Skip to content

Configuration endpoints

Witness has two public configuration surfaces with different purposes.

Informational configuration

GET /v1/config

The response is NetworkConfigPublic:

{
  "id": "home",
  "threshold": 2,
  "signature_scheme": "ed25519",
  "witness_count": 3
}

It reports network identity, threshold, signature scheme, and count only. It does not include witness public keys and cannot verify signatures.

Verification configuration

GET /v1/network

The response is a secret-free NetworkVerificationConfig containing:

  • id;
  • witnesses, each with id and pubkey;
  • threshold;
  • signature_scheme, ed25519 or bls; and
  • public federation policy (enabled, peer_networks, and cross_anchor_threshold).

It excludes witness endpoints, bearer tokens, inbound federation secrets, and external-anchor provider configuration. Peer gateway URLs used for public federation discovery may be present in peer_networks.

Trust boundary

/v1/network is suitable as an input format, not an automatic independent trust decision. If a gateway may be untrusted, pin or independently review the configuration before using it as the public-key trust anchor. Operator network.json files are accepted by the CLI as a superset for offline loading, but can contain secrets and should be protected.