Require a signed context, or stop requiring it

Chooses what the gateway does with an entry whose context carries no valid signature.

With required: false (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With required: true an entry without a valid signature is refused with 403 CONTEXT_SIGNATURE_REQUIRED: use it once every page of yours that embeds a composition signs its context.

Signatures cannot be required before you have made a secret (rotatePartnerEntryContextSecret): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.

Saving the same choice twice leaves the same state, so a retry is harmless and Idempotency-Key is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.

PUT /partners/{partnerId}/entry-context-signing

TypeScript SDK

TypeScript

import { Configuration, PartnersApi } from '@widgetic/api-sdk-ts';

const partnersApi = new PartnersApi(new Configuration({ apiKey: 'YOUR_API_KEY' }));

// Once every page that embeds a composition signs its context:
const signing = await partnersApi.updatePartnerEntryContextSigning({
  partnerId,
  updatePartnerEntryContextSigningRequest: { required: true },
});

200

{
  "success": true,
  "data": {
    "partnerId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "required": true,
    "secretSet": true,
    "secretRotatedAt": "2026-01-15T09:30:00.000Z",
    "previousSecretValidUntil": "2026-01-15T09:30:00.000Z",
    "signingAvailable": true
  },
  "meta": {
    "page": 1,
    "size": 20,
    "total": 135,
    "limit": 20,
    "offset": 0,
    "hasNextPage": true,
    "hasPreviousPage": false,
    "nextCursor": "<string>",
    "warnings": [
      "<string>"
    ]
  }
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

Idempotency-Key · string

Optional: without it the call is carried out every time it is sent. A key of your own that names this one request; a UUID is ideal. It is 8 to 50 characters of letters, digits, - and _. Send the same key again when you retry (after a timeout, a dropped connection or a 5xx) and the call is carried out once: the retry gets the first answer back, marked X-Idempotency-Cached: true. The same key with a different body is refused with 422, and a retry that arrives while the first call is still running with 409 (see Retry-After).

Required string length: 8 - 50

Pattern: ^[a-zA-Z0-9_-]{8,50}$

Example:

"9b2d6f0a-3c41-4e5a-8d77-1f2e3a4b5c6d"

Path Parameters

partnerId · string<uuid> · required

The partner whose context signing to change

Body

application/json

required · boolean · required

True to refuse every entry whose context carries no valid signature. False to check the signature of the entries that carry one and accept the others, as before.

Response

200

application/json

How the context of your embeds is signed now

success · boolean · required

Always true on a success.

Example:

true

data · object · required

How the context of your embeds is signed. The secret that signs it is never part of this: it is shown once, when it is made.

Show child attributes

Example:

{
  "partnerId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "required": true,
  "secretSet": true,
  "secretRotatedAt": "2026-01-15T09:30:00.000Z",
  "previousSecretValidUntil": "2026-01-15T09:30:00.000Z",
  "signingAvailable": true
}

meta · object

Extra information about the answer: where a page sits in a list, the cursor of the next page, or warnings about a call that succeeded with a caveat.

Show child attributes