Submit a native service authority envelope

POST

/service-endpoint-authority

const url = 'https://auth.example.invalid/service-endpoint-authority';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"request":{"v":1,"kind":"service-endpoint-authority","requestId":"example","space":"example","accountPublicKey":"example","endpoint":"example","instanceId":"example","operation":"register","witness":{"accountPublicKey":"example","space":"example","endpoint":"example","instanceId":"example","principal":{"owner":"example","actor":"example","lifecycleUid":"example"},"rootCredentialId":"example","approvalDigest":"example","processEpoch":1,"registrationRevision":1,"nameAuthorityRevision":1,"registrationRequestId":"example","registrationProof":"example"},"registration":{"clusterDigests":["example"],"contractArtifacts":[{}]},"expected":{"state":"unregistered","witness":{"accountPublicKey":"example","space":"example","endpoint":"example","instanceId":"example","principal":{"owner":"example","actor":"example","lifecycleUid":"example"},"rootCredentialId":"example","approvalDigest":"example","processEpoch":1,"registrationRevision":1,"nameAuthorityRevision":1,"registrationRequestId":"example","registrationProof":"example"}},"target":{"kind":"instance","operation":"register","requestId":"example"},"observation":{"subject":"example","fingerprint":"example"}},"proof":{"kind":"idp","token":"example"}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://auth.example.invalid/service-endpoint-authority \
  --header 'Content-Type: application/json' \
  --data '{ "request": { "v": 1, "kind": "service-endpoint-authority", "requestId": "example", "space": "example", "accountPublicKey": "example", "endpoint": "example", "instanceId": "example", "operation": "register", "witness": { "accountPublicKey": "example", "space": "example", "endpoint": "example", "instanceId": "example", "principal": { "owner": "example", "actor": "example", "lifecycleUid": "example" }, "rootCredentialId": "example", "approvalDigest": "example", "processEpoch": 1, "registrationRevision": 1, "nameAuthorityRevision": 1, "registrationRequestId": "example", "registrationProof": "example" }, "registration": { "clusterDigests": [ "example" ], "contractArtifacts": [ {} ] }, "expected": { "state": "unregistered", "witness": { "accountPublicKey": "example", "space": "example", "endpoint": "example", "instanceId": "example", "principal": { "owner": "example", "actor": "example", "lifecycleUid": "example" }, "rootCredentialId": "example", "approvalDigest": "example", "processEpoch": 1, "registrationRevision": 1, "nameAuthorityRevision": 1, "registrationRequestId": "example", "registrationProof": "example" } }, "target": { "kind": "instance", "operation": "register", "requestId": "example" }, "observation": { "subject": "example", "fingerprint": "example" } }, "proof": { "kind": "idp", "token": "example" } }'

Only enabled with service endpoints; otherwise 404 before all guards. Fresh JSON proof is verified by kind, never by a loopback capability. Account/space mismatch yields a native denied result. Protocol denials echo coordinates and state=denied: 401 unauthenticated/proof-mismatch; 409 conflict or registration/proposal state; 422 bad-request, closure-invalid, unsupported-runtime or unsupported; 429 resource-exhausted/rate-limited; other authority denials 403. Native envelope/parser errors are plain 400 errors. revoke and describe-view are currently unsupported (422). Transport, 5xx or unknown effects never justify changing the mutation identity. Origin is refused. registered, credential, ready and status answer 200; approval-required and pending answer 202.

