Request body
json
{} (no request body)API Endpoint
POST /management/offline/signing-keys/{id}/retire
Retire a signing key so it is no longer exported as trusted verification material.
POST /management/offline/signing-keys/{id}/retire
Endpoint context
Use these endpoints from internal tooling or your frontend backend to inspect licenses, manage slug policy templates, provisioning API keys, webhook endpoint configuration/logs, and offline JWT signing keys. Management routes require the management bootstrap key configured via MANAGEMENT_API_KEYS or MANAGEMENT_API_KEY.
- Requires management API key auth.
- Retired keys do not sign new tokens and are omitted from public key exports.
- Clients that remove the public key will reject existing offline tokens signed by that kid.
bash
curl -sS -X POST http://localhost:8080/management/offline/signing-keys/1/retire -H "Authorization: Bearer management_key_dev_123456"Response body
json
{
"id": 1,
"name": "desktop-app-2026",
"kid": "61426d843cf40341f68a3053",
"algorithm": "Ed25519",
"status": "retired",
"public_key_pem": "-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
",
"created_at": "2026-04-21T12:00:00Z",
"activated_at": "2026-04-21T12:05:00Z",
"retired_at": "2026-04-22T12:00:00Z"
}Response field types
status
"retired"
The key has been removed from active/verify-only trust.
retired_at
string
RFC3339 timestamp when retirement was recorded.
Error codes
400
Invalid key id.
401
Missing or invalid management API key.
404
Signing key not found.
500
Unexpected server or storage error.