Vorbal API Documentation

Return the Ed25519 public keys used to verify v1a entries in Webhook-Signature. This endpoint does not require authentication because it returns only public keys, integer key IDs (akid), and an algorithm name. It does not return secrets or application data.

Every webhook delivery carries Webhook-Id, Webhook-Timestamp, and Webhook-Signature: v1a,<base64>. Verify at least one signature against the complete active key set over the exact signing input <webhook-id>.<webhook-timestamp>.<raw_body>. During rotation, deliveries carry a space-delimited signature for each active private key. See the Webhook Signatures guide.

Return the Ed25519 public keys used to verify `v1a` entries in `Webhook-Signature`. This endpoint does not require authentication because it returns only public keys, integer key IDs (`akid`), and an algorithm name. It does not return secrets or application data. Every webhook delivery carries `Webhook-Id`, `Webhook-Timestamp`, and `Webhook-Signature: v1a,<base64>`. Verify at least one signature against the complete active key set over the exact signing input `<webhook-id>.<webhook-timestamp>.<raw_body>`. During rotation, deliveries carry a space-delimited signature for each active private key. See the Webhook Signatures guide.

Response

Current set of webhook signature public keys.

keyslist of objects

Complete active public-key set. Array order has no signing semantics.

1	{
2	"keys": [
3	{
4	"akid": 2,
5	"alg": "ed25519",
6	"public_key": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
7	},
8	{
9	"akid": 1,
10	"alg": "ed25519",
11	"public_key": "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE="
12	}
13	]
14	}