{"openapi":"3.1.0","info":{"title":"Human-Backed Agents API","description":"Accounts, devices, mandates and credentials that bind an agent to the human behind it.","license":{"name":"MIT","identifier":"MIT"},"version":"0.1.0"},"paths":{"/.well-known/jwks.json":{"get":{"tags":["operations"],"summary":"The JWKS: the ES256 credential key and the ML-DSA-65 key (RFC 9964 `AKP`).","operationId":"jwks","responses":{"200":{"description":"The issuer's keys","content":{"application/json":{"schema":{}}}},"503":{"description":"This deployment does not issue credentials"}}}},"/healthz":{"get":{"tags":["operations"],"summary":"The process is running. Touches nothing, so it stays up when dependencies are down.","operationId":"health","responses":{"200":{"description":"The process is running","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HealthBody"}}}}}}},"/log/checkpoint":{"get":{"tags":["log"],"summary":"The newest witnessed checkpoint, as a signed note.","operationId":"checkpoint","responses":{"200":{"description":"The checkpoint","content":{"text/plain":{"schema":{"type":"string"}}}},"404":{"description":"No checkpoint yet"}}}},"/log/checkpoints/{day}":{"get":{"tags":["log"],"summary":"The last checkpoint of a UTC day: what addrbook records in its evidence ledger.","operationId":"checkpoint_for_day","parameters":[{"name":"day","in":"path","description":"The UTC day, YYYY-MM-DD","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"That day's final checkpoint","content":{"text/plain":{"schema":{"type":"string"}}}},"404":{"description":"No checkpoint that day"}}}},"/log/keys":{"get":{"tags":["log"],"summary":"The log's origin, verifier key, witnesses and quorum.","operationId":"keys","responses":{"200":{"description":"The policy","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LogPolicyResponse"}}}},"503":{"description":"This deployment keeps no log"}}}},"/log/tile/{*path}":{"get":{"tags":["log"],"summary":"A Merkle tree tile or entry bundle.","operationId":"tile","parameters":[{"name":"path","in":"path","description":"`<L>/<N>[.p/<W>]` or `entries/<N>[.p/<W>]`","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The tile","content":{"application/octet-stream":{}}},"404":{"description":"No such tile for any published checkpoint"}}}},"/ready":{"get":{"tags":["operations"],"summary":"The process can serve requests: the database answers within two seconds.","operationId":"ready","responses":{"200":{"description":"The database answers","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReadyBody"}}}},"503":{"description":"The database does not answer","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReadyBody"}}}}}}},"/status/{list}":{"get":{"tags":["operations"],"summary":"The Status List Token of one issuance hour (`YYYY-MM-DDTHH`): a `statuslist+jwt` with one bit\nper credential, cacheable for its `ttl` of 300 seconds.","operationId":"list","parameters":[{"name":"list","in":"path","description":"The issuance hour, YYYY-MM-DDTHH","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The signed status list","content":{"application/statuslist+jwt":{"schema":{"type":"string"}}}},"404":{"description":"No such list"},"503":{"description":"This deployment does not issue credentials"}}}},"/v1/accounts/me":{"get":{"tags":["accounts"],"summary":"The account the session belongs to.","operationId":"me","responses":{"200":{"description":"The session's account","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Me"}}}},"401":{"description":"No live session token"}},"security":[{"session":[]}]}},"/v1/credentials":{"post":{"tags":["mandates"],"summary":"The agent renews within its mandate, proving possession of its key.","operationId":"renew","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenewalBody"}}},"required":true},"responses":{"201":{"description":"A new credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialResponse"}}}},"400":{"description":"The proof is malformed or asks for more than the mandate"},"401":{"description":"The proof does not verify, is stale, was replayed, or is by another key"},"403":{"description":"The mandate has expired"},"404":{"description":"No such live mandate"},"503":{"description":"This deployment does not issue credentials"}}}},"/v1/credentials/{jti}/receipt":{"get":{"tags":["mandates"],"summary":"A credential's inclusion receipt, once a witnessed checkpoint covers its entry.","operationId":"receipt","parameters":[{"name":"jti","in":"path","description":"The credential's jti","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The receipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Receipt"}}}},"404":{"description":"No such credential, or no covering checkpoint yet"}}}},"/v1/devices":{"get":{"tags":["devices"],"summary":"The session's account's devices.","operationId":"list","responses":{"200":{"description":"The devices","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeviceList"}}}},"401":{"description":"No live session