> ## Documentation Index > Fetch the complete documentation index at: https://widgetic.com/llms.txt > Use this file to discover all available pages before exploring further. # Require a signed context, or stop requiring it > Chooses what the gateway does with an entry whose `context` carries no valid signature. With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context. Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute. Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator. ## OpenAPI ````yaml /openapi/widgetic-api-public.json put /partners/{partnerId}/entry-context-signing openapi: 3.0.0 info: title: Widgetic API Gateway version: 1.0.0 description: API documentation for the Widgetic API Gateway license: name: Widgetic Integration License url: https://docs.widgetic.com/resources/license servers: - url: https://api.widgetic.com/v1 description: Production server variables: env: default: production description: Environment apiUrl: default: https://api.widgetic.com description: API URL apiVersion: default: /v1 description: API Version path prefix security: [] tags: [] paths: /partners/{partnerId}/entry-context-signing: put: tags: - Partners summary: Require a signed context, or stop requiring it description: > Chooses what the gateway does with an entry whose `context` carries no valid signature. With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context. Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute. Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator. operationId: updatePartnerEntryContextSigning parameters: - in: path name: partnerId required: true schema: type: string format: uuid description: The partner whose context signing to change - $ref: '#/components/parameters/IdempotencyKeyOptional' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdatePartnerEntryContextSigningRequest' example: required: true responses: '200': description: How the context of your embeds is signed now content: application/json: schema: $ref: '#/components/schemas/PartnerEntryContextSigningResponse' '400': description: '`required` is missing or is not true or false' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: The API key is missing or invalid content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- The caller does not administer this partner, or the API key has not full access content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: There is no such partner (reported to administrators only) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: >- Signatures cannot be required yet, because no secret exists (BUSINESS_STATE_CONFLICT). Nothing was changed. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: >- Too many changes in a short time. Try again after the Retry-After seconds. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '503': description: >- Signed context is not available on this server right now (ENTRY_CONTEXT_SIGNING_UNAVAILABLE). Nothing was changed. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - apiKeyAuth: [] x-code-samples: - lang: TypeScript label: TypeScript SDK source: > import { Configuration, PartnersApi } from '@widgetic/api-sdk-ts'; const partnersApi = new PartnersApi(new Configuration({ apiKey: 'YOUR_API_KEY' })); // Once every page that embeds a composition signs its context: const signing = await partnersApi.updatePartnerEntryContextSigning({ partnerId, updatePartnerEntryContextSigningRequest: { required: true }, }); components: parameters: IdempotencyKeyOptional: in: header name: Idempotency-Key required: false description: >- Optional: without it the call is carried out every time it is sent. A key of your own that names this one request; a UUID is ideal. It is 8 to 50 characters of letters, digits, `-` and `_`. Send the same key again when you retry (after a timeout, a dropped connection or a `5xx`) and the call is carried out once: the retry gets the first answer back, marked `X-Idempotency-Cached: true`. The same key with a different body is refused with `422`, and a retry that arrives while the first call is still running with `409` (see `Retry-After`). schema: type: string minLength: 8 maxLength: 50 pattern: ^[a-zA-Z0-9_-]{8,50}$ example: 9b2d6f0a-3c41-4e5a-8d77-1f2e3a4b5c6d schemas: UpdatePartnerEntryContextSigningRequest: type: object required: - required properties: required: type: boolean description: >- True to refuse every entry whose context carries no valid signature. False to check the signature of the entries that carry one and accept the others, as before. example: required: true PartnerEntryContextSigningResponse: type: object required: - success - data properties: success: type: boolean description: Always `true` on a success. example: true data: $ref: '#/components/schemas/PartnerEntryContextSigning' meta: $ref: '#/components/schemas/ResponseMeta' ErrorResponse: type: object required: - success - message - error additionalProperties: true properties: success: type: boolean description: Always `false` on a failure. example: false message: type: string description: The same text as `error.message`, for a caller that reads one line. error: $ref: '#/components/schemas/ErrorDetail' PartnerEntryContextSigning: type: object description: >- How the context of your embeds is signed. The secret that signs it is never part of this: it is shown once, when it is made. required: - partnerId - required - secretSet - secretRotatedAt - previousSecretValidUntil - signingAvailable properties: partnerId: type: string format: uuid required: type: boolean description: >- True: an entry whose context carries no valid signature is refused (403 `CONTEXT_SIGNATURE_REQUIRED`). False: an entry that carries a signature is checked, and one that carries none is accepted as before. secretSet: type: boolean description: >- Whether you have a signing secret. Until you have, no signature is checked and none can be required. secretRotatedAt: type: string format: date-time nullable: true description: When the current secret was made. Null while there is none. previousSecretValidUntil: type: string format: date-time nullable: true description: >- While you switch to a new secret, when the secret it replaced stops being accepted. Null when there is none to wait for. signingAvailable: type: boolean description: >- False when this server cannot keep secrets, in which case none can be made yet. example: partnerId: 3fa85f64-5717-4562-b3fc-2c963f66afa6 required: true secretSet: true secretRotatedAt: '2026-01-15T09:30:00.000Z' previousSecretValidUntil: '2026-01-15T09:30:00.000Z' signingAvailable: true ResponseMeta: type: object description: >- Extra information about the answer: where a page sits in a list, the cursor of the next page, or warnings about a call that succeeded with a caveat. additionalProperties: true properties: page: type: integer description: The page that was read, counting from 1. example: 1 size: type: integer description: How many items one page holds. example: 20 total: type: integer description: How many items the whole list has. example: 135 limit: type: integer description: The same as `size`. example: 20 offset: type: integer description: How many items come before this page. example: 0 hasNextPage: type: boolean example: true hasPreviousPage: type: boolean example: false nextCursor: type: string nullable: true description: >- Pass this as `cursor` to read the next page of a list that is read by cursor. `null` on the last page. warnings: type: array items: type: string description: >- Things the call did not do, though it succeeded (for example a table that could not be created just now). ErrorDetail: type: object required: - code - message - timestamp properties: code: type: string description: Machine-readable error code. example: RESOURCE_NOT_FOUND message: type: string description: Human-readable explanation. example: Composition not found param: type: string description: The field that caused the error, when one did. example: name docUrl: type: string description: Where this error is explained. suggestedAction: type: string description: What to do about it. retryAfter: type: integer description: >- Seconds to wait before trying again (rate limits). The same number is in the `Retry-After` header. example: 60 details: type: object additionalProperties: true description: >- More about the error: the fields that failed, a limit that was reached. correlationId: type: string description: Quote this when you ask support about the call. example: req_123e4567-e89b-12d3-a456-426614174000 timestamp: type: string format: date-time example: '2026-10-15T10:00:00.000Z' securitySchemes: apiKeyAuth: type: http scheme: bearer bearerFormat: JWT ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.