> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/api-reference/ar/registry-v3-signing-keys.md).
# Registry V3 Signing Keys
V3 signing key management endpoints
## List signing keys
> Lists signing keys for the current account/org/project with filtering and pagination.\
> Results are ordered by creation time (newest first).
```json
{"openapi":"3.0.0","info":{"title":"Harness Artifact Registry API","version":"1.0.0"},"tags":[{"description":"V3 signing key management endpoints","name":"Registry V3 - Signing Keys"}],"servers":[{"url":"/api"}],"paths":{"/v3/signing-keys":{"get":{"description":"Lists signing keys for the current account/org/project with filtering and pagination.\nResults are ordered by creation time (newest first).\n","operationId":"ListSigningKeysV3","parameters":[{"$ref":"#/components/parameters/AccountIdentifierV3"},{"$ref":"#/components/parameters/OrgIdentifierV3"},{"$ref":"#/components/parameters/ProjectIdentifierV3"},{"$ref":"#/components/parameters/PageNumberV3"},{"$ref":"#/components/parameters/PageSizeV3"},{"$ref":"#/components/parameters/SearchTermV3"},{"$ref":"#/components/parameters/SigningKeyTypesFilterParamV3"},{"$ref":"#/components/parameters/SigningKeyStatusesFilterParamV3"},{"$ref":"#/components/parameters/SigningKeysScopeParamV3"}],"responses":{"200":{"$ref":"#/components/responses/ListSigningKeysResponseV3"},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorV3"}}},"description":"Error response."}},"summary":"List signing keys","tags":["Registry V3 - Signing Keys"]}}},"components":{"parameters":{"AccountIdentifierV3":{"description":"Unique identifier for the Harness account.\n","in":"query","name":"account_identifier","required":true,"schema":{"type":"string"}},"OrgIdentifierV3":{"description":"Unique identifier for the organization within the account.\n\nExample: `default` or `engineering_org`\n","in":"query","name":"org_identifier","schema":{"type":"string"}},"ProjectIdentifierV3":{"description":"Unique identifier for the project within the organization.\n\nExample: `my_project` or `frontend_services`\n","in":"query","name":"project_identifier","schema":{"type":"string"}},"PageNumberV3":{"description":"The page number for pagination (0-indexed).\n\nUsed to navigate through large result sets. Combined with `size` parameter\nto control which subset of results to return.\n\nExample: `page=0` returns the first page, `page=1` returns the second page\n","in":"query","name":"page","schema":{"default":0,"format":"int64","type":"integer"}},"PageSizeV3":{"description":"The number of items to return per page.\n\nControls the page size for paginated results. \n\nExample: `size=50` returns up to 50 items per page\n","in":"query","name":"size","schema":{"default":20,"format":"int64","maximum":100,"minimum":1,"type":"integer"}},"SearchTermV3":{"description":"Search term for filtering results.\n\nExample: `search_term=prod` might match keys like \"production\", \"prod-env\", etc.\n","in":"query","name":"search_term","schema":{"type":"string"}},"SigningKeyTypesFilterParamV3":{"description":"Filter signing keys by cryptographic system. Values match `SigningKeyTypeV3`, which is extensible. Example: `types=GPG`\n","in":"query","name":"types","schema":{"items":{"$ref":"#/components/schemas/SigningKeyTypeV3"},"type":"array"}},"SigningKeyStatusesFilterParamV3":{"description":"Filter signing keys by lifecycle state. Values match `SigningKeyStatusV3`, which is extensible. Example: `statuses=ACTIVE`\n","in":"query","name":"statuses","schema":{"format":"uuid","items":{"$ref":"#/components/schemas/SigningKeyStatusV3"},"type":"array"}},"SigningKeysScopeParamV3":{"description":"**Scope of signing keys to list**\n* **none** – current space only (default)\n* **ancestors** – current space **plus** all parent spaces\n\nIf omitted, `none` is assumed. This field is extensible; clients must handle unknown values.\n","in":"query","name":"scope","schema":{"type":"string"}}},"schemas":{"SigningKeyTypeV3":{"description":"Cryptographic system of a signing key. Known values include: GPG (for Debian, RPM, Alpine), RSA (for direct signing operations). This field is extensible; clients must handle unknown values.\n","type":"string"},"SigningKeyStatusV3":{"description":"Lifecycle state of a signing key. Known values include: ACTIVE, INACTIVE (expired or manually deactivated), REVOKED (compromised), DELETED (deleted). This field is extensible; clients must handle unknown values.\n","type":"string"},"ListSigningKeysResponseBodyV3":{"allOf":[{"$ref":"#/components/schemas/PageInfoV3"},{"properties":{"items":{"items":{"$ref":"#/components/schemas/SigningKeyV3"},"type":"array"}},"required":["items"],"type":"object"}],"description":"Paginated list of signing keys"},"PageInfoV3":{"description":"Pagination metadata.\n- `page` selects which page of results to return (0 = first page).\n- `size` controls how many items are returned per page.\n- `hasMore` is true if more results exist after this page.