Request Body^required

UTF-8 JSON; maximum 2097152 bytes. An Authorization header does not replace the JSON proof.

application/json

Proof matrix: register=idp; activate=idp or service-renewal; renew=service-renewal; ready=service-access; status=any proof kind; revoke=idp or service-renewal; describe-view=service-access. revoke and describe-view parse but are currently denied as unsupported (422). The native parser also closes every request arm and enforces nested contracts.

object

request

required

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceAuthorityRequest in the linked source; this schema is not a complete native command contract.

object

required

Allowed value: 1

kind

required

Allowed value: service-endpoint-authority

requestId

required

string

/^[0-9a-f]{32}$/

space

required

string

>= 1 characters

accountPublicKey

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

operation

required

string

Allowed values: register activate renew ready revoke status describe-view

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

registration

object

clusterDigests

required

Array<string>

>= 1 items

contractArtifacts

required

Array<object>

>= 1 items

object

expected

object

state

required

string

Allowed values: unregistered registered

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

target

object

kind

required

string

Allowed values: instance operation

operation

string

Allowed values: register activate renew ready revoke

requestId

string

>= 1 characters

observation

object

subject

required

string

>= 1 characters

fingerprint

required

string

>= 1 characters

proof

required

object

kind

required

string

Allowed values: idp service-renewal service-access

token

required

string

>= 1 characters

Responses

200

Successful response.

application/json

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceAuthorityResult in the linked source; this schema is not a complete native command contract.

object

required

Allowed value: 1

kind

required

Allowed value: service-endpoint-authority

requestId

required

string

/^[0-9a-f]{32}$/

space

required

string

>= 1 characters

accountPublicKey

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

operation

required

string

Allowed values: register activate renew ready revoke status describe-view

state

required

string

Allowed values: approval-required pending registered credential ready status retired view denied

reason

string

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

status

object

state

required

string

Allowed values: proposed approved-unregistered registering revoking registered ready retired refused superseded

Example

{
  "v": 1,
  "kind": "service-endpoint-authority",
  "operation": "register",
  "state": "approval-required",
  "status": {
    "state": "proposed"
  }
}

202

Native approval-required or pending result with echoed coordinates; replay the same request after approval.

application/json

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceAuthorityResult in the linked source; this schema is not a complete native command contract.

object

required

Allowed value: 1

kind

required

Allowed value: service-endpoint-authority

requestId

required

string

/^[0-9a-f]{32}$/

space

required

string

>= 1 characters

accountPublicKey

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

operation

required

string

Allowed values: register activate renew ready revoke status describe-view

state

required

string

Allowed values: approval-required pending registered credential ready status retired view denied

reason

string

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

status

object

state

required

string

Allowed values: proposed approved-unregistered registering revoking registered ready retired refused superseded

Example

{
  "v": 1,
  "kind": "service-endpoint-authority",
  "operation": "register",
  "state": "approval-required",
  "status": {
    "state": "proposed"
  }
}

400

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

application/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

401

Native denied result with echoed coordinates, state=denied and reason.

application/json

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceAuthorityResult in the linked source; this schema is not a complete native command contract.

object

required

Allowed value: 1

kind

required

Allowed value: service-endpoint-authority

requestId

required

string

/^[0-9a-f]{32}$/

space

required

string

>= 1 characters

accountPublicKey

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

operation

required

string

Allowed values: register activate renew ready revoke status describe-view

state

required

string

Allowed values: approval-required pending registered credential ready status retired view denied

reason

string

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

status

object

state

required

string

Allowed values: proposed approved-unregistered registering revoking registered ready retired refused superseded

Example

{
  "v": 1,
  "kind": "service-endpoint-authority",
  "operation": "register",
  "state": "approval-required",
  "status": {
    "state": "proposed"
  }
}

403

Native denied result for account or authority refusal, or a plain error when Origin is present before envelope parsing.

application/json

One of:

object
object

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceAuthorityResult in the linked source; this schema is not a complete native command contract.

object

required

Allowed value: 1

kind

required

Allowed value: service-endpoint-authority

requestId

required

string

/^[0-9a-f]{32}$/

space

required

string

>= 1 characters

accountPublicKey

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

operation

required

string

Allowed values: register activate renew ready revoke status describe-view

state

required

string

Allowed values: approval-required pending registered credential ready status retired view denied

reason

string

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

status

object

state

required

string

Allowed values: proposed approved-unregistered registering revoking registered ready retired refused superseded

