Docs API reference

Schemas

The named request and response schemas of the API.

Every named schema in the OpenAPI description. Field types link here from the operation pages.

`ErrorCode`

Type: one of "invalid_request", "unauthenticated", "forbidden", "not_found", "step_up_required", "provider_unavailable", "conflict", "semantic_check_failed", "rate_limited", "unavailable"

Machine-readable error code. The HTTP status is fixed per code except where noted on invalid_request.

`FieldError`

Type: object

Field	Type	Required	Description
`field`	string	Yes	The offending field, a dotted or indexed path (`details.type`, `files[0].size`) or a header name.
`message`	string	Yes

`Error`

Type: object

The error model returned by every failing request.

Field	Type	Required	Description
`code`	`ErrorCode`	Yes
`message`	string	Yes	Human-readable. Not stable; branch on `code`.
`request_id`	string	Yes	Echoes the `x-request-id` response header. pattern `^req_[0-9a-z]{26}$`
`field_errors`	array of `FieldError`	No	Present only when specific fields are at fault.

`CursorExpired`

Type: object

The 410 body of the change feed. It follows the error model, but code is cursor_expired, which is not one of the ErrorCode values, and it adds resync instructions and the current head cursor.

Field	Type	Required	Description
`code`	`"cursor_expired"`	Yes
`message`	string	Yes
`request_id`	string	Yes
`resync`	string	Yes	What to do.
`next_cursor`	string	Yes	The current head of the feed; resume from here after re-resolving.

`Timestamp`

Type: string (date-time)

ISO 8601 UTC timestamp.

`OrganizationId`

Type: string; pattern ^org_[0-9a-z]{26,32}$

Example

json

"org_7k3m9q2x8d5f1h4j6n0p2r4t8v"

`ClaimId`

Type: string; pattern ^clm_[0-9a-z]{26,32}$

Example

json

"clm_4c8e2g6k0m3q7s1w5y9a2d6f8h"

`BindingId`

Type: string; pattern ^bnd_[0-9a-z]{26,32}$

Example

json

"bnd_9r2t5w8z1b4d7f0h3k6n9q2s5v"

`DelegationId`

Type: string; pattern ^dlg_[0-9a-z]{26,32}$

Example

json

"dlg_2b5d8f1h4k7n0q3s6w9y2a5c8e"

`TrustDomain`

Type: string; 1 to 255 characters; pattern ^[a-z0-9._-]+$

An exact SPIFFE trust domain, lowercase, no spiffe://.

Example

json

"agents.payments.example.com"

`WorkloadScope`

Type: array of string; 1 to 64 items; unique items

Workload path prefixes. 1 to 64 distinct prefixes; each starts with /, has at least one segment, and each segment is [A-Za-z0-9._-]+ (no . or .., no percent-encoding).

Example

json

[
  "/agent/checkout",
  "/agent/refunds"
]

`BundleDigest`

Type: string; pattern ^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$

Unpadded base64url SHA-256 of the exact bundle bytes (43 characters).

Example

json

"q7Yd3nXk0aV2pLw9sT4uHc8BzE1mR6fJ5gN0oIxK2tA"

`OrgRole`

Type: one of "organization_owner", "issuer_administrator", "domain_administrator", "viewer"

`ServiceTokenScope`

Type: one of "issuer_administrator", "domain_administrator", "viewer"

`PermittedAction`

Type: one of "authorize_issuer", "delegate", "manage_domain"

What a reviewed representative authority permits.

`ClaimState`

Type: one of "pending_domain", "pending_identity", "pending_authority", "verified", "needs_information", "rejected", "disputed", "expired", "suspended", "withdrawn"

`Health`

Type: object

Field	Type	Required	Description
`status`	`"ok"`	Yes
`environment`	string	Yes	The deployment environment name.

`ObservationSummary`

Type: object

The latest TLS observation in a domain list entry.

Field	Type	Required	Description
`status`	string	Yes	Observation status; `unchecked` until the first observation.
`observed_at`	string (date-time) or null	Yes

`DomainSummary`

Type: object

Field	Type	Required	Description
`domain`	string	Yes	Canonical domain name.
`display_name`	string	Yes
`registrable_domain`	string	Yes
`status`	string	Yes	`unclaimed`, `claimed`, or another status shown raw (never silently mapped to `claimed`).
`rank`	integer or null	Yes	Current popularity rank: the rank from the most recent snapshot that lists the domain among the newest snapshot of each source (snapshot recency is the source list's creation date). A domain left out of the newest snapshot of its source has no current rank from it, and with no current listing anywhere it is null (unranked, browsed after ranked domains). Every snapshot's rank stays in `sources`.
`observation`	`ObservationSummary`	Yes