\n","properties":{"hasMore":{"description":"True if more results exist after this page.","type":"boolean"},"page":{"description":"The current page (0-indexed)","format":"int64","type":"integer"},"size":{"description":"Number of items per page","format":"int64","type":"integer"}},"required":["page","size","hasMore"],"type":"object"},"SigningKeyV3":{"description":"A signing key used for repository metadata signing (Debian, Alpine, etc.)","properties":{"algorithm":{"$ref":"#/components/schemas/SigningKeyAlgorithmV3"},"createdAt":{"$ref":"#/components/schemas/CreatedAtMsV3"},"createdBy":{"$ref":"#/components/schemas/UserInfoV3"},"expirationAt":{"description":"Expiration timestamp in Unix milliseconds (null if never expires)","format":"int64","nullable":true,"type":"integer"},"fingerprint":{"description":"Primary identifier (GPG 40 hex chars, RSA SHA256 of public key 64 hex chars)","type":"string"},"id":{"description":"Unique internal identifier of the signing key","format":"uuid","type":"string"},"longKeyId":{"description":"Last 16 hex chars of fingerprint (for CLI compatibility)","type":"string"},"modifiedAt":{"$ref":"#/components/schemas/ModifiedAtMsV3"},"name":{"description":"Human-readable name for UI/API","type":"string"},"shortKeyId":{"description":"Last 8 hex chars of fingerprint (for CLI compatibility)","type":"string"},"size":{"description":"Key strength in bits (e.g. 2048, 3072, 4096 for RSA)","format":"int32","nullable":true,"type":"integer"},"source":{"description":"Origin of the key (created by system or provided by user)","enum":["GENERATED","IMPORTED"],"type":"string"},"status":{"$ref":"#/components/schemas/SigningKeyStatusV3"},"type":{"$ref":"#/components/schemas/SigningKeyTypeV3"},"updatedBy":{"$ref":"#/components/schemas/UserInfoV3"}},"required":["id","name","type","source","status","fingerprint","algorithm","createdAt","modifiedAt"],"type":"object"},"SigningKeyAlgorithmV3":{"description":"Underlying cryptographic algorithm of a signing key. Known values include: RSA, ED25519, ECDSA. This field is extensible; clients must handle unknown values. Note that only RSA and ED25519 can be generated; ECDSA is only observed on imported keys.\n","type":"string"},"CreatedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was created","format":"int64","nullable":true,"type":"integer"},"UserInfoV3":{"description":"Structured user information for a principal","properties":{"display_name":{"description":"Human-readable display name","type":"string"},"email":{"description":"Email address","type":"string"},"type":{"description":"Principal type (user, service, service_account)","type":"string"},"uid":{"description":"Principal unique identifier (username)","type":"string"}},"type":"object"},"ModifiedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was last modified","format":"int64","nullable":true,"type":"integer"},"ErrorV3":{"description":"An error response","properties":{"error":{"$ref":"#/components/schemas/ApiErrorsV3"}},"required":["error"],"type":"object"},"ApiErrorsV3":{"properties":{"code":{"description":"For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.","maxLength":5000,"type":"string"},"message":{"description":"A human-readable message providing more details about the error. These messages can be shown to users.","maxLength":40000,"type":"string"},"param":{"description":"If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.","maxLength":5000,"type":"string"},"type":{"description":"The type of error returned.","enum":["INVALID_REQUEST_ERROR","AUTHENTICATION_ERROR","PERMISSION_ERROR","API_ERROR"],"type":"string"}},"required":["type"],"title":"APIErrors","type":"object"}},"responses":{"ListSigningKeysResponseV3":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListSigningKeysResponseBodyV3"}}},"description":"response for list signing keys"}}}}
```
## Get signing key details
> Retrieves detailed information about a specific signing key by ID.
```json
{"openapi":"3.0.0","info":{"title":"Harness Artifact Registry API","version":"1.0.0"},"tags":[{"description":"V3 signing key management endpoints","name":"Registry V3 - Signing Keys"}],"servers":[{"url":"/api"}],"paths":{"/v3/signing-keys/{id}":{"get":{"description":"Retrieves detailed information about a specific signing key by ID.","operationId":"GetSigningKeyV3","parameters":[{"$ref":"#/components/parameters/AccountIdentifierV3"},{"$ref":"#/components/parameters/IdPathParamV3"}],"responses":{"200":{"$ref":"#/components/responses/SigningKeyDetailsResponseV3"},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorV3"}}},"description":"Error response."}},"summary":"Get signing key details","tags":["Registry V3 - Signing Keys"]}}},"components":{"parameters":{"AccountIdentifierV3":{"description":"Unique identifier for the Harness account.\n","in":"query","name":"account_identifier","required":true,"schema":{"type":"string"}},"IdPathParamV3":{"in":"path","name":"id","required":true,"schema":{"type":"string"}}},"responses":{"SigningKeyDetailsResponseV3":{"content":{"application/json":{"schema":{"properties":{"data":{"$ref":"#/components/schemas/SigningKeyV3"}},"required":["data"],"type":"object"}}},"description":"Signing key details"}},"schemas":{"SigningKeyV3":{"description":"A signing key used for repository metadata signing (Debian, Alpine, etc.)","properties":{"algorithm":{"$ref":"#/components/schemas/SigningKeyAlgorithmV3"},"createdAt":{"$ref":"#/components/schemas/CreatedAtMsV3"},"createdBy":{"$ref":"#/components/schemas/UserInfoV3"},"expirationAt":{"description":"Expiration timestamp in Unix milliseconds (null if never expires)","format":"int64","nullable":true,"type":"integer"},"fingerprint":{"description":"Primary identifier (GPG 40 hex chars, RSA SHA256 of public key 64 hex chars)","type":"string"},"id":{"description":"Unique internal identifier of the signing key","format":"uuid","type":"string"},"longKeyId":{"description":"Last 16 hex chars of fingerprint (for CLI