Get a delegated signing key

Retrieve a delegated signing key by its system-generated id.

GET /auth/delegated-keys/{id}

Get a delegated signing key

cURL

curl --request GET \
  --url https://api.lightspark.com/grid/2025-10-13/auth/delegated-keys/{id} \
  --header 'Authorization: Basic <encoded-value>'

200

{
  "id": "DelegatedKey:019542f5-b3e7-1d02-0000-000000000021",
  "accountId": "InternalAccount:019542f5-b3e7-1d02-0000-000000000002",
  "publicKey": "02a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90",
  "nickname": "Settlement service key",
  "status": "ACTIVE",
  "createdAt": "2026-04-08T15:30:01Z",
  "updatedAt": "2026-04-08T15:30:42Z",
  "cardId": "Card:019542f5-b3e7-1d02-0000-000000000010",
  "fundingSourceId": "CardFundingSource:019542f5-b3e7-1d02-0000-000000000011",
  "agentId": "Agent:019542f5-b3e7-1d02-0000-000000000042"
}

Authorizations

Authorization · string · header · required

API token authentication using format <api token id>:<api client secret>

Path Parameters

id · string · required

The id of the delegated key to retrieve (the id field of the DelegatedKey returned from POST /auth/delegated-keys or GET /auth/delegated-keys).

Response

200

application/json

Successful operation

A delegated signing key for either a card funding source or an agent, backed by an Embedded Wallet internal account. Card keys include cardId and fundingSourceId; agent keys include agentId. Returned from POST /auth/delegated-keys (on activation), GET /auth/delegated-keys (list), and GET /auth/delegated-keys/{id}. The keypair is generated and custodied by Grid; the private key is never returned. While ACTIVE, Grid may use the key to authorize Spark token-transaction signing for the selected card funding source or agent in place of a session keypair. publicKey is informational metadata identifying the credential.

id · string · required

Grid-issued DelegatedKey:<uuid> identifier.

Example:

"DelegatedKey:019542f5-b3e7-1d02-0000-000000000021"

accountId · string · required

The Embedded Wallet internal account this key is delegated for, derived from the card funding source or the agent's customer.

Example:

"InternalAccount:019542f5-b3e7-1d02-0000-000000000002"

publicKey · string · required

Compressed P-256 public key (hex) of the delegated API keypair.

Example:

"02a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90"

nickname · string · required

Human-readable label for the delegated key.

Example:

"Settlement service key"

status · enum<string> · required

Status of a delegated signing key.

• PENDING: The delegated user exists but the policy-creation leg never completed. The key cannot sign.
• ACTIVE: The policy is granted and the key may stamp quote executions.
• REVOKED: The delegated user has been deleted and the key can no longer sign.

Available options: PENDING, ACTIVE, REVOKED

Example:

"ACTIVE"

createdAt · string<date-time> · required

When the delegated key was created.

Example:

"2026-04-08T15:30:01Z"

updatedAt · string<date-time> · required

When the delegated key was last updated.

Example:

"2026-04-08T15:30:42Z"

cardId · string

The card this key is delegated for. Present only for card keys.

Example:

"Card:019542f5-b3e7-1d02-0000-000000000010"

fundingSourceId · string

The card funding source this key is delegated for. Present only for card keys.

Example:

"CardFundingSource:019542f5-b3e7-1d02-0000-000000000011"

agentId · string

The agent this key is delegated for. Present only for agent keys.

Example:

"Agent:019542f5-b3e7-1d02-0000-000000000042"