API ReferenceAudit

Per-workspace JWKS for audit signature verification.

Fully unauthenticated RFC 7517 JWKS endpoint. Returns active and revoked Ed25519 keys so third parties can verify historical audit signatures without a Rensei account. Unknown workspaces return `200 {"keys":[]}` to avoid revealing workspace existence. Both `/{workspace_id}` and `/{workspace_id}.json` are accepted.

Path Parameters

workspace_id*string

Length1 <= length

Header Parameters

If-None-Match?string

Response Body

`application/jwk-set+json`

`application/json`

curl -X GET "https://example.com/.well-known/audit-keys/string"

{
  "keys": [
    {
      "kid": "string",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "EdDSA",
      "use": "sig",
      "x": "string",
      "rensei:workspace_id": "string",
      "rensei:created_at": "2019-08-24T14:15:22Z",
      "rensei:revoked_at": "2019-08-24T14:15:22Z"
    }
  ]
}

Empty

{
  "error": "string"
}

List A2A task dispatches for the authenticated org

Returns both `explicit` (authored `agent.dispatch` workflow nodes) and `transparent` (MCP-bridge auto-routed) dispatches. Auth: session cookie via `requireOrgAccess()` (cookie-only today; CLI bearer tokens use a separate path).

Account-free signed audit-entry verification sample.

Fully unauthenticated worked example for independently verifying a signed audit entry. The response includes the signed entry, canonicalization material, Ed25519 verification data, JWKS discovery URL, and public catalog URL.