token"}},"security":[{"session":[]}]},"post":{"tags":["devices"],"summary":"Enrols an approval key with its platform attestation.","operationId":"enroll","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnrolmentRequest"}}},"required":true},"responses":{"201":{"description":"The device is enrolled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeviceResponse"}}}},"400":{"description":"A field is malformed"},"401":{"description":"No live session, an unknown challenge, or evidence that does not verify"},"403":{"description":"The platform is not accepted here, or the key does not reach H1; the message names each shortfall"},"409":{"description":"The approval key is already enrolled"}},"security":[{"session":[]}]}},"/v1/devices/challenge":{"post":{"tags":["devices"],"summary":"Issues a five-minute enrolment challenge to the session's account.","operationId":"challenge","responses":{"200":{"description":"A fresh challenge","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChallengeResponse"}}}},"401":{"description":"No live session token"}},"security":[{"session":[]}]}},"/v1/devices/{id}":{"delete":{"tags":["devices"],"summary":"Revokes one of the session's account's devices.","operationId":"revoke","parameters":[{"name":"id","in":"path","description":"The device","required":true,"schema":{"type":"string","format":"uuid"}}],"responses":{"204":{"description":"Revoked"},"401":{"description":"No live session token"},"404":{"description":"No such live device on this account"}},"security":[{"session":[]}]}},"/v1/mandates":{"get":{"tags":["mandates"],"summary":"The session's account's mandates.","operationId":"list","responses":{"200":{"description":"The mandates","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MandateList"}}}},"401":{"description":"No live session token"}},"security":[{"session":[]}]}},"/v1/mandates/requests":{"post":{"tags":["mandates"],"summary":"An agent asks for a mandate; the answer carries the hash the human will sign.","operationId":"create_request","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MandateRequestBody"}}},"required":true},"responses":{"201":{"description":"The request waits for the human for 15 minutes","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MandateRequestResponse"}}}},"400":{"description":"The key, audience, details or lifetime are not acceptable"},"503":{"description":"This deployment does not issue credentials"}}}},"/v1/mandates/requests/{id}":{"get":{"tags":["mandates"],"summary":"The request as the human's app shows it.","operationId":"view_request","parameters":[{"name":"id","in":"path","description":"The request","required":true,"schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"The request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MandateRequestView"}}}},"401":{"description":"No live session token"},"404":{"description":"No such request"}},"security":[{"session":[]}]}},"/v1/mandates/requests/{id}/approve":{"post":{"tags":["mandates"],"summary":"The human approves with an enrolled device's key; the first credential is minted.","operationId":"approve","parameters":[{"name":"id","in":"path","description":"The request","required":true,"schema":{"type":"string","format":"uuid"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalBody"}}},"required":true},"responses":{"201":{"description":"The mandate and its first credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalResponse"}}}},"401":{"description":"No live session, or the approval does not verify"},"404":{"description":"No such request, or no such live device on this account"},"409":{"description":"The request was already approved or has expired"}},"security":[{"session":[]}]}},"/v1/mandates/requests/{id}/credential":{"get":{"tags":["mandates"],"summary":"The agent fetches the newest credential of its approved request.","operationId":"credential","parameters":[{"name":"id","in":"path","description":"The request","required":true,"schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"The credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialResponse"}}}},"404":{"description":"No such request, or not approved yet"}}}},"/v1/mandates/{id}/revoke":{"post":{"tags":["mandates"],"summary":"The human revokes a mandate: every credential under it is revoked, and the status lists say so.","operationId":"revoke","parameters":[{"name":"id","in":"path","description":"The mandate","required":true,"schema":{"type":"string","format":"uuid"}}],"responses":{"204":{"description":"Revoked"},"401":{"description":"No live session token"},"404":{"description":"No such live mandate on this account"}},"security":[{"session":[]}]}},"/v1/passkeys/authentication":{"post":{"tags":["passkeys"],"summary":"Completes a login: verifies the assertion and opens a session.","operationId":"authenticate","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthenticationRequest"}}},"required":true},"responses":{"200":{"description":"The session is open","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionResponse"}}}},"400":{"description":"A