Webhook signature public keys

GET

https://api.vorbal.dev/.well-known/webhook-public-keys

Return the Ed25519 public keys used to verify v1a entries in Webhook-Signature.

Every webhook delivery carries Webhook-Id, Webhook-Timestamp, and Webhook-Signature: v1a,<base64>. Verify at least one signature against the complete active key set over the exact signing input <webhook-id>.<webhook-timestamp>.<raw_body>. During rotation, deliveries carry a space-delimited signature for each active private key.

Return the Ed25519 public keys used to verify `v1a` entries in `Webhook-Signature`. Every webhook delivery carries `Webhook-Id`, `Webhook-Timestamp`, and `Webhook-Signature: v1a,<base64>`. Verify at least one signature against the complete active key set over the exact signing input `<webhook-id>.<webhook-timestamp>.<raw_body>`. During rotation, deliveries carry a space-delimited signature for each active private key.

Response headers

traceparentstringOptional

Server-owned W3C Trace Context for correlating this response with support and observability data. It is present on successful and error responses. A valid incoming traceparent is linked to, but never becomes, the server-owned trace identifier.

Response

Current webhook signature public keys.

keyslist of objects

Complete active public-key set.

Errors

406

Not Acceptable Error