Submit a public key

POST/v1/enrollments/{invitationId}/keys

Sends the PUBLIC half of a new P-256 key, and receives the challenge to prove you hold the private half.

PermissionNone

AuthenticationEnrolment token

Staff-set limits it counts towardNone

.NET SDKenrollment.SubmitKeyAsync(request)

Parameters

Name	In	Type	Notes
`invitationId`required	`path`	UUID	A UUID, lower-case with hyphens.

Authorised with Authorization: Enrollment <token>; not signed.

Headers: Accept-Language (optional). The SDKs set all of them for you.

Body: EnrollmentKeyRequest, as JSON.

Field	Type	Notes
`publicJwk`required	PublicJwk	The PUBLIC half of a new P-256 key only. A private member is refused.
`notBefore`required	string (date-time)	Only the length of the window (to `expiresAt`) is used — kept between 1 day and 2 years by default — and it starts when Anis staff activate the key.
`expiresAt`required	string (date-time)	The end of the validity you ask for. See `notBefore`.
`cidrs`	list of string	The networks you will call from, proposed for Anis staff to confirm.

Status	Meaning	Body
200	Success.	EnrollmentKeyResult
401	Refused: not authenticated.	Problem
404	Refused: not found, or not yours.	Problem
409	Refused: conflicts with the current state.	Problem
422	Refused: the request breaks a rule.	Problem
429	Refused: a limit was reached.	Problem
503	No decision: a dependency was unavailable.	Problem

Every answer is signed by Anis; the SDKs check it before you see it.

Every refusal is a signed problem. Branch on its code; each links to what it means and what to do.

Field	Type	Notes
`publicJwk`required	PublicJwk	The PUBLIC half of a new P-256 key only. A private member is refused.
`notBefore`required	string (date-time)	Only the length of the window (to `expiresAt`) is used — kept between 1 day and 2 years by default — and it starts when Anis staff activate the key.
`expiresAt`required	string (date-time)	The end of the validity you ask for. See `notBefore`.
`cidrs`	list of string	The networks you will call from, proposed for Anis staff to confirm.

Field	Type	Notes
`kty`required	string	Always `EC`. Values: `EC`
`crv`required	string	Always `P-256`. Values: `P-256`
`x`required	string	The key’s x coordinate: exactly 32 bytes, base64url without padding.
`y`required	string	The key’s y coordinate: exactly 32 bytes, base64url without padding.
`kid`	string	In Anis’s signing keys: the key an answer’s signature names. Treat it as an opaque name. Not sent when you submit your own key.
`use`	string	Intended use, when published.
`alg`	string	Algorithm, when published.

Field	Type	Notes
`keyId`always present	UUID	Your key id: the `keyid` every signature will carry once the key is active.
`thumbprint`always present	string	The key’s fingerprint. Give it to Anis staff through the channel you agreed; they confirm the key with it.
`challenge`always present	string	The challenge your proof answers. It is returned only here: keep it until the proof is accepted.
`challengeGeneration`	integer	Which challenge this is; a restarted enrolment issues the next one.