`SourceList`

Type: object

Field	Type	Required	Description
`data`	array of object	Yes
`data[].snapshot_id`	string	Yes
`data[].source`	string	Yes
`data[].snapshot`	string	Yes	The source's own snapshot identifier (a Tranco list ID, an archive date).
`data[].snapshot_date`	string (date-time) or null	Yes	When the source list was created, if known.
`data[].retrieved_at`	string (date-time)	Yes
`data[].row_limit`	integer	Yes	How many leading rows of the list were imported.
`data[].checksum`	string	Yes	sha256: of the imported slice.
`data[].source_file_sha256`	string or null	Yes	SHA-256 of the full upstream file.
`data[].psl_version`	string	Yes	Public Suffix List version used to canonicalize names.
`data[].attribution`	string	Yes
`data[].license`	string or null	Yes
`data[].counts`	object	Yes
`data[].counts.source_rows`	integer or null	Yes
`data[].counts.unique_domains`	integer or null	Yes
`data[].counts.invalid_rows`	integer or null	Yes
`data[].counts.merged_rows`	integer or null	Yes
`data[].coverage`	object or null	Yes	Null until first computed.
`data[].coverage.observed`	integer or null	Yes
`data[].coverage.unreachable`	integer or null	Yes
`data[].coverage.unknown`	integer or null	Yes
`data[].coverage.pending`	integer or null	Yes
`data[].coverage.as_of`	string (date-time) or null	Yes
`as_of`	string (date-time)	Yes

`PublicOrganization`

Type: object

Field	Type	Required	Description
`id`	string	Yes
`legal_name`	string	Yes
`jurisdiction`	string	Yes	ISO 3166-1 alpha-2, optionally with an ISO 3166-2 subdivision.
`registration_reference`	string or null	Yes	Registry number, reviewed together with the legal name.
`verification`	object	Yes
`verification.status`	`"verified"`	Yes
`verification.first_verified_at`	string (date-time) or null	Yes
`verification.last_reviewed_at`	string (date-time) or null	Yes
`verification.expires_at`	string (date-time) or null	Yes	When the latest identity approval lapses.
`evidence`	object	Yes	Five independent indicators. There is no combined score.
`evidence.organization_identity`	object	Yes
`evidence.organization_identity.status`	one of `"reviewed"`, `"lapsed"`	No
`evidence.organization_identity.reviewed_at`	string (date-time) or null	No
`evidence.organization_identity.expires_at`	string (date-time) or null	No
`evidence.domain_control`	object	Yes
`evidence.domain_control.verified_domains`	integer	No
`evidence.domain_control.listed_domains`	integer	No
`evidence.representative_authority`	object	Yes
`evidence.representative_authority.current`	integer	No
`evidence.representative_authority.listed_domains`	integer	No
`evidence.representative_authority.earliest_expiry`	string (date-time) or null	No
`evidence.issuer_authorization`	object	Yes
`evidence.issuer_authorization.active`	integer	No
`evidence.issuer_authorization.suspended`	integer	No
`evidence.certificate_observation`	object	Yes
`evidence.certificate_observation.observed_domains`	integer	No
`evidence.certificate_observation.listed_domains`	integer	No
`evidence.certificate_observation.latest_observed_at`	string (date-time) or null	No
`evidence.certificate_observation.status_checked`	`false`	No
`domains`	array of object	Yes	Domains with a verified or suspended claim of this organization (at most 200).
`domains[].domain`	string	Yes
`domains[].claim_state`	one of `"verified"`, `"suspended"`	Yes
`domains[].verified_checks`	array of one of `"domain"`, `"identity"`, `"authority"`	Yes
`domains[].domain_verified_at`	string (date-time) or null	Yes	Last successful DNS check.
`domains[].domain_control_recheck_due`	string (date-time) or null	Yes	90 days after the last DNS check.
`domains[].identity_verified_at`	string (date-time) or null	Yes
`domains[].authority_verified_at`	string (date-time) or null	Yes
`domains[].authority_expires_at`	string (date-time) or null	Yes
`domains[].observation`	object	Yes
`domains[].observation.status`	string	No
`domains[].observation.observed_at`	string (date-time) or null	No
`domains[].observation.class`	string or null	No
`issuer_bindings`	array of object	Yes	Published (active or suspended) bindings of an environment this deployment publishes.
`issuer_bindings[].trust_domain`	`TrustDomain`	Yes
`issuer_bindings[].profile`	string	Yes
`issuer_bindings[].workload_scope`	array of string	Yes
`issuer_bindings[].status`	one of `"active"`, `"suspended"`	Yes
`issuer_bindings[].verified_domain`	string or null	Yes
`issuer_bindings[].current_version`	integer	Yes
`issuer_bindings[].bundle_sha256`	string or null	Yes	Digest of the served bundle version (the value assertions pin).
`issuer_bindings[].effective_at`	string (date-time) or null	Yes
`issuer_bindings[].expires_at`	string (date-time) or null	Yes
`issuer_bindings[].bundle_url`	string or null	Yes
`delegations`	object	Yes
`delegations.given`	array of `PublicDelegation`	Yes
`delegations.received`	array of `PublicDelegation`	Yes
`as_of`	string (date-time)	Yes

