verify + parse per manifest-format.md.

## Other responses

- `304` — Keystore unchanged since the supplied If-None-Match. Empty body; ETag headers still present.
- `401` — User not authenticated
- `403` — User not authorized
- `404` — No keystore exists at the requested version.
- `default` — Unknown error

---

[API](https://skmtc.net/mabl/apis/mabl-api.md) · [All operations](https://skmtc.net/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mabl/mabl-api/revisions/d0fc0114da66/schema)