Skip to content
OTA-Pulse Docs

Generate a new signing key pair

POST
/api/signing-keys
 
curl --request POST \
  --url 'https://example.com/api/signing-keys?organization_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "algo": "RSA-4096", "name": "example" }'

Generate an asymmetric key pair and persist the public side.

The private key is returned exactly once in the response body as private_key_pem. It is never stored server-side — if lost, a new key pair must be generated. Only RSA-4096 and ECDSA-P256 are accepted: mender-artifact/the device agent cannot use P-384 keys.

Authorizations

Section titled “ Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “ Query Parameters ”
organization_id
required
Organization Id
string format: uuid

Request Bodyrequired

Section titled “ Request Bodyrequired ”
Media type application/json
SigningKeyCreate

Request body for creating (generating) a new signing key pair.

The server generates the key pair; only the public half is persisted. The private key is returned once in SigningKeyCreateResponse. ECDSA-P384 is still parsed so the endpoint can answer with a clear deprecation error instead of a generic schema error.

object
algo
required
Algo

Key algorithm - RSA-4096 or ECDSA-P256 (ECDSA-P384 is rejected)

string
Allowed values: RSA-4096 ECDSA-P256 ECDSA-P384
name
required
Name

Human-readable key name

string
>= 1 characters <= 255 characters

Responses

Section titled “ Responses ”

201

Section titled “ 201 ”

Successful Response

Media type application/json
SigningKeyCreateResponse

Response returned once when a new key pair is generated.

Includes the PEM-encoded private key — this is the only time it is returned. The server does not persist private key material.

object
algo
required
Algo
string
artifact_compatible
required
Artifact Compatible

False for legacy ECDSA-P384 keys, which cannot sign installable artifacts.

boolean
created_at
required
Created At
string format: date-time
fingerprint
required
Fingerprint
string
id
required
Id
string format: uuid
is_active
required
Is Active
boolean
name
required
Name
string
origin
Origin
string
default: generated
private_key_pem
required
Private Key Pem

PEM-encoded private key — store securely; not recoverable after this response

string
public_key_pem
required
Public Key Pem
string
revoked_at
Any of:
string format: date-time
Example 
{
  "origin": "generated"
}

422

Section titled “ 422 ”

Validation Error

Media type application/json
HTTPValidationError
object
detail
Detail
Array<object>
ValidationError
object
ctx
Context
object
input
Input
loc
required
Location
Array
msg
required
Message
string
type
required
Error Type
string
Example generated 
{
  "detail": [
    {
      "ctx": {},
      "input": "example",
      "loc": [
        "example"
      ],
      "msg": "example",
      "type": "example"
    }
  ]
}