Example

{
  "v": 1,
  "kind": "service-endpoint-authority",
  "operation": "register",
  "state": "approval-required",
  "status": {
    "state": "proposed"
  }
}

404

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

application/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

405

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

application/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

409

Native denied result with echoed coordinates, state=denied and reason.

application/json

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceAuthorityResult in the linked source; this schema is not a complete native command contract.

object

required

Allowed value: 1

kind

required

Allowed value: service-endpoint-authority

requestId

required

string

/^[0-9a-f]{32}$/

space

required

string

>= 1 characters

accountPublicKey

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

operation

required

string

Allowed values: register activate renew ready revoke status describe-view

state

required

string

Allowed values: approval-required pending registered credential ready status retired view denied

reason

string

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

status

object

state

required

string

Allowed values: proposed approved-unregistered registering revoking registered ready retired refused superseded

Example

{
  "v": 1,
  "kind": "service-endpoint-authority",
  "operation": "register",
  "state": "approval-required",
  "status": {
    "state": "proposed"
  }
}

413

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

application/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

415

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

application/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

422

Native denied result with echoed coordinates, state=denied and reason.

application/json

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceAuthorityResult in the linked source; this schema is not a complete native command contract.

object

required

Allowed value: 1

kind

required

Allowed value: service-endpoint-authority

requestId

required

string

/^[0-9a-f]{32}$/

space

required

string

>= 1 characters

accountPublicKey

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

operation

required

string

Allowed values: register activate renew ready revoke status describe-view

state

required

string

Allowed values: approval-required pending registered credential ready status retired view denied

reason

string

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

status

object

state

required

string

Allowed values: proposed approved-unregistered registering revoking registered ready retired refused superseded

Example

{
  "v": 1,
  "kind": "service-endpoint-authority",
  "operation": "register",
  "state": "approval-required",
  "status": {
    "state": "proposed"
  }
}

429

Native denied result with echoed coordinates, state=denied and reason.

application/json

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceAuthorityResult in the linked source; this schema is not a complete native command contract.

object

required

Allowed value: 1

kind

required

Allowed value: service-endpoint-authority

requestId

required

string

/^[0-9a-f]{32}$/

space

required

string

>= 1 characters

accountPublicKey

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

operation

required

string

Allowed values: register activate renew ready revoke status describe-view

state

required

string

Allowed values: approval-required pending registered credential ready status retired view denied

reason

string

witness

Transport envelope only. Nested native fields and operation-specific constraints are defined by ServiceRegistrationWitness in the linked source; this schema is not a complete native command contract.

object

accountPublicKey

required

string

>= 1 characters

space

required

string

>= 1 characters

endpoint

required

string

>= 1 characters

instanceId

required

string

>= 1 characters

principal

required

object

owner

required

string

>= 1 characters

actor

required

string

>= 1 characters

lifecycleUid

required

string

>= 1 characters

rootCredentialId

required

string

>= 1 characters

approvalDigest

required

string

>= 1 characters

processEpoch

required

integer

registrationRevision

required

integer

nameAuthorityRevision

required

integer

registrationRequestId

required

string

>= 1 characters

registrationProof

required

string

>= 1 characters

status

object

state

required

string

Allowed values: proposed approved-unregistered registering revoking registered ready retired refused superseded

Example

{
  "v": 1,
  "kind": "service-endpoint-authority",
  "operation": "register",
  "state": "approval-required",
  "status": {
    "state": "proposed"
  }
}

503

Public admission cap (64 in flight), 10 second request deadline, or a route-specific unavailable read/effect. A service authority 503 may follow a binding; retain the request identity.

application/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

Submit a native service authority envelope

Request Bodyrequired

Responses

200

Example

202

Example

400

Example

401

Example

403

Example

404

Example

405

Example

409

Example

413

Example

415

Example

422

Example

429

Example

503

Example

Request Body^required