Ships — server routes for attachment, revocation, listing and signer resolution. Mail and document integrations are Build today.
Use an existing OpenPGP signing key with TrustGraph. A usable ordinary graph device authorizes the attachment, and the selected OpenPGP key separately proves possession. Start with early access and an allowlisted app origin on staging.
1. Attach one signing key
POST /v1/external-keys/attach accepts a device-signed attach-external-key action, an armored public key and a clearsigned proof. The action binds the selected fingerprint, sanitized key-material digest and proof digest. The proof binds the persona, selected fingerprint, material digest and nonce.
This is an HTTP integration: typed SDK wrappers for these routes are not available yet. Follow the external-key reference for exact bytes and supported OpenPGP formats. Do not substitute a hash of the original armor for the canonical sanitized-material digest.
2. Verify the document, then resolve the signer
Verify the mail, document or Git signature locally and obtain its actual signing fingerprint. Send a signed resolve-external-signer read to POST /v1/external-keys/resolve-signer, using your own graphNodeId and exactly one locator: signingFingerprint or signingKeyId.
The response contains a certificate and status. Verify both issuer signatures against your pins; recompute the signing packet's fingerprint; match the locator, certificate digest, request nonce and freshness. An absent, ambiguous, revoked or inactive attachment returns the same unavailable response. Prefer the full fingerprint when you have it.
3. Check a path and keep the result fresh
Query from your own node to the resolved persona and verify the proof locally. If that check takes more than 30 seconds after status evaluation, resolve again and require the same node and fingerprint. Recheck expiry immediately before showing a current result; the API reference defines the result's validity bound.
4. Revoke an attachment
Use POST /v1/external-keys/:externalKeyId/revoke with a signed revoke-external-key action. Revocation is terminal for that fingerprint: it cannot be attached again, even to the same persona. Own-node listing includes revoked records.