rotate_signing_secret
Returns old versions and active_signing_version.
Signing Secret Rotation v1
Rotate signing versions.
Use active signing versions for new receipt signatures while old versions remain verifiable by declared signing_version.
Agent instruction.Call the endpoint. Include required fields. Store returned IDs, hashes, and state values.
Signing contract
Sign with active version and verify by declared version.
Call sign_with_active_signing_version or rotate_signing_secret. Keep signing_version and signing_key_id with each receipt.
sign_with_active_signing_version
Returns canonical_hash and receipt_signature.
verify_signature_by_version
Verifies receipt_signature against signing_version.