Re-sign data (streaming).

post

https://staging.ankatech.co/api/v3/crypto/stream/resign

Verifies a detached-JWS (oldJws) under oldKid—
either the header's kid or sourceKidOverride
if the header lacks a kid—and immediately signs the same payload with
newKid. The response is multipart/mixed (PRD §64):

PART 1 (application/octet-stream) is the new detached-JWS JSON and the
trailing PART 2 (application/json) is a StreamVerdict emitted
AFTER the source (old) signature is verified — an INVALID verdict signals a
source-signature failure discovered at end-of-stream.

Supports all key type combinations:

• SIMPLE → SIMPLE (single signature → single signature)

• SIMPLE → COMPOSITE (single signature → multiple signatures)

• COMPOSITE → COMPOSITE (multiple signatures → multiple signatures)

• COMPOSITE → SIMPLE (multiple signatures → single signature)

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Sequential multipart body — the parts are read in the order they arrive and the server never buffers the payload.

metadata MUST be sent before file. A file-first body is rejected with 400 application/problem+json, type .../errors/multipart-part-order. This is a property of streaming, not a policy: the server cannot look ahead past a 512 MiB payload to find the part that tells it what to do with it.

metadata is bounded at 2 MiB; file has no size limit.

metadata

object

required

JSON metadata sent in the metadata field when streaming a
re-sign request. Carries the existing detached JWS, the new signing key,
an optional override for a missing header kid, and optional validity period.

file

required

Binary data to be re-signed. No size limit.

Headers

string

enum

Defaults to application/problem+json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

multipart/mixed

application/problem+json

200multipart/mixed: PART 1 the new detached-JWS JSON, trailing PART 2 the end-of-stream StreamVerdict (VALID/INVALID after the source-signature check).

400Invalid Base64, signature mismatch, or key does not support the requested operation. PQC session transport is also refused here: an X-PQC-Transport: true or X-PQC-Session header on this route yields .../errors/pqc-transport-not-available-for-streaming, refused before any body byte is read.

401Unauthorized.

404oldKid/newKid not found.

409Conflict: the tenant's key-protection backend is not configured - never declared, or declared but not yet bound. Durable: complete the setup rather than retrying. No Retry-After is sent.

413Payload Too Large: the small part (metadata or header) exceeded its 2 MiB cap. file has NO size limit — this response never refers to the payload.

429Too Many Requests: the streaming concurrency bound is full, either globally or for this tenant. Retry-After carries the suggested delay in seconds. This bound replaced the edge client_max_body_size ceiling PRD §130 removed, so it is emittable on every streaming endpoint.

500Unexpected failure.

503Service Unavailable: the tenant's key-protection backend is bound but not currently usable. Transient - retry after the Retry-After interval. The body is oracle-safe and names no backend, token, slot, PIN or vendor.