Skip to content
Certivu Docs

/v1/generators

Generators are the entities that sign content. Each generator has an ML-DSA keypair. A generator belongs to one organization.

All endpoints require authentication — Authorization: Bearer ctv_key_…

List generators

Section titled “List generators”
GET /v1/generators

Returns all generators for the authenticated organization.

{
  "generators": [
    {
      "generator_id": "gen_abc123",
      "org_id": "org_xyz",
      "name": "prod-sdxl",
      "status": "active",
      "public_keys": [
        { "kid": "key_1", "algorithm": "ml-dsa-65", "key": "<base64>" }
      ]
    }
  ]
}

Get a generator

Section titled “Get a generator”
GET /v1/generators/:generator_id

Register a generator

Section titled “Register a generator”
POST /v1/generators
Content-Type: application/json
{
  "name": "prod-sdxl",
  "supported_formats": ["image"],
  "public_keys": [
    { "kid": "key_1", "algorithm": "ml-dsa-65", "key": "<base64 public key>" }
  ]
}
FieldTypeRequiredDescription
namestringYesHuman-readable name for this generator
supported_formatsstring[]YesFormats this generator may sign: "image", "audio", "text", "video". At least one required.
public_keysarrayNoOmit to use a server-managed keypair (recommended).

A generator may declare multiple formats — for example, a multimodal model that outputs images and video:

{ "name": "sora-v1", "supported_formats": ["image", "video"] }

Signing attempts with a format not listed in supported_formats are rejected with 400 format_not_supported.

Generate a keypair using the SDK:

import { generateKeypair } from '@certivu/sdk'


const { publicKey, privateKey } = generateKeypair()
// privateKey: store securely on your server, never share
// publicKey: paste into the dashboard when registering this generator

Returns { generator_id, name, supported_formats, status }.

Revoke a generator

Section titled “Revoke a generator”
PUT /v1/generators/:generator_id/revoke

Sets status: "revoked". All signatures from a revoked generator immediately become invalid. This action cannot be undone.

Returns { generator_id, status: "revoked" }.

Rotate signing key

Section titled “Rotate signing key”
POST /v1/generators/:generator_id/rotate-key

Issues a fresh ML-DSA signing key for a server-managed generator and retires the previous one. New content is signed with the new key, while content signed earlier stays verifiable — each signature records which key produced it, so the retired key continues to verify history. Use this to refresh keys on a schedule or after a suspected exposure, without invalidating past provenance.

Returns { generator_id, active_kid, retired_kid }.

Only available for server-managed generators. For client-managed generators (where you hold the private key), register a new key yourself instead — rotation returns 400.

Get public keys

Section titled “Get public keys”
GET /v1/keys/:generator_id

Public endpoint — no authentication required. Used by the verification flow to retrieve the generator’s public key for ML-DSA signature verification.