Export JWK File

Endpoint

GET /apiops/projects/{projectName}/jwks/{jwkName}/export-file/

Info

This is the raw document download. To move a JWK between Apinizer installations, use the Export Objects endpoint with type CERTIFICATE, which produces an Apinizer package.

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
jwkName	string	Yes	JWK name

Query Parameters

Parameter	Type	Required	Default	Description
publicOnly	boolean	No	false	When true, only the public members are written — what a published JWKS endpoint serves. When false, the stored material is returned as it is

Response

Success Response (200 OK)

The response is the JWK Set document.

• Content-Type: application/json
• Content-Disposition: attachment; filename="<jwkName>.json", or "<jwkName>-public.json" with publicOnly=true

Default (the stored material, private members included):

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "1735689600",
      "use": "sig",
      "alg": "RS256",
      "n": "...",
      "e": "AQAB",
      "d": "...",
      "p": "...",
      "q": "...",
      "dp": "...",
      "dq": "...",
      "qi": "..."
    }
  ]
}

With publicOnly=true:

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "1735689600",
      "use": "sig",
      "alg": "RS256",
      "n": "...",
      "e": "AQAB"
    }
  ]
}

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "JWK (name: signing-jwk) is not found!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "JWK (name: signing-jwk) carries no key material to export!"
}

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

Example 1: Download the Full JWK Set

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/jwks/signing-jwk/export-file/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  --output signing-jwk.json

Example 2: Download a Publishable JWKS

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/jwks/signing-jwk/export-file/?publicOnly=true" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  --output jwks.json

Notes and Warnings

• Use publicOnly=true for anything you publish: it removes the private members (d, p, q, dp, dq, qi), which is what a relying party needs and all it should ever receive.
• The default carries private material: it matches what the package export of the same object carries, so the two never disagree about what a JWK contains. Keep the token that can call this endpoint tightly scoped.
• A public-only JWK yields the same document either way: when the stored material has no private members, both forms return the public one.
• Symmetric keys have no public form: for those, publicOnly=true returns nothing to publish and the call reports it rather than emitting an empty document.

Permissions

• User must have SECRETS + EXPORT_IMPORT permission in the project

Related Documentation

• Import JWK File - Upload a raw JWK document
• Generate JWK - Generate a new JWK in place
• Parse JWK from Clipboard - Supply a JWK as text instead of a file