compatibility)","type":"string"},"modifiedAt":{"$ref":"#/components/schemas/ModifiedAtMsV3"},"name":{"description":"Human-readable name for UI/API","type":"string"},"shortKeyId":{"description":"Last 8 hex chars of fingerprint (for CLI compatibility)","type":"string"},"size":{"description":"Key strength in bits (e.g. 2048, 3072, 4096 for RSA)","format":"int32","nullable":true,"type":"integer"},"source":{"description":"Origin of the key (created by system or provided by user)","enum":["GENERATED","IMPORTED"],"type":"string"},"status":{"$ref":"#/components/schemas/SigningKeyStatusV3"},"type":{"$ref":"#/components/schemas/SigningKeyTypeV3"},"updatedBy":{"$ref":"#/components/schemas/UserInfoV3"}},"required":["id","name","type","source","status","fingerprint","algorithm","createdAt","modifiedAt"],"type":"object"},"SigningKeyAlgorithmV3":{"description":"Underlying cryptographic algorithm of a signing key. Known values include: RSA, ED25519, ECDSA. This field is extensible; clients must handle unknown values. Note that only RSA and ED25519 can be generated; ECDSA is only observed on imported keys.\n","type":"string"},"CreatedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was created","format":"int64","nullable":true,"type":"integer"},"UserInfoV3":{"description":"Structured user information for a principal","properties":{"display_name":{"description":"Human-readable display name","type":"string"},"email":{"description":"Email address","type":"string"},"type":{"description":"Principal type (user, service, service_account)","type":"string"},"uid":{"description":"Principal unique identifier (username)","type":"string"}},"type":"object"},"ModifiedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was last modified","format":"int64","nullable":true,"type":"integer"},"SigningKeyStatusV3":{"description":"Lifecycle state of a signing key. Known values include: ACTIVE, INACTIVE (expired or manually deactivated), REVOKED (compromised), DELETED (deleted). This field is extensible; clients must handle unknown values.\n","type":"string"},"SigningKeyTypeV3":{"description":"Cryptographic system of a signing key. Known values include: GPG (for Debian, RPM, Alpine), RSA (for direct signing operations). This field is extensible; clients must handle unknown values.\n","type":"string"},"ErrorV3":{"description":"An error response","properties":{"error":{"$ref":"#/components/schemas/ApiErrorsV3"}},"required":["error"],"type":"object"},"ApiErrorsV3":{"properties":{"code":{"description":"For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.","maxLength":5000,"type":"string"},"message":{"description":"A human-readable message providing more details about the error. These messages can be shown to users.","maxLength":40000,"type":"string"},"param":{"description":"If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.","maxLength":5000,"type":"string"},"type":{"description":"The type of error returned.","enum":["INVALID_REQUEST_ERROR","AUTHENTICATION_ERROR","PERMISSION_ERROR","API_ERROR"],"type":"string"}},"required":["type"],"title":"APIErrors","type":"object"}}}}
```
## Delete signing key (soft delete)
> Soft-deletes a signing key by marking it as DELETED. The key metadata is retained\
> for audit purposes. The key must not be attached to any registry: if it is, the\
> request fails with 409 and the error message lists every registry to detach first.
```json
{"openapi":"3.0.0","info":{"title":"Harness Artifact Registry API","version":"1.0.0"},"tags":[{"description":"V3 signing key management endpoints","name":"Registry V3 - Signing Keys"}],"servers":[{"url":"/api"}],"paths":{"/v3/signing-keys/{id}":{"delete":{"description":"Soft-deletes a signing key by marking it as DELETED. The key metadata is retained\nfor audit purposes. The key must not be attached to any registry: if it is, the\nrequest fails with 409 and the error message lists every registry to detach first.\n","operationId":"DeleteSigningKeyV3","parameters":[{"$ref":"#/components/parameters/AccountIdentifierV3"},{"$ref":"#/components/parameters/IdPathParamV3"}],"responses":{"204":{"description":"Signing key deleted successfully"},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorV3"}}},"description":"Error response."}},"summary":"Delete signing key (soft delete)","tags":["Registry V3 - Signing Keys"]}}},"components":{"parameters":{"AccountIdentifierV3":{"description":"Unique identifier for the Harness account.\n","in":"query","name":"account_identifier","required":true,"schema":{"type":"string"}},"IdPathParamV3":{"in":"path","name":"id","required":true,"schema":{"type":"string"}}},"schemas":{"ErrorV3":{"description":"An error response","properties":{"error":{"$ref":"#/components/schemas/ApiErrorsV3"}},"required":["error"],"type":"object"},"ApiErrorsV3":{"properties":{"code":{"description":"For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.","maxLength":5000,"type":"string"},"message":{"description":"A human-readable message providing more details about the error. These messages can be shown to users.","maxLength":40000,"type":"string"},"param":{"description":"If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.","maxLength":5000,"type":"string"},"type":{"description":"The type of error returned.","enum":["INVALID_REQUEST_ERROR","AUTHENTICATION_ERROR","PERMISSION_ERROR","API_ERROR"],"type":"string"}},"required":["type"],"title":"APIErrors","type":"object"}}}}
```
## Update signing key
> Updates a signing key's status.