field is not base64url or the client data is not JSON"},"401":{"description":"The challenge is unknown, used or expired, or the response does not verify"}}}},"/v1/passkeys/authentication/options":{"post":{"tags":["passkeys"],"summary":"Starts a login: a fresh challenge and the request options for the client.","operationId":"authentication_options","responses":{"200":{"description":"Request options with a five-minute challenge","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthenticationOptions"}}}}}}},"/v1/passkeys/registration":{"post":{"tags":["passkeys"],"summary":"Completes a registration: verifies the attestation, creates the account and opens a session.","operationId":"register","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegistrationRequest"}}},"required":true},"responses":{"201":{"description":"The account exists; the session is open","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionResponse"}}}},"400":{"description":"A field is not base64url or the client data is not JSON"},"401":{"description":"The challenge is unknown, used or expired, or the response does not verify"},"409":{"description":"This passkey is already registered"}}}},"/v1/passkeys/registration/options":{"post":{"tags":["passkeys"],"summary":"Starts a registration: a fresh challenge and the creation options for the client.","operationId":"registration_options","responses":{"200":{"description":"Creation options with a five-minute challenge","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegistrationOptions"}}}}}}},"/v1/uniqueness":{"get":{"tags":["uniqueness"],"summary":"The account's live uniqueness link.","operationId":"current","responses":{"200":{"description":"The link, or none","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UniquenessView"}}}},"401":{"description":"No live session token"}},"security":[{"session":[]}]}},"/v1/uniqueness/world":{"post":{"tags":["uniqueness"],"summary":"The human's app sends the IDKit 4.0 result of a uniqueness proof for our relying party and\n`action hba:link`, exactly as IDKit returned it. HBA forwards it to World, and links the account:\nthe Orb gives U2, a passport chip U1. A proof whose World ID is already linked to another\naccount opens a review (202) instead of linking. Off (503) until World is configured.","operationId":"link","requestBody":{"content":{"application/json":{"schema":{}}},"required":true},"responses":{"200":{"description":"Linked","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Link"}}}},"202":{"description":"Already linked to another account; a person reviews it","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReviewOpened"}}}},"400":{"description":"Not an acceptable World ID 4.0 uniqueness proof for this relying party"},"401":{"description":"No live session, or World did not verify the credential (the message names the code)"},"503":{"description":"Uniqueness linking is off, or World could not be reached"}},"security":[{"session":[]}]}}},"components":{"schemas":{"ApprovalBody":{"type":"object","description":"The human's approval.","required":["deviceId","signature"],"properties":{"deviceId":{"type":"string","format":"uuid","description":"The enrolled device whose key signed."},"signature":{"type":"string","description":"The device key's DER ECDSA signature over the mandate hash, base64url."}}},"ApprovalResponse":{"type":"object","description":"The outcome of an approval.","required":["mandateId","credential"],"properties":{"credential":{"$ref":"#/components/schemas/CredentialResponse","description":"The first credential under it."},"mandateId":{"type":"string","format":"uuid","description":"The mandate."}}},"AuthenticationOptions":{"type":"object","description":"`PublicKeyCredentialRequestOptions`, as JSON.","required":["challenge","rpId","timeout","userVerification","allowCredentials"],"properties":{"allowCredentials":{"type":"array","items":{"$ref":"#/components/schemas/CredentialDescriptor"},"description":"Empty: the authenticator offers its discoverable credentials."},"challenge":{"type":"string","description":"The challenge, base64url."},"rpId":{"type":"string","description":"The RP ID."},"timeout":{"type":"integer","format":"int32","description":"Milliseconds the client should allow.","minimum":0},"userVerification":{"type":"string","description":"`required`."}}},"AuthenticationRequest":{"type":"object","description":"The client's answer to an authentication: the `response` fields of the credential JSON.","required":["id","clientDataJSON","authenticatorData","signature"],"properties":{"authenticatorData":{"type":"string","description":"`response.authenticatorData`, base64url."},"clientDataJSON":{"type":"string","description":"`response.clientDataJSON`, base64url."},"id":{"type":"string","description":"The credential id, base64url."},"signature":{"type":"string","description":"`response.signature`, base64url."