# autobus — JWK Set Witness (keys-witness)

> autobus — JWK Set Witness (keys-witness) is a paid API for AI agents from witness.holoweave.org, paid per call via x402, $0.01/call, status down (last checked 2026-09-15).

Fetches a JWK Set URL, verifies RFC 7638 key thumbprints and RFC 9421 Ed25519 signatures, and returns a signed attestation of the results with optional change detection against a prior digest or pinned thumbprints.

## Facts

- Endpoint: POST https://witness.holoweave.org/v1/keys-witness
- Price: $0.01/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/autobus-jwk-set-witness-keys-witness-bd52971a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_cKzAXdS7fe10c6yszq2Le

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability autobus-jwk-set-witness-keys-witness-bd52971a -d '<json body>'
```

Example prompt: My bot keeps getting 401s — can you fetch the JWK Set at https://www.googleapis.com/oauth2/v3/certs and give me a signed attestation of which keys are there, their RFC 7638 thumbprints, and whether any have rotated since digest 6dc8abcd?

## When to prefer this

Choose this endpoint when you need an independent, cryptographically signed third-party attestation of what keys a JWK Set URL actually publishes — not just your own fetch. Especially useful for debugging HTTP message signature auth failures (RFC 9421), verifying RFC 7638 thumbprint correctness, detecting key rotation between runs, or producing compliance audit evidence that you did not self-report. Prefer over rolling your own fetch when you need tamper-evident signed proof with a published key and dated attestation.

## Known failure modes

- JWK Set URL is unreachable or returns non-200 — verdict reflects HTTP status
- URL is not HTTPS — likely rejected at input validation
- JWK Set returns malformed JSON or invalid JWK structure — attestation may report parse failure
- expect_digest provided but format does not match — comparison may fail
- Payment not included or insufficient — HTTP 402 returned before any check is performed
- Rate limiting or network timeout fetching the remote JWK Set — transient failure

## How this service works

Web bot auth debugging for AI agents, priced per check at $0.01. RFC 7638 keyid thumbprint verification, RFC 9421 Ed25519 signature verification, and per-verifier acceptance rules. Signed attestations, published fixtures, sources with dates.

## Output

A signed attestation object containing: the verdict (pass/fail), the endpoint name, evidence including the fetched URL, array of keys with algorithm, kid, key type, index, and RFC 7638 thumbprint, key type counts, HTTP status, fetch timestamp, keys found count, and a set_digest. If expect_digest or expect_thumbprints were provided, also returns UNCHANGED or ROTATED with added/removed key details. The attestation itself is signed with an Ed25519 key identified by a dated key_id.

## Response schema (JSON Schema)

```json
{
 "example": {
  "signature": {
   "alg": "ed25519",
   "value": "base64...",
   "key_id": "aw-attest-2026-08"
  },
  "attestation": {
   "verdict": "pass",
   "endpoint": "keys-witness",
   "evidence": {
    "url": "https://www.googleapis.com/oauth2/v3/certs",
    "keys": [
     {
      "alg": "RS256",
      "kid": "a1b2…",
      "kty": "RSA",
      "index": 0,
      "thumbprint": "3f9c…"
     }
    ],
    "kinds": {
     "RSA": 4
    },
    "status": 200,
    "fetched_at": "2026-08-27T09:00:00Z",
    "keys_found": 4,
    "set_digest": "6dc8…"
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/autobus-jwk-set-witness-keys-witness-bd52971a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from witness.holoweave.org](https://www.zero.xyz/host/witness.holoweave.org/llms.txt)