Skip to content
GitmoapAPIBeta
Identity & platformoidc
GET/.well-known/jwks.json

JSON Web Key Set publishing the public half of the OIDC signing key(s).

oidc_jwks
  • Public
    This operation declares no security requirement: it takes no token.

The public keys (RFC 7517) that verify the signature on an identity token gitmoap issued to a pipeline run, matched by the token's key id. Anyone may read it, without signing in, and it may be cached for five minutes.

Responses

200JSON Web Key Setapplication/json
  • keysarray of Jwk
    • The Jwk schema
    • algstringSigning algorithm — always RS256.
    • estringBase64url (no padding) RSA public exponent (typically AQAB).
    • kidstringThe key's id, equal to the kid header of the tokens it signs, so a relying party picks the right key while keys are being rotated.
    • ktystringKey type — always RSA.
    • nstringBase64url (no padding) RSA modulus.
    • usestringPublic key use — always sig (signature verification).
200 exampleSynthesized example
{
"keys": [
{
"alg": "alg-d71e",
"e": "e-d56b",
"kid": "kid-211d",
"kty": "kty-8cb2",
"n": "n-1247",
"use": "use-293e"
}
]
}
501The OIDC issuer is not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-6064",
"message": "Pin a page's payload to the build that rendered it"
}
}

CLI

gitmoap oidc oidc-jwks

Used in these guides