Skip to main content
The Fireblocks Console shows a status for each Key Link signing key and validation key. The Key Link API does not return that status as a single field. Instead, the Console derives it from several fields in the API response. Use the tables on this page to compute the same status from the API so your systems and the Console agree.

​
Signing key status

A signing key is the key in your HSM or key management system that signs transactions for a vault account. Its Console status depends on three fields returned by Get list of signing keys: enabled, vaultAccountId, and agentUserId. Every signing key is linked to an Agent user when you create it, so agentUserId is always set. After a signing key becomes enabled, it never returns to enabled: false.

​
Validation key status

A validation key certifies the signing keys you register: each new signing key’s certificate must be signed by one of your validation keys. Its Console status depends on the enabled, revoked, and expirationTime fields returned by Get list of registered validation keys, and on the key’s approval request. The approval state is not part of the API response. The Console reads it from the approval request created when the validation key was added to your workspace. When you only have the API response, a validation key with enabled: false that is not revoked is either pending approval or rejected. To include revoked validation keys in the list, set the includeRevoked query parameter to true.

​
When a validation key can certify signing keys

A validation key can certify new signing keys only when all of these conditions are true:
  • enabled is true
  • revoked is false
  • The key has not expired (expirationTime is in the future)

​
Revoke a validation key

Revoke a validation key when you no longer want it to certify new signing keys, for example when the key is retired or compromised.
Revoking a validation key is permanent. You cannot re-enable a revoked validation key. To certify new signing keys afterward, add a different validation key.
To revoke a validation key in the Console:
  1. Go to Settings > External Keys > Validation keys.
  2. Find the key you want to revoke, then select Revoke key.
To revoke a validation key with the API, use Disables a validation key.