Register a public JWK for an application

post

https://account.api.here.com/authentication/v1.1/apps/{app}/jwks

Register a new public JSON Web Key for the specified application. The key will be used to verify
JWT assertions presented by the client at the token endpoint (private_key_jwt authentication).

The request body must be a valid public JWK per RFC 7517. Private key parameters (d, p, q, dp, dq, qi)
SHOULD NOT be present.

The kid must be unique within the application's key set.

A maximum of two JWKs can be created per application.
Clients can register multiple keys simultaneously to support key rotation:

Register new key (POST)
Start signing assertions with new key
Delete old key (DELETE)

Access Control:

The calling principal must have "manage" or "write" action permission for the resource "{app}" in the "account" service.
The calling principal MUST NOT include a project scope.

Path Params

app

string

required

HRN identifying the application. Must be URL-encoded, if reserved characters ":/?#[]@!$&'()*+,;=" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.

Body Params

A public JSON Web Key as defined in RFC 7517. The properties required depend on the key type (kty).

RSA keys (RS256) are supported. For RSA keys: kty, n, e are required.

Private key parameters (d, p, q, dp, dq, qi) SHOULD NOT be included.

kty

string

enum

required

The key type parameter identifying the cryptographic algorithm family.

Allowed:

kid

string

length between 1 and 256

The key ID. Must be unique within the application's key set. Used to match a specific key
when verifying JWT assertions.

alg

string

enum

The algorithm intended for use with this key.

Allowed:

use

string

enum

The intended use of the public key. Must be "sig" for signing verification.

Allowed:

string

RSA modulus (base64url-encoded). Required when kty is RSA.

string

RSA public exponent (base64url-encoded). Required when kty is RSA.

Headers

X-Correlation-ID

string

Correlates HTTP requests between a client and server. If not present in the incoming request, it will be generated. This header and value will be included in all loglines including access logs. It will also be propagated to downstream services and returned in the response.

X-Request-ID

string

The unique for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services.

Responses

400

400200 - Received invalid data. See 'errorFields' for more information.
- errorFields.errorCode 400201: Missing required field.
- errorFields.errorCode 400203: Invalid value.
400454 - Unsupported JWK 'alg'.
400455 - Unsupported JWK 'use'.
400456 - Unsupported JWK 'kty'.
400457 - Missing required JWK key material.

401

401300 - Access is denied due to invalid credentials.

404

404660 - No app exists with the given id.

409

409109 - The supplied JWK 'kid' already exists in the application's key set.
409304 - Reached allowed maximum number of JWKs per application. Delete a JWK to register another one.

429

429003 - Request blocked because of too many requests made. Wait for a while before making a new request.

Language

Credentials

Bearer

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

201Created