PublicKey

Defines a public key for email encryption (OpenPGP or S/MIME).

This object can be configured from the WebUI under Account › Public Keys

Fields

accountId

Type: Id<Account> · read-only

Identifier for the account this public key belongs to

key

Type: Text · required

OpenPGP key or S/MIME certificate, armored, PEM, or binary encoded as base64

description

Type: String · required

Description of the public key

strictKeyWrapEncoding

Type: Boolean · default: false

Use the RFC 5753 key wrap encoding for elliptic-curve S/MIME certificates; required by gpgsm and KMail, may not be readable by Microsoft Outlook

authenticatedEncryption

Type: Boolean · default: false

All mail clients holding the private key can read AES-GCM with RSA-OAEP. Applies to S/MIME RSA and elliptic-curve keys. Apple Mail and Thunderbird ESR cannot read it.

createdAt

Type: UTCDateTime · server-set

Creation date of the public key

expiresAt

Type: UTCDateTime? · server-set

Expiration date of the key, taken from the key itself

emailAddresses

Type: Set<EmailAddress> · server-set

Email addresses bound to the key, taken from the key itself

kind

Type: PublicKeyKind? · server-set

Type of key, taken from the key itself

keyType

Type: String? · server-set

Type of key and its encryption algorithms, taken from the key itself

fingerprints

Type: Set<String> · server-set

Fingerprints of the keys or certificates used for encryption

capabilities

Type: Set<PublicKeyCapability> · server-set

Encryption features supported by the key

warnings

Type: Set<PublicKeyWarning> · server-set

Issues detected in the key that may affect security or compatibility

JMAP API

The PublicKey object is available via the urn:stalwart:jmap capability.

x:PublicKey/get

This is a standard Foo/get method as defined in RFC 8620, Section 5.1.

This method requires the sysPublicKeyGet permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:PublicKey/get",
          {
            "ids": [
              "id1"
            ]
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

x:PublicKey/set

This is a standard Foo/set method as defined in RFC 8620, Section 5.3.

Supports the following operations in a single call: create, update, destroy.

Create

This operation requires the sysPublicKeyCreate permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:PublicKey/set",
          {
            "create": {
              "new1": {
                "description": "Example",
                "key": "Example"
              }
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

Update

This operation requires the sysPublicKeyUpdate permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:PublicKey/set",
          {
            "update": {
              "id1": {
                "key": "updated value"
              }
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

Destroy

This operation requires the sysPublicKeyDestroy permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:PublicKey/set",
          {
            "destroy": [
              "id1"
            ]
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

x:PublicKey/query

This is a standard Foo/query method as defined in RFC 8620, Section 5.5.

This method requires the sysPublicKeyQuery permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:PublicKey/query",
          {
            "filter": {
              "accountId": "id1"
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

The x:PublicKey/query filter argument accepts the following conditions (combinable with AnyOf / AllOf / Not per RFC 8620):

Condition	Kind
accountId	id of Account

CLI

stalwart-cli wraps the same JMAP calls. See the CLI reference for installation, authentication, and general usage.

Fetch

stalwart-cli get PublicKey id1

Create

stalwart-cli create PublicKey \
  --field key=Example \
  --field description=Example

Query

stalwart-cli query PublicKey
stalwart-cli query PublicKey --where accountId=id1

Update

stalwart-cli update PublicKey id1 --field key='updated value'

Delete

stalwart-cli delete PublicKey --ids id1

Enums

PublicKeyKind

Value	Label
openPgp	OpenPGP
smime	S/MIME

PublicKeyCapability

Value	Label
aead	Authenticated encryption
postQuantum	Post-quantum

PublicKeyWarning

Value	Label
weakRsa	RSA key shorter than 3072 bits
noKnownDecryptor	No common mail client can decrypt messages for this key type
postQuantumOnly	Only post-quantum keys, some clients cannot decrypt
expiresSoon	Expires within 14 days
addressMismatch	None of the key’s addresses belong to this account
unusable	The key cannot be used for encryption