```json
{"openapi":"3.0.0","info":{"title":"Harness Artifact Registry API","version":"1.0.0"},"tags":[{"description":"V3 signing key management endpoints","name":"Registry V3 - Signing Keys"}],"servers":[{"url":"/api"}],"paths":{"/v3/signing-keys/{id}":{"patch":{"description":"Updates a signing key's status.\n","operationId":"UpdateSigningKeyV3","parameters":[{"$ref":"#/components/parameters/AccountIdentifierV3"},{"$ref":"#/components/parameters/IdPathParamV3"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateKeyRequestV3"}}},"required":true},"responses":{"200":{"$ref":"#/components/responses/SigningKeyDetailsResponseV3"},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorV3"}}},"description":"Error response."}},"summary":"Update signing key","tags":["Registry V3 - Signing Keys"]}}},"components":{"parameters":{"AccountIdentifierV3":{"description":"Unique identifier for the Harness account.\n","in":"query","name":"account_identifier","required":true,"schema":{"type":"string"}},"IdPathParamV3":{"in":"path","name":"id","required":true,"schema":{"type":"string"}}},"schemas":{"UpdateKeyRequestV3":{"description":"Request to update a signing key status","properties":{"status":{"description":"New status for the key (cannot transition from REVOKED or DELETED). Intentionally a closed subset of `SigningKeyStatusV3` rather than an extensible enum: DELETED is reachable only via `DELETE /signing-keys/{id}`, which emits a distinct audit event.\n","enum":["ACTIVE","INACTIVE","REVOKED"],"type":"string"}},"required":["status"],"type":"object"},"SigningKeyV3":{"description":"A signing key used for repository metadata signing (Debian, Alpine, etc.)","properties":{"algorithm":{"$ref":"#/components/schemas/SigningKeyAlgorithmV3"},"createdAt":{"$ref":"#/components/schemas/CreatedAtMsV3"},"createdBy":{"$ref":"#/components/schemas/UserInfoV3"},"expirationAt":{"description":"Expiration timestamp in Unix milliseconds (null if never expires)","format":"int64","nullable":true,"type":"integer"},"fingerprint":{"description":"Primary identifier (GPG 40 hex chars, RSA SHA256 of public key 64 hex chars)","type":"string"},"id":{"description":"Unique internal identifier of the signing key","format":"uuid","type":"string"},"longKeyId":{"description":"Last 16 hex chars of fingerprint (for CLI compatibility)","type":"string"},"modifiedAt":{"$ref":"#/components/schemas/ModifiedAtMsV3"},"name":{"description":"Human-readable name for UI/API","type":"string"},"shortKeyId":{"description":"Last 8 hex chars of fingerprint (for CLI compatibility)","type":"string"},"size":{"description":"Key strength in bits (e.g. 2048, 3072, 4096 for RSA)","format":"int32","nullable":true,"type":"integer"},"source":{"description":"Origin of the key (created by system or provided by user)","enum":["GENERATED","IMPORTED"],"type":"string"},"status":{"$ref":"#/components/schemas/SigningKeyStatusV3"},"type":{"$ref":"#/components/schemas/SigningKeyTypeV3"},"updatedBy":{"$ref":"#/components/schemas/UserInfoV3"}},"required":["id","name","type","source","status","fingerprint","algorithm","createdAt","modifiedAt"],"type":"object"},"SigningKeyAlgorithmV3":{"description":"Underlying cryptographic algorithm of a signing key. Known values include: RSA, ED25519, ECDSA. This field is extensible; clients must handle unknown values. Note that only RSA and ED25519 can be generated; ECDSA is only observed on imported keys.\n","type":"string"},"CreatedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was created","format":"int64","nullable":true,"type":"integer"},"UserInfoV3":{"description":"Structured user information for a principal","properties":{"display_name":{"description":"Human-readable display name","type":"string"},"email":{"description":"Email address","type":"string"},"type":{"description":"Principal type (user, service, service_account)","type":"string"},"uid":{"description":"Principal unique identifier (username)","type":"string"}},"type":"object"},"ModifiedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was last modified","format":"int64","nullable":true,"type":"integer"},"SigningKeyStatusV3":{"description":"Lifecycle state of a signing key. Known values include: ACTIVE, INACTIVE (expired or manually deactivated), REVOKED (compromised), DELETED (deleted). This field is extensible; clients must handle unknown values.\n","type":"string"},"SigningKeyTypeV3":{"description":"Cryptographic system of a signing key. Known values include: GPG (for Debian, RPM, Alpine), RSA (for direct signing operations). This field is extensible; clients must handle unknown values.\n","type":"string"},"ErrorV3":{"description":"An error response","properties":{"error":{"$ref":"#/components/schemas/ApiErrorsV3"}},"required":["error"],"type":"object"},"ApiErrorsV3":{"properties":{"code":{"description":"For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.","maxLength":5000,"type":"string"},"message":{"description":"A human-readable message providing more details about the error. These messages can be shown to users.","maxLength":40000,"type":"string"},"param":{"description":"If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.","maxLength":5000,"type":"string"},"type":{"description":"The type of error returned.","enum":["INVALID_REQUEST_ERROR","AUTHENTICATION_ERROR","PERMISSION_ERROR","API_ERROR"],"type":"string"}},"required":["type"],"title":"APIErrors","type":"object"}},"responses":{"SigningKeyDetailsResponseV3":{"content":{"application/json":{"schema":{"properties":{"data":{"$ref":"#/components/schemas/SigningKeyV3"}},"required":["data"],"type":"object"}}},"description":"Signing key details"}}}}
```
## Get public key
> Returns the public key for a signing key in ASCII-armored format\
> (PGP for GPG keys, PEM for RSA keys). Used by clients to verify\
> signatures.\
> \
> By default the key is returned inline as \`text/plain\`. Pass\
> \`download=true\` to receive it as a file attachment instead, with a\
> \`Content-Disposition\` header and a key-type-specific content type\
> (\`application/pgp-keys\` with a \`.asc\` filename for GPG keys,\
> \`application/x-pem-file\` with a \`.rsa.pub\` filename for RSA keys).
