---
title: "List issuers"
method: GET
path: "/v1/kms/issuers"
tags: ["kms"]
---

# List issuers

`GET /v1/kms/issuers`

Retrieve the list of KMS issuers that belong to the authenticated team. The results are paginated.

## Query parameters

- `limit` integer — Maximum number of issuers to return.
- `next` string — Continuation cursor to retrieve the next page of results.
- `teamId` string
- `slug` string

## Response `200`

- object
  - `issuers` object[], required
    - `id` string, required
    - `ownerId` string, required
    - `name` string, required
    - `algorithm` 'ES256' | 'ES384' | 'ES512' | 'EdDSA' | 'PS256' | 'PS384' | 'PS512' | 'RS256' | 'RS384' | 'RS512', required
    - `origin` 'external' | 'vercel', required
    - `managedBy` string
    - `claimsSchema` object
    - `createdAt` string, required
    - `updatedAt` string, required
    - `signingKeys` object[], required
      - `keyId` string, required — The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
      - `importKeyId` string — The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys.
      - `issuerId` string, required
      - `algorithm` string, required
      - `status` 'active' | 'pending' | 'revoking', required
      - `publicKey` object
        - `kty` string
        - `kid` string
        - `alg` string
        - `use` string
        - `key_ops` string[]
        - `x5c` string[] — The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.
        - `x5t#S256` string — The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9).
      - `publicKeyFingerprint` string
      - `publicKeyPem` string — The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it.
      - `certificatePem` string — The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
      - `createdAt` string, required
      - `updatedAt` string, required
      - `revokeAt` string
      - `activateAt` string
      - `activatedAt` string — When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
    - `policies` union[], required
      - union
        - object
          - `kind` 'project-grant', required
          - `teamId` string, required
          - `projectId` string, required
          - `environments` string[], required — Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim.
          - `tokenClaims` object
          - `createdAt` string, required
          - `updatedAt` string, required
        - object
          - `kind` 'connex-grant', required
          - `clientId` string, required
          - `tokenClaims` object
          - `createdAt` string, required
          - `updatedAt` string, required
  - `pagination` object, required
    - `count` number, required
    - `next` string, nullable, required

## Other responses

- `400` — One of the provided values in the request query is invalid.
- `401` — The request is not authorized.
- `403` — You do not have permission to access this resource.
- `410`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/revisions/915cc4809c98/schema)