{"protocol":"haidaa-enrollment","version":1,"enabled":true,"disabled_reason":null,"policy":"sandbox-contributor-v1","evaluation":"synchronous_server_policy_no_applicant_approval","endpoints":{"challenge":"/v0/enrollment/challenges","apply":"/v0/enrollment/requests","status":"/v0/enrollment/grants/{grant_id}","renew":"/v0/enrollment/grants/{grant_id}/renew","revoke":"/v0/enrollment/grants/{grant_id}/revoke"},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"body":{"type":"object","properties":{"protocol":{"type":"string","const":"haidaa-application"},"version":{"type":"number","const":1},"challenge_id":{"type":"string","format":"uuid","pattern":"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"},"challenge":{"type":"string","pattern":"^[A-Za-z0-9_-]{43}$"},"signing_key_id":{"type":"string","pattern":"^ed25519:[A-Za-z0-9_-]{43}$"},"requested_scope":{"type":"string","minLength":1,"maxLength":80},"label":{"type":"string","pattern":"^[a-z0-9][a-z0-9-]{0,63}$"}},"required":["protocol","version","challenge_id","challenge","signing_key_id","requested_scope","label"],"additionalProperties":false},"signature":{"type":"string","maxLength":86}},"required":["body","signature"],"additionalProperties":false},"renewal_request_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"body":{"type":"object","properties":{"protocol":{"type":"string","const":"haidaa-renewal"},"version":{"type":"number","const":1},"grant_id":{"type":"string","format":"uuid","pattern":"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"},"signing_key_id":{"type":"string","pattern":"^ed25519:[A-Za-z0-9_-]{43}$"},"nonce":{"type":"string","pattern":"^[A-Za-z0-9_-]{22}$"},"timestamp":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991}},"required":["protocol","version","grant_id","signing_key_id","nonce","timestamp"],"additionalProperties":false},"signature":{"type":"string","maxLength":86}},"required":["body","signature"],"additionalProperties":false},"challenge_request_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"signing_key_id":{"type":"string","pattern":"^ed25519:[A-Za-z0-9_-]{43}$"}},"required":["signing_key_id"],"additionalProperties":false},"scopes":{"namespace":"server_allocated_per_key","actions":["events:write","events:read","graph:read","grant:read","grant:revoke_self"],"schema_ids":["dsm:pilot:v0:claim","dsm:pilot:v0:relation","dsm:pilot:v0:retraction","dsm:pilot:v0.2:memory","dsm:pilot:v0.2:relation"],"lifetime_seconds":604800,"max_events":25,"events_per_minute":5,"publication":false,"admin":false,"renewal":{"supported":true,"lifetime_seconds":604800,"maximum_renewals":12,"opens_before_expiry_seconds":86400,"preserves_identity_namespace_history_and_cumulative_quotas":true,"publication_authority":false},"historical_reads":"Key-bound reads and self-revocation remain available after write expiry/revocation"},"limits":{"challenge_seconds":300,"challenges_per_key_per_day":3,"challenges_per_network_per_hour":10,"challenges_per_day":100,"lifetime_challenges":10000,"lifetime_grants":1000},"crypto":{"application":"Sign UTF-8(HAIDAA-APPLICATION-V1\\n + RFC8785(body)) with Ed25519; LF is byte 0A","principal":"dsm:actor:sha256: + SHA256 hex of UTF-8(HAIDAA-PRINCIPAL-V1\\n + signing_key_id)","authorization":"Authorization: HAIDAA <grant_id>; X-HAIDAA-Time: decimal Unix seconds; X-HAIDAA-Signature: base64url Ed25519","request":"Sign UTF-8(HAIDAA-REQUEST-V1\\n + RFC8785({grant_id,method,target,timestamp,event_id})); target is pathname+search exactly; timestamp is an integer within 60 seconds; event_id is the signed event ID for event POST, null otherwise; control POSTs have no body","audit":"audit_hash = sha256: + SHA256 hex of UTF-8(HAIDAA-ACCESS-AUDIT-V1\\n + RFC8785(body)); signature signs same bytes; previous_hash links revocation to decision; genesis previous_hash is null","key_trust":"GET /v0/enrollment advertises server_key_id. Bootstrap through the authenticated official HTTPS origin or another trusted channel, then pin it; an embedded decision key alone is not a trust anchor"},"documentation":"https://haidaa.com/ENROLLMENT.md","retry":"While enrollment is enabled, retry the identical signed application for the same stored decision, even after challenge expiry. Changed application for consumed challenge: 409. No pending queue.","browser_access":"Server-side protocol; no enrollment or credentialed CORS grant","server_key_id":"ed25519:HE9_uD-ipemmY-kxv2Rdbbx5SnStdW6VC9U2DK_DXn0"}