Return the signed Merkle Sum Tree root commitment for one asset in your platform's tree.

The tree is always your own: the platform is taken from your authenticated identity and cannot be supplied in the request, so another platform's roots are not addressable through this endpoint.

Verify the response by checking signature over the raw bytes of commitment_cbor using the key whose key_id matches signing_key_id in GET /por/keys, then decoding commitment_cbor and reading the committed values from it. The sibling JSON fields are an unsigned convenience view, and they are not a complete rendering of the signed payload.

This API does not cache these responses and sets no Cache-Control, but responses do carry a weak ETag, so a request sending If-None-Match can receive 304 Not Modified with no body. Nothing here suppresses caching by an intermediary, so treat latest as a moving target.

No rate limit is applied on these routes by this API. Edge limits may still apply, so handle 429 and honour Retry-After rather than assuming an unlimited budget.