```json
{"openapi":"3.0.0","info":{"title":"Harness Artifact Registry API","version":"1.0.0"},"tags":[{"description":"V3 signing key management endpoints","name":"Registry V3 - Signing Keys"}],"servers":[{"url":"/api"}],"paths":{"/v3/signing-keys/{id}/public-key":{"get":{"description":"Returns the public key for a signing key in ASCII-armored format\n(PGP for GPG keys, PEM for RSA keys). Used by clients to verify\nsignatures.\n\nBy default the key is returned inline as `text/plain`. Pass\n`download=true` to receive it as a file attachment instead, with a\n`Content-Disposition` header and a key-type-specific content type\n(`application/pgp-keys` with a `.asc` filename for GPG keys,\n`application/x-pem-file` with a `.rsa.pub` filename for RSA keys).\n","operationId":"GetSigningKeyPublicKeyV3","parameters":[{"$ref":"#/components/parameters/AccountIdentifierV3"},{"$ref":"#/components/parameters/IdPathParamV3"},{"$ref":"#/components/parameters/PublicKeyDownloadQueryParamV3"}],"responses":{"200":{"content":{"application/pgp-keys":{"schema":{"format":"binary","type":"string"}},"application/x-pem-file":{"schema":{"format":"binary","type":"string"}},"text/plain":{"schema":{"type":"string"}}},"description":"Public key content. Returned inline as `text/plain` by default, or\nas a file attachment when `download=true`.\n","headers":{"Content-Disposition":{"description":"Attachment header with a filename based on key type. Only set\nwhen `download=true`.\n","schema":{"type":"string"}}}},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorV3"}}},"description":"Error response."}},"summary":"Get public key","tags":["Registry V3 - Signing Keys"]}}},"components":{"parameters":{"AccountIdentifierV3":{"description":"Unique identifier for the Harness account.\n","in":"query","name":"account_identifier","required":true,"schema":{"type":"string"}},"IdPathParamV3":{"in":"path","name":"id","required":true,"schema":{"type":"string"}},"PublicKeyDownloadQueryParamV3":{"description":"When `true`, the public key is returned as a file attachment with a `Content-Disposition` header and a key-type-specific content type (`application/pgp-keys` with a `.asc` filename for GPG keys, `application/x-pem-file` with a `.rsa.pub` filename for RSA keys). Defaults to `false`, which returns the ASCII-armored key inline as `text/plain`.\n","in":"query","name":"download","schema":{"default":false,"type":"boolean"}}},"schemas":{"ErrorV3":{"description":"An error response","properties":{"error":{"$ref":"#/components/schemas/ApiErrorsV3"}},"required":["error"],"type":"object"},"ApiErrorsV3":{"properties":{"code":{"description":"For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.","maxLength":5000,"type":"string"},"message":{"description":"A human-readable message providing more details about the error. These messages can be shown to users.","maxLength":40000,"type":"string"},"param":{"description":"If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.","maxLength":5000,"type":"string"},"type":{"description":"The type of error returned.","enum":["INVALID_REQUEST_ERROR","AUTHENTICATION_ERROR","PERMISSION_ERROR","API_ERROR"],"type":"string"}},"required":["type"],"title":"APIErrors","type":"object"}}}}
```
## Generate a new signing key
> Generates a new signing key (GPG or RSA), stores it in Harness Secret Manager,\
> and persists metadata to the database. The private key is never stored in the database.
```json
{"openapi":"3.0.0","info":{"title":"Harness Artifact Registry API","version":"1.0.0"},"tags":[{"description":"V3 signing key management endpoints","name":"Registry V3 - Signing Keys"}],"servers":[{"url":"/api"}],"paths":{"/v3/signing-keys/generate":{"post":{"description":"Generates a new signing key (GPG or RSA), stores it in Harness Secret Manager,\nand persists metadata to the database. The private key is never stored in the database.\n","operationId":"GenerateSigningKeyV3","parameters":[{"$ref":"#/components/parameters/AccountIdentifierV3"},{"$ref":"#/components/parameters/OrgIdentifierV3"},{"$ref":"#/components/parameters/ProjectIdentifierV3"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateKeyRequestV3"}}},"required":true},"responses":{"201":{"$ref":"#/components/responses/SigningKeyDetailsResponseV3"},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorV3"}}},"description":"Error response."}},"summary":"Generate a new signing key","tags":["Registry V3 - Signing Keys"]}}},"components":{"parameters":{"AccountIdentifierV3":{"description":"Unique identifier for the Harness account.\n","in":"query","name":"account_identifier","required":true,"schema":{"type":"string"}},"OrgIdentifierV3":{"description":"Unique identifier for the organization within the account.\n\nExample: `default` or `engineering_org`\n","in":"query","name":"org_identifier","schema":{"type":"string"}},"ProjectIdentifierV3":{"description":"Unique identifier for the project within the organization.\n\nExample: `my_project` or `frontend_services`\n","in":"query","name":"project_identifier","schema":{"type":"string"}}},"schemas":{"GenerateKeyRequestV3":{"description":"Request to generate a new signing key.\n\n`type` selects the cryptographic system to generate:\n- GPG: OpenPGP key for package signing (Debian, RPM, Alpine)\n- RSA: Raw RSA key for direct signing operations\n\n`algorithm` selects the underlying algorithm. Only RSA and ED25519 can\nbe generated; other `SigningKeyAlgorithmV3` values (e.g. ECDSA) are\nrejected with 400 here but may appear on imported keys.