`PublicDelegation`

Type: object

Field	Type	Required	Description
`child_domain`	string	Yes
`parent_domain`	string	Yes
`organization`	object	Yes	The other organization. `id` is set only when it is itself verified.
`organization.name`	string	Yes
`organization.id`	string or null	Yes
`actions`	array of string	Yes
`workload_scope`	array of string	Yes
`activated_at`	string (date-time) or null	Yes
`expires_at`	string (date-time)	Yes

`DomainPage`

Type: object

Field	Type	Required	Description
`data`	array of `DomainSummary`	Yes
`next_cursor`	string or null	Yes	Opaque; pass as `cursor` for the next page. Null on the last page.
`as_of`	`Timestamp`	Yes

`Observation`

Type: object

The latest TLS observation. Always a historical observation with status_checked: false; it is never a trust verdict and revocation status is not checked.

Field	Type	Required	Description
`status`	string	Yes
`observed_at`	string (date-time) or null	Yes
`class`	string or null	Yes	Certificate validation class (DV, OV, EV, ...) if observed.
`label`	string	Yes
`policy_oids`	array of string	Yes
`policy_version`	string or null	Yes
`trust_store_version`	string or null	Yes
`status_checked`	`false`	Yes
`path_valid`	boolean or null	Yes
`sans_count`	integer or null	Yes
`issuer_cn`	string or null	Yes
`not_before`	string (date-time) or null	Yes
`not_after`	string (date-time) or null	Yes
`error_code`	string or null	Yes
`wildcard_match`	boolean or null	Yes	True when the name matched the certificate only through a wildcard SAN (*.parent), false for an exact SAN, null when unknown.

`DomainDetail`

Type: object

Field	Type	Required	Description
`domain`	string	Yes
`display_name`	string	Yes
`registrable_domain`	string	Yes
`status`	string	Yes
`rank`	integer or null	Yes
`observation`	`Observation`	Yes
`unclaimed`	boolean	Yes
`sources`	array of object	Yes	Imported lists that contain the domain, one row per snapshot (newest first), each with the attribution and license recorded for that snapshot. The rows are the domain's rank history; nothing is removed when a newer snapshot omits it.
`sources[].source`	string	Yes
`sources[].snapshot`	string	Yes
`sources[].rank`	integer or null	Yes
`sources[].original_name`	string or null	Yes
`sources[].snapshot_date`	string (date-time) or null	Yes	When the source list was created, if known.
`sources[].attribution`	string	Yes	Attribution text the source requires; show it wherever the data is shown.
`sources[].license`	string or null	Yes	Terms the snapshot is used under, as stated when it was staged.
`enrollment`	object or null	Yes	Set when the domain was added by enrollment (`POST /v1/domains`) rather than from a source list. Never names who asked.
`enrollment.source`	`"enrollment"`	Yes
`enrollment.validated_at`	`Timestamp`	Yes
`enrollment.note`	string	Yes
`claims`	array of object	Yes	Verified claims only.
`claims[].organization_name`	string	Yes
`claims[].organization_id`	string or null	Yes	The organization's public record, `GET /v1/organizations/{id}/public` (null unless the organization is verified).
`claims[].state`	`"verified"`	Yes
`claims[].verified_checks`	array of one of `"domain"`, `"identity"`, `"authority"`	Yes	The checks that are currently valid (empty if the claim has lapsed).
`pending_claims`	integer	Yes	Count of claims in progress. Never names the organizations.
`delegations`	array of object	Yes	Active delegations under or onto this domain (at most 100).
`delegations[].child_domain`	string	Yes
`delegations[].parent_domain`	string	Yes
`delegations[].organization_name`	string	Yes
`delegations[].organization_id`	string or null	Yes	The recipient's public record id, when it is a verified organization.
`delegations[].expires_at`	`Timestamp`	Yes
`issuer_bindings`	array of object	Yes
`issuer_bindings[].trust_domain`	`TrustDomain`	Yes
`issuer_bindings[].status`	one of `"active"`, `"suspended"`	Yes
`as_of`	`Timestamp`	Yes

