The service's public key
Unauthenticated, because a client needs this before it can encrypt a request body. Use it to wrap a request as an RFC 7516 JWE when the payload should not be readable by anything between the client and this service, including the reverse proxy that terminates TLS.
Distribution only: there is no API call that rotates this pair. A pair
that a rotation replaces stays valid until it expires, so requests
already in flight still decrypt. Re-read this endpoint after
rotates_after to pick the successor up.
Response
The current public key.
Names this pair, and travels in the JWE header.
"QANAPI-PUB-1DAF66C2"
"RSA-2048"
PEM.
When the service begins advertising a successor. Re-read this endpoint after it.
After this, a payload wrapped to this pair is no longer accepted.