/v1/generators

Generators are the entities that sign content. Each generator has an ML-DSA keypair. A generator belongs to one organization.

All endpoints require authentication — Authorization: Bearer ctv_key_…

---

List generators

GET /v1/generators

Returns all generators for the authenticated organization.

{
  "generators": [
    {
      "generator_id": "gen_abc123",
      "org_id": "org_xyz",
      "name": "prod-sdxl",
      "status": "active",
      "public_keys": [
        { "kid": "key_1", "algorithm": "ml-dsa-65", "key": "<base64>" }
      ]
    }
  ]
}

---

Get a generator

GET /v1/generators/:generator_id

---

Register a generator

POST /v1/generators
Content-Type: application/json

{
  "name": "prod-sdxl",
  "public_keys": [
    { "kid": "key_1", "algorithm": "ml-dsa-65", "key": "<base64 public key>" }
  ]
}

Generate a keypair with:

bun run infra/scripts/gen-keys.ts --org-name "Acme AI" --generator-name "prod-sdxl"

Returns { generator_id, name, status }.

---

Revoke a generator

PUT /v1/generators/:generator_id/revoke

Sets status: "revoked". All signatures from a revoked generator immediately become invalid. This action cannot be undone.

Returns { generator_id, status: "revoked" }.

---

Get public keys

GET /v1/keys/:generator_id

Public endpoint — no authentication required. Used by the verification flow to retrieve the generator’s public key for ML-DSA signature verification.