\n\nKey size is not a request parameter. It is fixed per algorithm so that\nevery generated key is one package clients are known to accept:\n- GPG + ED25519: 256 bits (fixed by the curve)\n- GPG + RSA: 4096 bits\n- RSA + RSA: 4096 bits\n\nThe resulting size is reported as `size` on the created key.\n\nSupported combinations: GPG + ED25519, GPG + RSA, RSA + RSA. Pairing\n`type: RSA` with `algorithm: ED25519` is rejected with 400.\n","properties":{"algorithm":{"$ref":"#/components/schemas/SigningKeyAlgorithmV3"},"expirationAt":{"description":"Optional expiration timestamp in Unix milliseconds","format":"int64","nullable":true,"type":"integer"},"name":{"description":"Human-readable name for the key","maxLength":128,"type":"string"},"type":{"$ref":"#/components/schemas/SigningKeyTypeV3"}},"required":["name","type","algorithm"],"type":"object"},"SigningKeyAlgorithmV3":{"description":"Underlying cryptographic algorithm of a signing key. Known values include: RSA, ED25519, ECDSA. This field is extensible; clients must handle unknown values. Note that only RSA and ED25519 can be generated; ECDSA is only observed on imported keys.\n","type":"string"},"SigningKeyTypeV3":{"description":"Cryptographic system of a signing key. Known values include: GPG (for Debian, RPM, Alpine), RSA (for direct signing operations). This field is extensible; clients must handle unknown values.\n","type":"string"},"SigningKeyV3":{"description":"A signing key used for repository metadata signing (Debian, Alpine, etc.)","properties":{"algorithm":{"$ref":"#/components/schemas/SigningKeyAlgorithmV3"},"createdAt":{"$ref":"#/components/schemas/CreatedAtMsV3"},"createdBy":{"$ref":"#/components/schemas/UserInfoV3"},"expirationAt":{"description":"Expiration timestamp in Unix milliseconds (null if never expires)","format":"int64","nullable":true,"type":"integer"},"fingerprint":{"description":"Primary identifier (GPG 40 hex chars, RSA SHA256 of public key 64 hex chars)","type":"string"},"id":{"description":"Unique internal identifier of the signing key","format":"uuid","type":"string"},"longKeyId":{"description":"Last 16 hex chars of fingerprint (for CLI compatibility)","type":"string"},"modifiedAt":{"$ref":"#/components/schemas/ModifiedAtMsV3"},"name":{"description":"Human-readable name for UI/API","type":"string"},"shortKeyId":{"description":"Last 8 hex chars of fingerprint (for CLI compatibility)","type":"string"},"size":{"description":"Key strength in bits (e.g. 2048, 3072, 4096 for RSA)","format":"int32","nullable":true,"type":"integer"},"source":{"description":"Origin of the key (created by system or provided by user)","enum":["GENERATED","IMPORTED"],"type":"string"},"status":{"$ref":"#/components/schemas/SigningKeyStatusV3"},"type":{"$ref":"#/components/schemas/SigningKeyTypeV3"},"updatedBy":{"$ref":"#/components/schemas/UserInfoV3"}},"required":["id","name","type","source","status","fingerprint","algorithm","createdAt","modifiedAt"],"type":"object"},"CreatedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was created","format":"int64","nullable":true,"type":"integer"},"UserInfoV3":{"description":"Structured user information for a principal","properties":{"display_name":{"description":"Human-readable display name","type":"string"},"email":{"description":"Email address","type":"string"},"type":{"description":"Principal type (user, service, service_account)","type":"string"},"uid":{"description":"Principal unique identifier (username)","type":"string"}},"type":"object"},"ModifiedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was last modified","format":"int64","nullable":true,"type":"integer"},"SigningKeyStatusV3":{"description":"Lifecycle state of a signing key. Known values include: ACTIVE, INACTIVE (expired or manually deactivated), REVOKED (compromised), DELETED (deleted). This field is extensible; clients must handle unknown values.\n","type":"string"},"ErrorV3":{"description":"An error response","properties":{"error":{"$ref":"#/components/schemas/ApiErrorsV3"}},"required":["error"],"type":"object"},"ApiErrorsV3":{"properties":{"code":{"description":"For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.","maxLength":5000,"type":"string"},"message":{"description":"A human-readable message providing more details about the error. These messages can be shown to users.","maxLength":40000,"type":"string"},"param":{"description":"If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.","maxLength":5000,"type":"string"},"type":{"description":"The type of error returned.","enum":["INVALID_REQUEST_ERROR","AUTHENTICATION_ERROR","PERMISSION_ERROR","API_ERROR"],"type":"string"}},"required":["type"],"title":"APIErrors","type":"object"}},"responses":{"SigningKeyDetailsResponseV3":{"content":{"application/json":{"schema":{"properties":{"data":{"$ref":"#/components/schemas/SigningKeyV3"}},"required":["data"],"type":"object"}}},"description":"Signing key details"}}}}
```
## Import an existing signing key
> Imports an existing signing key from Harness Secret Manager by validating it\
> and storing metadata in the database. The private key remains in the user-provided\
> secret reference (not copied).
