Get Agent Certificate

GET

/api/v1/trust/agent-certificates/{cert_id}

• Production
• Local development

Return public-key + Merkle proof + signed-action count for a cert.

cert_id may be either:

• 64-char lowercase hex SHA-256 fingerprint, or
• RFC-4122 UUID string of the certificate row primary key.

The endpoint is unauthenticated — intended for prospects who receive a signed decision and want to verify the agent’s public key independently. Cache-Control is private, no-store so intermediaries do not fan out per-cert lookups.

Returns 404 when the cert id is unknown; 409 when the cert exists but has not yet been appended to the Merkle tree (race window during issuance, fail-closed).

Authorizations

• ApiKeyAuth

Parameters

Path Parameters

cert_id

required

string

Responses

200

Successful Response

object

key

additional properties

any

422

Validation Error

object

detail

Array<object>

object

ctx

object

input

loc

required

Array

msg

required

string

type

required

string