}}},"AuthenticatorSelection":{"type":"object","description":"What kind of authenticator the ceremony asks for.","required":["residentKey","requireResidentKey","userVerification"],"properties":{"requireResidentKey":{"type":"boolean","description":"For older clients."},"residentKey":{"type":"string","description":"`required`: a discoverable credential (a passkey)."},"userVerification":{"type":"string","description":"`required`."}}},"ChallengeResponse":{"type":"object","description":"A challenge issued to an account for one enrolment.","required":["challenge","expiresAt"],"properties":{"challenge":{"type":"string","description":"32 bytes, base64url."},"expiresAt":{"type":"string","format":"date-time","description":"When it stops being answerable."}}},"CredentialDescriptor":{"type":"object","description":"A credential a client may use.","required":["type","id"],"properties":{"id":{"type":"string","description":"The credential id, base64url."},"type":{"type":"string","description":"Always `public-key`."}}},"CredentialParameter":{"type":"object","description":"One accepted credential algorithm.","required":["type","alg"],"properties":{"alg":{"type":"integer","format":"int32","description":"The COSE algorithm: `-7` (ES256)."},"type":{"type":"string","description":"Always `public-key`."}}},"CredentialResponse":{"type":"object","description":"A minted credential.","required":["mandateId","credential","pq","jti","issuedAt","expiresAt","status"],"properties":{"credential":{"type":"string","description":"The SD-JWT VC."},"expiresAt":{"type":"integer","format":"int64","description":"`exp`."},"issuedAt":{"type":"integer","format":"int64","description":"`iat`."},"jti":{"type":"string","description":"`jti`."},"mandateId":{"type":"string","format":"uuid","description":"The mandate the credential was minted under: what a renewal names."},"pq":{"$ref":"#/components/schemas/PqSignature","description":"The detached ML-DSA-65 signature."},"status":{"$ref":"#/components/schemas/StatusRef","description":"The status reference."}}},"DeviceList":{"type":"object","description":"Body of `GET /v1/devices`.","required":["devices"],"properties":{"devices":{"type":"array","items":{"$ref":"#/components/schemas/DeviceResponse"},"description":"Newest first, revoked ones included."}}},"DeviceResponse":{"type":"object","description":"An enrolled device.","required":["id","platform","attestation","tier","facts","createdAt"],"properties":{"attestation":{"type":"string","description":"`android-key`, `apple-app-attest` or `test`."},"createdAt":{"type":"string","format":"date-time","description":"When it was enrolled."},"facts":{"description":"The §8 evidence summary."},"id":{"type":"string","format":"uuid","description":"The device."},"platform":{"type":"string","description":"`android`, `ios` or `test`."},"revokedAt":{"type":["string","null"],"format":"date-time","description":"When it was revoked, if it was."},"tier":{"type":"string","description":"The tier the key reaches, as `H1`.","example":"H1"}}},"EnrolmentRequest":{"oneOf":[{"type":"object","description":"Android Key Attestation.","required":["challenge","certificateChain","platform"],"properties":{"certificateChain":{"type":"array","items":{"type":"string"},"description":"The key's certificate chain, DER, leaf first."},"challenge":{"type":"string","description":"The challenge issued for this enrolment."},"platform":{"type":"string","enum":["android"]}}},{"type":"object","description":"Apple App Attest.","required":["challenge","keyId","attestationObject","approvalKey","assertion","platform"],"properties":{"approvalKey":{"type":"string","description":"The Secure Enclave approval key, an uncompressed P-256 point."},"assertion":{"type":"string","description":"An App Attest assertion over `SHA-256(challenge || approvalKey)`."},"attestationObject":{"type":"string","description":"The attestation object for that key over `SHA-256(challenge)`."},"challenge":{"type":"string","description":"The challenge issued for this enrolment."},"keyId":{"type":"string","description":"The App Attest key id."},"platform":{"type":"string","enum":["ios"]}}},{"type":"object","description":"The configured test attestor.","required":["challenge","approvalKey","tier","signature","platform"],"properties":{"approvalKey":{"type":"string","description":"The approval key, an uncompressed P-256 point."},"challenge":{"type":"string","description":"The challenge issued for this enrolment."},"platform":{"type":"string","enum":["test"]},"signature":{"type":"string","description":"The attestor's signature over the statement."},"tier":{"type":"string","description":"`H0` or `H1`."}}}],"description":"The evidence a platform supplies at enrolment. Every field is base64url."},"HealthBody":{"type":"object","description":"Body of `GET /healthz`.","required":["status"],"properties":{"status":{"type":"string","description":"Always `ok`."}}},"Link":{"type":"object","description":"A live link.","required":["provider","tier","cloneResistant","issuerSchemaId","linkedAt","expiresAt"],"properties":{"cloneResistant":{"type":"boolean","description":"Whether the credential proved clone resistance (never, with World)."