```json
{"openapi":"3.0.0","info":{"title":"Harness Artifact Registry API","version":"1.0.0"},"tags":[{"description":"V3 signing key management endpoints","name":"Registry V3 - Signing Keys"}],"servers":[{"url":"/api"}],"paths":{"/v3/signing-keys/import":{"post":{"description":"Imports an existing signing key from Harness Secret Manager by validating it\nand storing metadata in the database. The private key remains in the user-provided\nsecret reference (not copied).\n","operationId":"ImportSigningKeyV3","parameters":[{"$ref":"#/components/parameters/AccountIdentifierV3"},{"$ref":"#/components/parameters/OrgIdentifierV3"},{"$ref":"#/components/parameters/ProjectIdentifierV3"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportKeyRequestV3"}}},"required":true},"responses":{"201":{"$ref":"#/components/responses/SigningKeyDetailsResponseV3"},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorV3"}}},"description":"Error response."}},"summary":"Import an existing signing key","tags":["Registry V3 - Signing Keys"]}}},"components":{"parameters":{"AccountIdentifierV3":{"description":"Unique identifier for the Harness account.\n","in":"query","name":"account_identifier","required":true,"schema":{"type":"string"}},"OrgIdentifierV3":{"description":"Unique identifier for the organization within the account.\n\nExample: `default` or `engineering_org`\n","in":"query","name":"org_identifier","schema":{"type":"string"}},"ProjectIdentifierV3":{"description":"Unique identifier for the project within the organization.\n\nExample: `my_project` or `frontend_services`\n","in":"query","name":"project_identifier","schema":{"type":"string"}}},"schemas":{"ImportKeyRequestV3":{"description":"Request to import an existing signing key from secret manager. `type` is the cryptographic system of the key being imported.\n\nPassphrase-protected keys are supported for both GPG and RSA. Supply `passphraseSecretIdentifier` and `passphraseSecretSpacePath` together; providing only one is rejected with 400. The passphrase is stored as a secret reference and re-read on every signing operation, so it must remain readable for the lifetime of the key.\n\nAccepted RSA private key encodings:\n- PKCS#1 (`RSA PRIVATE KEY`), encrypted or not\n- PKCS#8 (`PRIVATE KEY` / `ENCRYPTED PRIVATE KEY`)\n- OpenSSH (`OPENSSH PRIVATE KEY`), encrypted or not\n","properties":{"expirationAt":{"description":"Optional expiration timestamp in Unix milliseconds.\nPriority: provided value > key's embedded expiration > no expiration.\nNote: RSA keys don't have embedded expiration, so this is the only way to set expiration for RSA keys.\n","format":"int64","nullable":true,"type":"integer"},"name":{"description":"Human-readable name for the key","maxLength":128,"type":"string"},"passphraseSecretIdentifier":{"description":"Reference to the passphrase secret. Required when the private key is encrypted, for both GPG and RSA keys, and must be provided together with passphraseSecretSpacePath.\n","nullable":true,"type":"string"},"passphraseSecretSpacePath":{"description":"Space path for the passphrase secret (e.g., \"accountId/orgId/projectId\"). Must be provided together with passphraseSecretIdentifier; defaults to the private key's space when omitted.\n","nullable":true,"type":"string"},"privateKeySecretIdentifier":{"description":"Reference to private key secret in Harness Secret Manager","type":"string"},"privateKeySecretSpacePath":{"description":"Space path for the private key secret (e.g., \"accountId/orgId/projectId\")","type":"string"},"type":{"$ref":"#/components/schemas/SigningKeyTypeV3"}},"required":["name","type","privateKeySecretIdentifier","privateKeySecretSpacePath"],"type":"object"},"SigningKeyTypeV3":{"description":"Cryptographic system of a signing key. Known values include: GPG (for Debian, RPM, Alpine), RSA (for direct signing operations). This field is extensible; clients must handle unknown values.\n","type":"string"},"SigningKeyV3":{"description":"A signing key used for repository metadata signing (Debian, Alpine, etc.)","properties":{"algorithm":{"$ref":"#/components/schemas/SigningKeyAlgorithmV3"},"createdAt":{"$ref":"#/components/schemas/CreatedAtMsV3"},"createdBy":{"$ref":"#/components/schemas/UserInfoV3"},"expirationAt":{"description":"Expiration timestamp in Unix milliseconds (null if never expires)","format":"int64","nullable":true,"type":"integer"},"fingerprint":{"description":"Primary identifier (GPG 40 hex chars, RSA SHA256 of public key 64 hex chars)","type":"string"},"id":{"description":"Unique internal identifier of the signing key","format":"uuid","type":"string"},"longKeyId":{"description":"Last 16 hex chars of fingerprint (for CLI compatibility)","type":"string"},"modifiedAt":{"$ref":"#/components/schemas/ModifiedAtMsV3"},"name":{"description":"Human-readable name for UI/API","type":"string"},"shortKeyId":{"description":"Last 8 hex chars of fingerprint (for CLI compatibility)","type":"string"},"size":{"description":"Key strength in bits (e.g. 2048, 3072, 4096 for RSA)","format":"int32","nullable":true,"type":"integer"},"source":{"description":"Origin of the key (created by system or provided by user)","enum":["GENERATED","IMPORTED"],"type":"string"},"status":{"$ref":"#/components/schemas/SigningKeyStatusV3"},"type":{"$ref":"#/components/schemas/SigningKeyTypeV3"},"updatedBy":{"$ref":"#/components/schemas/UserInfoV3"}},"required":["id","name","type","source","status","fingerprint","algorithm","createdAt","modifiedAt"],"type":"object"},"SigningKeyAlgorithmV3":{"description":"Underlying cryptographic algorithm of a signing key. Known values include: RSA, ED25519, ECDSA. This field is extensible; clients must handle unknown values. Note that only RSA and ED25519 can be generated; ECDSA is only observed on imported keys.