> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gnosispay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get PCI encryption keys

> Lists the active RSA public keys that can encrypt an AES session key.

Fetch the keys immediately before a sensitive card-data operation so your
integration can select a currently active key. Cache keys only for the
duration agreed for your integration.



## OpenAPI

````yaml https://core.sandbox.gnosispay.in/partner-api/openapi.json get /v1/pci/public-key
openapi: 3.1.0
info:
  title: Gnosis Pay Partner API
  version: 1.0.0
  description: >-
    Server-to-server API for onboarding users, creating accounts and cards,
    moving

    funds, and managing the card lifecycle. Call this API only from a trusted

    backend. Every request requires a partner access token, and every resource
    is

    scoped to the authenticated partner.
servers:
  - url: https://core.prod.gnosispay.com/partner-api
    description: Production
    variables: {}
  - url: https://core.sandbox.gnosispay.in/core
    description: Sandbox
    variables: {}
security:
  - BearerAuth: []
tags:
  - name: Accounts
  - name: Cards
  - name: Card transactions
  - name: KYC
  - name: Deposits
  - name: Withdrawals
  - name: PCI
  - name: 3DS
  - name: Webhooks
paths:
  /v1/pci/public-key:
    get:
      tags:
        - PCI
      summary: Get PCI encryption keys
      description: >-
        Lists the active RSA public keys that can encrypt an AES session key.


        Fetch the keys immediately before a sensitive card-data operation so
        your

        integration can select a currently active key. Cache keys only for the

        duration agreed for your integration.
      operationId: pci.get_public_key.v1
      parameters: []
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PCIPublicKey'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    PCIPublicKey:
      type: object
      required:
        - public_key
        - encryption_keys
      properties:
        public_key:
          type: string
          description: >-
            Base64-encoded DER (SPKI) RSA public key. For new integrations,
            select a

            key from `encryption_keys` so that the matching `key_id` can be sent
            with

            the encrypted session key.
        encryption_keys:
          type: array
          items:
            $ref: '#/components/schemas/PCIEncryptionKey'
          description: >-
            RSA public keys a client may wrap a session key with. The client
            sends the

            chosen entry's id back as `key_id`.
    Error:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: integer
          format: int32
          description: HTTP status code.
        message:
          type: string
          description: Generic human-readable text for the status code. Do not parse it.
        reason:
          type: string
          description: >-
            Stable machine-readable code identifying the specific cause, present
            only

            for errors that expose one (e.g. `CREATE_CARD_LIMIT_EXCEEDED`).
            Branch on

            this rather than on `message`.
    PCIEncryptionKey:
      type: object
      required:
        - id
        - algorithm
        - public_key
      properties:
        id:
          type: string
          description: >-
            Stable id the client sends back as `key_id` when it wraps with this
            key.
        algorithm:
          type: string
          description: >-
            OAEP algorithm this key expects. Clients match this when choosing a
            key.
        public_key:
          type: string
          description: Base64-encoded DER (SPKI) RSA public key.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: Bearer

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.