},"expiresAt":{"type":"string","format":"date-time","description":"When the tier lapses without a fresh proof."},"issuerSchemaId":{"type":"integer","format":"int64","description":"World's credential schema the tier came from."},"linkedAt":{"type":"string","format":"date-time","description":"When the account linked."},"provider":{"type":"string","description":"`world_id`."},"tier":{"type":"integer","format":"int32","description":"The uniqueness tier, 1 or 2."}}},"LogPolicyResponse":{"type":"object","description":"Body of `GET /log/keys`.","required":["origin","logKey","witnesses","quorum"],"properties":{"logKey":{"type":"string","description":"The log's verifier key."},"origin":{"type":"string","description":"The log origin."},"quorum":{"type":"integer","description":"How many witnesses must cosign.","minimum":0},"witnesses":{"type":"array","items":{"type":"string"},"description":"The witnesses' verifier keys."}}},"MandateList":{"type":"object","description":"Body of `GET /v1/mandates`.","required":["mandates"],"properties":{"mandates":{"type":"array","items":{"$ref":"#/components/schemas/MandateView"},"description":"Newest first, revoked ones included."}}},"MandateRequestBody":{"type":"object","description":"What an agent asks for.","required":["agentKey","aud","authorizationDetails"],"properties":{"agentKey":{"description":"The agent's public JWK (`OKP`/`Ed25519` or `EC`/`P-256`)."},"aud":{"type":"string","description":"The one origin the credentials are for."},"authorizationDetails":{"description":"The typed scopes and limits (§7.2)."},"lifetimeSeconds":{"type":["integer","null"],"format":"int64","description":"Seconds the mandate should last; the default is a day, the cap 30 days (7 with payment)."},"registrations":{"description":"The agent's ERC-8004 registrations, if any."}}},"MandateRequestResponse":{"type":"object","description":"A request, as returned to the agent.","required":["requestId","mandateHash","canonical","notBefore","mandateExp","expiresAt"],"properties":{"canonical":{"type":"string","description":"The canonical mandate (JCS), for display and audit."},"expiresAt":{"type":"string","format":"date-time","description":"When the request stops being approvable."},"mandateExp":{"type":"integer","format":"int64","description":"`mandate_exp`, Unix seconds."},"mandateHash":{"type":"string","description":"SHA-256 of the canonical mandate, base64url: the challenge the human's key signs."},"notBefore":{"type":"integer","format":"int64","description":"`not_before`, Unix seconds."},"requestId":{"type":"string","format":"uuid","description":"The request; the human approves it and the agent fetches the credential by it."}}},"MandateRequestView":{"type":"object","description":"A request, as shown to the human.","required":["requestId","agentThumbprint","aud","authorizationDetails","notBefore","mandateExp","mandateHash","status","expiresAt"],"properties":{"agentThumbprint":{"type":"string","description":"The agent key's RFC 7638 thumbprint."},"aud":{"type":"string","description":"The audience."},"authorizationDetails":{"description":"The scopes and limits."},"expiresAt":{"type":"string","format":"date-time","description":"When the request stops being approvable."},"mandateExp":{"type":"integer","format":"int64","description":"`mandate_exp`, Unix seconds."},"mandateHash":{"type":"string","description":"The hash the device signs, base64url."},"notBefore":{"type":"integer","format":"int64","description":"`not_before`, Unix seconds."},"registrations":{"description":"The agent's registrations, if any."},"requestId":{"type":"string","format":"uuid","description":"The request."},"status":{"type":"string","description":"`pending`, `approved` or `expired`."}}},"MandateView":{"type":"object","description":"A mandate, as listed to its account.","required":["id","deviceId","agentThumbprint","aud","authorizationDetails","notBefore","mandateExp","approvedAt"],"properties":{"agentThumbprint":{"type":"string","description":"The agent key's thumbprint."},"approvedAt":{"type":"string","format":"date-time","description":"When the human approved."},"aud":{"type":"string","description":"The audience."},"authorizationDetails":{"description":"The scopes and limits."},"deviceId":{"type":"string","format":"uuid","description":"The device that approved it."},"id":{"type":"string","format":"uuid","description":"The mandate."},"mandateExp":{"type":"string","format":"date-time","description":"Until when."},"notBefore":{"type":"string","format":"date-time","description":"From when."},"revokedAt":{"type":["string","null"],"format":"date-time","description":"When it was revoked, if it was."}}},"Me":{"type":"object","description":"Body of `GET /v1/accounts/me`.","required":["accountId","createdAt"],"properties":{"accountId":{"type":"string","format":"uuid","description":"The account."},"createdAt":{"type":"string","format":"date-time","description":"When it was created."