Skip to main content
GET
/
auth
/
delegated-keys
/
{id}
Get a delegated signing key
curl --request GET \
  --url https://api.lightspark.com/grid/2025-10-13/auth/delegated-keys/{id} \
  --header 'Authorization: Basic <encoded-value>'
{
  "id": "DelegatedKey:019542f5-b3e7-1d02-0000-000000000021",
  "cardId": "Card:019542f5-b3e7-1d02-0000-000000000010",
  "accountId": "InternalAccount:019542f5-b3e7-1d02-0000-000000000002",
  "publicKey": "02a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90",
  "nickname": "Settlement service key",
  "status": "ACTIVE",
  "createdAt": "2026-04-08T15:30:01Z",
  "updatedAt": "2026-04-08T15:30:42Z"
}

Authorizations

​
Authorization
string
header
required

API token authentication using format <api token id>:<api client secret>

Path Parameters

​
id
string
required

The id of the delegated key to retrieve (the id field of the DelegatedKey returned from POST /auth/delegated-keys or GET /auth/delegated-keys).

Response

Successful operation

A delegated signing key for a card backed by an Embedded Wallet internal account. Returned from POST /auth/delegated-keys (on activation), GET /auth/delegated-keys (list), and GET /auth/delegated-keys/{id}. The keypair is generated and custodied by Grid; the private key is never returned. While ACTIVE, Grid may use the key to authorize Spark token-transaction signing for the card's Embedded Wallet funding account in place of a session keypair. publicKey is informational metadata identifying the credential.

​
id
string
required

Grid-issued DelegatedKey:<uuid> identifier.

Example:

"DelegatedKey:019542f5-b3e7-1d02-0000-000000000021"

​
cardId
string
required

The card this key is delegated for.

Example:

"Card:019542f5-b3e7-1d02-0000-000000000010"

​
accountId
string
required

The Embedded Wallet internal account this key is delegated for, derived from the card's funding sources.

Example:

"InternalAccount:019542f5-b3e7-1d02-0000-000000000002"

​
publicKey
string
required

Compressed P-256 public key (hex) of the delegated API keypair.

Example:

"02a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90"

​
nickname
string
required

Human-readable label for the delegated key.

Example:

"Settlement service key"

​
status
enum<string>
required

Status of a delegated signing key.

  • PENDING: The delegated user exists but the policy-creation leg never completed. The key cannot sign.
  • ACTIVE: The policy is granted and the key may stamp quote executions.
  • REVOKED: The delegated user has been deleted and the key can no longer sign.
Available options:
PENDING,
ACTIVE,
REVOKED
Example:

"ACTIVE"

​
createdAt
string<date-time>
required

When the delegated key was created.

Example:

"2026-04-08T15:30:01Z"

​
updatedAt
string<date-time>
required

When the delegated key was last updated.

Example:

"2026-04-08T15:30:42Z"