---
title: "Get an issuer"
method: GET
path: "/v1/kms/issuers/{issuerId}"
tags: ["kms"]
---

# Get an issuer

`GET /v1/kms/issuers/{issuerId}`

Retrieve a single KMS issuer by its ID.

## Path parameters

- `issuerId` string, required — The ID of the issuer.

## Query parameters

- `teamId` string
- `slug` string

## Response `200`

- object
  - `id` string, required
  - `ownerId` string, required
  - `name` string, required
  - `algorithm` 'ES256' | 'ES384' | 'ES512' | 'EdDSA' | 'PS256' | 'PS384' | 'PS512' | 'RS256' | 'RS384' | 'RS512', required
  - `origin` 'external' | 'vercel', required
  - `managedBy` string
  - `claimsSchema` object
  - `createdAt` string, required
  - `updatedAt` string, required
  - `signingKeys` object[], required
    - `keyId` string, required — The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
    - `importKeyId` string — The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys.
    - `issuerId` string, required
    - `algorithm` string, required
    - `status` 'active' | 'pending' | 'revoking', required
    - `publicKey` object
      - `kty` string
      - `kid` string
      - `alg` string
      - `use` string
      - `key_ops` string[]
      - `x5c` string[] — The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.
      - `x5t#S256` string — The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9).
    - `publicKeyFingerprint` string
    - `publicKeyPem` string — The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it.
    - `certificatePem` string — The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
    - `createdAt` string, required
    - `updatedAt` string, required
    - `revokeAt` string
    - `activateAt` string
    - `activatedAt` string — When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
  - `policies` union[], required
    - union
      - object
        - `kind` 'project-grant', required
        - `teamId` string, required
        - `projectId` string, required
        - `environments` string[], required — Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim.
        - `tokenClaims` object
        - `createdAt` string, required
        - `updatedAt` string, required
      - object
        - `kind` 'connex-grant', required
        - `clientId` string, required
        - `tokenClaims` object
        - `createdAt` string, required
        - `updatedAt` string, required

## Other responses

- `400` — One of the provided values in the request query is invalid.
- `401` — The request is not authorized.
- `403` — You do not have permission to access this resource.
- `404`
- `410`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/revisions/339d55de6905/schema)