},"uniqueness":{"oneOf":[{"$ref":"#/components/schemas/Link","description":"The live uniqueness link, if any."},{"type":"null"}]}}},"PqSignature":{"type":"object","description":"The detached post-quantum signature beside a credential.","required":["alg","kid","signature"],"properties":{"alg":{"type":"string","description":"`ML-DSA-65`."},"kid":{"type":"string","description":"The key in the JWKS."},"signature":{"type":"string","description":"The signature over the JWS signing input, base64url."}}},"ReadyBody":{"type":"object","description":"Body of `GET /ready`.","required":["status"],"properties":{"status":{"type":"string","description":"`ready` when the database answers, `unavailable` otherwise."}}},"Receipt":{"type":"object","description":"The receipt a credential's gateway presents (`log.receipt` in §7.2): the entry's index, the\nwitnessed checkpoint as a signed note, and the inclusion proof.","required":["log","index","checkpoint","proof"],"properties":{"checkpoint":{"type":"string","description":"The signed checkpoint note."},"index":{"type":"integer","format":"int64","description":"The entry's index.","minimum":0},"log":{"type":"string","description":"The log origin."},"proof":{"type":"array","items":{"type":"string"},"description":"The inclusion proof hashes, base64."}}},"RegistrationOptions":{"type":"object","description":"`PublicKeyCredentialCreationOptions`, as JSON.","required":["challenge","rp","user","pubKeyCredParams","timeout","authenticatorSelection","attestation"],"properties":{"attestation":{"type":"string","description":"`none`: passkeys attest nothing, and device trust comes from attested approval keys."},"authenticatorSelection":{"$ref":"#/components/schemas/AuthenticatorSelection","description":"A discoverable credential with user verification."},"challenge":{"type":"string","description":"The challenge, base64url."},"pubKeyCredParams":{"type":"array","items":{"$ref":"#/components/schemas/CredentialParameter"},"description":"ES256 only."},"rp":{"$ref":"#/components/schemas/RpEntity","description":"This relying party."},"timeout":{"type":"integer","format":"int32","description":"Milliseconds the client should allow.","minimum":0},"user":{"$ref":"#/components/schemas/UserEntity","description":"The account to be: an opaque handle, no personal data."}}},"RegistrationRequest":{"type":"object","description":"The client's answer to a registration: the `response` fields of the credential JSON.","required":["id","clientDataJSON","attestationObject"],"properties":{"attestationObject":{"type":"string","description":"`response.attestationObject`, base64url."},"clientDataJSON":{"type":"string","description":"`response.clientDataJSON`, base64url."},"id":{"type":"string","description":"The credential id, base64url."}}},"RenewalBody":{"type":"object","description":"A renewal: the agent's proof of possession.","required":["proof"],"properties":{"proof":{"type":"string","description":"An `EdDSA` compact JWS (`typ: hba-renew+jwt`, the JWK in the header) over\n`{mandateId, jti, iat, lifetimeSeconds?, authorizationDetails?}`."}}},"ReviewOpened":{"type":"object","description":"Body of a 202: the proof is linked to another account and a person will look.","required":["status","reviewId"],"properties":{"reviewId":{"type":"string","format":"uuid","description":"The review."},"status":{"type":"string","description":"`review`."}}},"RpEntity":{"type":"object","description":"The relying party entity.","required":["id","name"],"properties":{"id":{"type":"string","description":"The RP ID."},"name":{"type":"string","description":"The name authenticators show."}}},"SessionResponse":{"type":"object","description":"A session, the outcome of a verified ceremony.","required":["accountId","token","expiresAt"],"properties":{"accountId":{"type":"string","format":"uuid","description":"The account."},"expiresAt":{"type":"string","format":"date-time","description":"When the session ends."},"token":{"type":"string","description":"The bearer token, shown only now."}}},"StatusRef":{"type":"object","description":"Where the credential's status bit lives.","required":["uri","idx"],"properties":{"idx":{"type":"integer","format":"int64","description":"The bit index."},"uri":{"type":"string","description":"The status list."}}},"UniquenessView":{"type":"object","description":"Body of `GET /v1/uniqueness`.","properties":{"link":{"oneOf":[{"$ref":"#/components/schemas/Link","description":"The live link, if any."},{"type":"null"}]}}},"UserEntity":{"type":"object","description":"The user entity: the future account id as the handle and a derived name.","required":["id","name","displayName"],"properties":{"displayName":{"type":"string","description":"The same as `name`."},"id":{"type":"string","description":"The account id's 16 bytes, base64url."},"name":{"type":"string","description":"`hba-` and eight hex digits of the account id."}}}},"securitySchemes":{"session":{"type":"http","scheme":"bearer"}}}}