> ## Documentation Index
> Fetch the complete documentation index at: https://developers.fireblocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Link Key Status in the API and Console

> How the Fireblocks Key Link API fields for signing keys and validation keys map to the key status shown in the Console, and when a validation key can certify signing keys.

The Fireblocks Console shows a status for each Key Link signing key and validation key. The Key Link API does not return that status as a single field. Instead, the Console derives it from several fields in the API response. Use the tables on this page to compute the same status from the API so your systems and the Console agree.

## Signing key status

A signing key is the key in your HSM or key management system that signs transactions for a vault account. Its Console status depends on three fields returned by [Get list of signing keys](/api-reference/key-link-beta/get-list-of-signing-keys): `enabled`, `vaultAccountId`, and `agentUserId`.

| `enabled` | `vaultAccountId` | `agentUserId` | Console status | Meaning |
| - | - | - | - | - |
| `false` | `null` | Set | Pending proof | The key is registered and linked to an Agent user, and is waiting for proof of ownership. |
| `true` | `null` | Set | Pending assignment | Proof of ownership succeeded. The key is not assigned to a vault account and controls no addresses. |
| `true` | Set | Set | Active | The key is assigned to a vault account and is used for signing. |

Every signing key is linked to an Agent user when you create it, so `agentUserId` is always set. After a signing key becomes enabled, it never returns to `enabled: false`.

## Validation key status

A validation key certifies the signing keys you register: each new signing key's certificate must be signed by one of your validation keys. Its Console status depends on the `enabled`, `revoked`, and `expirationTime` fields returned by [Get list of registered validation keys](/api-reference/key-link-beta/get-list-of-registered-validation-keys), and on the key's approval request.

| API fields | Console status |
| - | - |
| `expirationTime` is in the past | Expired |
| `enabled: true` and not expired | Active |
| `enabled: false`, waiting for admin quorum approval | Pending approval |
| `enabled: false`, approval rejected | Rejected |
| `revoked: true` | Not listed in the Console |

The approval state is not part of the API response. The Console reads it from the approval request created when the validation key was added to your workspace. When you only have the API response, a validation key with `enabled: false` that is not revoked is either pending approval or rejected.

To include revoked validation keys in the list, set the `includeRevoked` query parameter to `true`.

### When a validation key can certify signing keys

A validation key can certify new signing keys only when all of these conditions are true:

* `enabled` is `true`
* `revoked` is `false`
* The key has not expired (`expirationTime` is in the future)

### Revoke a validation key

Revoke a validation key when you no longer want it to certify new signing keys, for example when the key is retired or compromised.

<Warning>
  Revoking a validation key is permanent. You cannot re-enable a revoked validation key. To certify new signing keys afterward, add a different validation key.
</Warning>

To revoke a validation key in the Console:

1. Go to **Settings** > **External Keys** > **Validation keys**.
2. Find the key you want to revoke, then select **Revoke key**.

To revoke a validation key with the API, use [Disables a validation key](/api-reference/key-link-beta/disables-a-validation-key).

## Related pages

* [Key Link transaction metadata](/reference/keylink-transaction-metadata)