# Public Endpoints and Keys

The Magistrate module calls the Octet policy engine for you, so most integrations never call these endpoints directly. Your backend needs only the receipt keys.

All endpoints are on `https://gw.octetproof.com`.

## Keys for your backend

| Endpoint | What it returns |
|---|---|
| `GET /.well-known/decision-receipt-jwks.json` | The keys that sign decision receipts, as a JSON Web Key Set. Each key has a `kid`, `valid_from` and, once replaced, `valid_until` |
| `GET /.well-known/decision-receipt-key-history.json` | Every receipt key the engine has used, as a chain in which each key signs the next. Use it to check an old receipt after its key was replaced |
| `GET /.well-known/policy-signing-jwks.json` | The keys that sign policy bundles, as a JSON Web Key Set |
| `GET /.well-known/policy-signing-key-history.json` | The same chain for the keys that sign policy bundles |

A receipt key is used only for receipts. It never signs a policy, and a policy key never signs a receipt.

## Policies

| Endpoint | What it returns |
|---|---|
| `GET /v1/policies` | Octet's demo policies, each with its OPL, title, version, `question` and `yes_is`. Your own policies aren't listed publicly |
| `GET /v1/bundle?policy=<name>` | The signed policy bundle the Magistrate module verifies. Without `policy`, every bundle |

## Decisions

The Magistrate module makes these calls in `decide` and `decideMany`. Your backend makes them itself when it [starts the check](/docs/magistrate/get-started/verify-and-enforce/#start-the-check-from-your-backend).

| Endpoint | What it does |
|---|---|
| `POST /v1/decide/challenge` | Issues a one-time challenge for a check, with its `decision_ref` and `nonce`. It expires after a few minutes |
| `POST /v1/decide` | Takes the check's `decision_ref` and the device's proofs, decides, and returns the decision with its receipt |

A challenge works once, for the policies it was issued for. A second use returns 409.