# Add partner public key

Adds one or more public keys for a partner organization to use for token exchange authentication. Accessible to TMC, company, and global admins.

Endpoint: POST /v2/companies/{companyId}/partner-public-keys
Version: v2
Security: Bearer

## Security:

  - `Bearer` (unknown)
    http bearer

## Path parameters:

  - `companyId` (string, required)
    Organization identifier.

## Request fields (application/json):

  - `keyType` (string, required)
    The type of public key being registered.
    Enum: "JWKS"

  - `jwks` (object)
    A JSON Web Key Set (JWKS) per RFC 7517.

  - `jwks.keys` (array, required)
    List of public keys. Exactly one key must be provided per request.

  - `jwks.keys.kty` (string, required)
    Key type. Only RSA is supported.
    Enum: "RSA"

  - `jwks.keys.use` (string, required)
    Key use. Must be sig (signature).
    Enum: "sig"

  - `jwks.keys.alg` (string, required)
    Signing algorithm. Must be RS256.
    Enum: "RS256"

  - `jwks.keys.kid` (string, required)
    Key ID — used to match the JWT header kid during token exchange.

  - `jwks.keys.n` (string, required)
    RSA modulus (base64url-encoded).

  - `jwks.keys.e` (string, required)
    RSA public exponent (base64url-encoded).

## Response 201:

  - `201` (unknown)
    Keys created successfully.

## Response 201 fields (application/json):

  - `keys` (array)
    List of added partner public keys.

  - `keys.id` (string)
    Unique identifier for the key.

  - `keys.orgId` (string)
    Organization this key is scoped to.

  - `keys.kid` (string)
    Key ID extracted from the JWK.

  - `keys.status` (string)
    Key status.
    Enum: "ACTIVE", "REVOKED"

  - `keys.createdAt` (string)
    Timestamp when the key was created.

  - `keys.thumbprint` (string)
    RFC 7638 JWK thumbprint (base64url SHA-256 of canonical key material). Use this to verify the correct key was registered.

## Response 400:

  - `400` (unknown)
    Bad request

## Response 400 fields (application/json):

  - `debugIdentifier` (string)
    Link to debug the error internally.

  - `errorMessages` (array)

  - `errorMessages.errorCode` (string)
    Error code to identify the specific errors.

  - `errorMessages.message` (string)
    Message containing details of error.

  - `errorMessages.errorParameters` (array)
    Error message parameters.

  - `errorMessages.errorParameters.name` (string)
    Parameter name

  - `errorMessages.errorParameters.value` (string)
    Parameter value

  - `errorMessages.errorDetail` (string)
    More details about the error.

## Response 401:

  - `401` (unknown)
    Unauthorized

## Response 401 fields (application/json):

  - `debugIdentifier` (string)
    Link to debug the error internally.

  - `errorMessages` (array)

  - `errorMessages.errorCode` (string)
    Error code to identify the specific errors.

  - `errorMessages.message` (string)
    Message containing details of error.

  - `errorMessages.errorParameters` (array)
    Error message parameters.

  - `errorMessages.errorParameters.name` (string)
    Parameter name

  - `errorMessages.errorParameters.value` (string)
    Parameter value

  - `errorMessages.errorDetail` (string)
    More details about the error.

## Response 403:

  - `403` (unknown)
    Forbidden

## Response 403 fields (application/json):

  - `debugIdentifier` (string)
    Link to debug the error internally.

  - `errorMessages` (array)

  - `errorMessages.errorCode` (string)
    Error code to identify the specific errors.

  - `errorMessages.message` (string)
    Message containing details of error.

  - `errorMessages.errorParameters` (array)
    Error message parameters.

  - `errorMessages.errorParameters.name` (string)
    Parameter name

  - `errorMessages.errorParameters.value` (string)
    Parameter value

  - `errorMessages.errorDetail` (string)
    More details about the error.