\n","type":"string"},"CreatedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was created","format":"int64","nullable":true,"type":"integer"},"UserInfoV3":{"description":"Structured user information for a principal","properties":{"display_name":{"description":"Human-readable display name","type":"string"},"email":{"description":"Email address","type":"string"},"type":{"description":"Principal type (user, service, service_account)","type":"string"},"uid":{"description":"Principal unique identifier (username)","type":"string"}},"type":"object"},"ModifiedAtMsV3":{"description":"Unix timestamp in milliseconds when the resource was last modified","format":"int64","nullable":true,"type":"integer"},"SigningKeyStatusV3":{"description":"Lifecycle state of a signing key. Known values include: ACTIVE, INACTIVE (expired or manually deactivated), REVOKED (compromised), DELETED (deleted). This field is extensible; clients must handle unknown values.\n","type":"string"},"ErrorV3":{"description":"An error response","properties":{"error":{"$ref":"#/components/schemas/ApiErrorsV3"}},"required":["error"],"type":"object"},"ApiErrorsV3":{"properties":{"code":{"description":"For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.","maxLength":5000,"type":"string"},"message":{"description":"A human-readable message providing more details about the error. These messages can be shown to users.","maxLength":40000,"type":"string"},"param":{"description":"If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.","maxLength":5000,"type":"string"},"type":{"description":"The type of error returned.","enum":["INVALID_REQUEST_ERROR","AUTHENTICATION_ERROR","PERMISSION_ERROR","API_ERROR"],"type":"string"}},"required":["type"],"title":"APIErrors","type":"object"}},"responses":{"SigningKeyDetailsResponseV3":{"content":{"application/json":{"schema":{"properties":{"data":{"$ref":"#/components/schemas/SigningKeyV3"}},"required":["data"],"type":"object"}}},"description":"Signing key details"}}}}
```
## Get signing key summary
> Returns aggregate signing key counts for the requested scope: the total\
> number of keys, the number of registries referencing a key in that\
> scope, and the number of ACTIVE keys expiring within the next 30 days.\
> \
> Counts apply to the requested scope only — they are not rolled up from\
> parent or child scopes.
```json
{"openapi":"3.0.0","info":{"title":"Harness Artifact Registry API","version":"1.0.0"},"tags":[{"description":"V3 signing key management endpoints","name":"Registry V3 - Signing Keys"}],"servers":[{"url":"/api"}],"paths":{"/v3/signing-keys/summary":{"get":{"description":"Returns aggregate signing key counts for the requested scope: the total\nnumber of keys, the number of registries referencing a key in that\nscope, and the number of ACTIVE keys expiring within the next 30 days.\n\nCounts apply to the requested scope only — they are not rolled up from\nparent or child scopes.\n","operationId":"GetSigningKeySummaryV3","parameters":[{"$ref":"#/components/parameters/AccountIdentifierV3"},{"$ref":"#/components/parameters/OrgIdentifierV3"},{"$ref":"#/components/parameters/ProjectIdentifierV3"}],"responses":{"200":{"$ref":"#/components/responses/SigningKeySummaryResponseV3"},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorV3"}}},"description":"Error response."}},"summary":"Get signing key summary","tags":["Registry V3 - Signing Keys"]}}},"components":{"parameters":{"AccountIdentifierV3":{"description":"Unique identifier for the Harness account.\n","in":"query","name":"account_identifier","required":true,"schema":{"type":"string"}},"OrgIdentifierV3":{"description":"Unique identifier for the organization within the account.\n\nExample: `default` or `engineering_org`\n","in":"query","name":"org_identifier","schema":{"type":"string"}},"ProjectIdentifierV3":{"description":"Unique identifier for the project within the organization.\n\nExample: `my_project` or `frontend_services`\n","in":"query","name":"project_identifier","schema":{"type":"string"}}},"responses":{"SigningKeySummaryResponseV3":{"content":{"application/json":{"schema":{"properties":{"data":{"$ref":"#/components/schemas/SigningKeySummaryV3"}},"required":["data"],"type":"object"}}},"description":"Aggregate signing key counts for the requested scope"}},"schemas":{"SigningKeySummaryV3":{"description":"Aggregate signing key counts for a single scope (account, org, or project). Counts cover only the requested scope and are not rolled up from parent or child scopes.\n","properties":{"expiringSoon":{"description":"Number of ACTIVE keys whose expiry falls within the next 30 days. Keys that never expire, and keys that have already expired, are excluded.\n","format":"int64","type":"integer"},"referencedRegistries":{"description":"Number of registries that have a signing configuration pointing at a key in this scope, whether or not signing is currently enabled on them. Soft-deleted registries are excluded.\n","format":"int64","type":"integer"},"totalKeys":{"description":"Total number of signing keys in the scope, including deleted keys (status DELETED).\n","format":"int64","type":"integer"}},"required":["totalKeys","referencedRegistries","expiringSoon"],"type":"object"},"ErrorV3":{"description":"An error response","properties":{"error":{"$ref":"#/components/schemas/ApiErrorsV3"}},"required":["error"],"type":"object"},"ApiErrorsV3":{"properties":{"code":{"description":"For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.","maxLength":5000,"type":"string"},"message":{"description":"A human-readable message providing more details about the error. These messages can be shown to users.","maxLength":40000,"type":"string"},"param":{"description":"If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.","maxLength":5000,"type":"string"},"type":{"description":"The type of error returned.","enum":["INVALID_REQUEST_ERROR","AUTHENTICATION_ERROR","PERMISSION_ERROR","API_ERROR"],"type":"string"}},"required":["type"],"title":"APIErrors","type":"object"}}}}
```