`ResolveActive`

Type: object

Field	Type	Required	Description
`trust_domain`	`TrustDomain`	Yes
`status`	`"active"`	Yes
`assertion`	string	Yes	A compact JWS (`header.payload.signature`). Protected header: `alg` `ES256`, `typ` `art-resolution+jwt;v=1`, `kid` (the RFC 7638 thumbprint of the signing key, found in `/.well-known/jwks.json`). The payload is `ResolutionAssertionPayload`.
`expires_at`	`Timestamp`	Yes
`checked_at`	`Timestamp`	Yes

`ResolveInactive`

Type: object

Field	Type	Required	Description
`trust_domain`	`TrustDomain`	Yes
`status`	string	Yes	The binding status (`suspended`, `expired`, `withdrawn`), or `inactive` when a resolution rule failed.
`reason`	string	Yes	A stable reason code: `binding_<status>`, `no_published_binding`, `no_effective_version`, `organization_missing`, `claim_missing`, `delegation_missing`, `expiring`, or a failed resolution rule such as `evidence_expired`, `claim_not_verified`, `organization_not_verified`, `domain_control_missing`, `evidence_missing:<kind>`, `superseded_by_more_specific_claim`, or `delegation_*`. New codes may be added.
`assertion`	null	Yes
`checked_at`	`Timestamp`	Yes

`ResolveResponse`

Type: one of: ResolveActive; ResolveInactive

The resolution result. Discriminate on status.

`ResolutionAssertionPayload`

Type: object

The decoded JWS payload of ResolveActive.assertion. Not a response body: it exists inside the signed token.

JWS protected header: {"alg":"ES256","typ":"art-resolution+jwt;v=1","kid":"<thumbprint>"}. Verify the signature with the JWKS key whose kid matches, require alg ES256 and the exact typ, require iss to be the directory origin you resolved from and aud to equal workload-directory-resolver-v1, and honour nbf/exp with at most 30 seconds of clock skew. Reject any assertion past its exp; do not cache beyond it. Lifetime is at most 300 seconds and is shortened to the earliest expiry of the binding, the claim, the 90-day domain-control freshness window and every piece of evidence (and, for a delegated binding, the delegation and the parent authority). Check bundle_sha256 against the bytes you fetch from bundle_url. The payload is at most 8192 bytes.

Field	Type	Required	Description
`iss`	string	Yes	The directory origin, for example `https://svid.io`., format: uri
`aud`	`"workload-directory-resolver-v1"`	Yes
`iat`	integer	Yes	Seconds since the epoch; the time of the authoritative database read.
`nbf`	integer	Yes	Equal to `iat`.
`exp`	integer	Yes	Expiry; at most `iat` + 300.
`schema_version`	`1`	Yes
`binding_id`	`BindingId`	Yes
`binding_version`	integer	Yes	minimum 1
`status`	`"active"`	Yes
`organization_id`	`OrganizationId`	Yes
`organization_name`	string	Yes	The verified legal name.
`verified_domain`	string	Yes	The domain the organization verified (for a delegated binding, the delegated child domain).
`trust_domain`	`TrustDomain`	Yes
`profile`	`"spiffe-x509"`	Yes	The only supported profile.
`workload_scope`	`WorkloadScope`	Yes
`bundle_url`	string (uri)	Yes	Where to fetch the approved bundle (`/v1/issuer-bindings/{id}/versions/{version}/bundle`).
`bundle_sha256`	`BundleDigest`	Yes
`evidence_summary`	object	Yes
`evidence_summary.domain_control`	`"verified"`	Yes
`evidence_summary.organization_identity`	`"reviewed"`	Yes
`evidence_summary.representative_authority`	`"verified"`	Yes
`policy_version`	`"directory-policy-v1"`	Yes

Example

json

{
  "iss": "https://svid.io",
  "aud": "workload-directory-resolver-v1",
  "iat": 1791201600,
  "nbf": 1791201600,
  "exp": 1791201900,
  "schema_version": 1,
  "binding_id": "bnd_9r2t5w8z1b4d7f0h3k6n9q2s5v",
  "binding_version": 1,
  "status": "active",
  "organization_id": "org_7k3m9q2x8d5f1h4j6n0p2r4t8v",
  "organization_name": "Example Payments, Inc.",
  "verified_domain": "payments.example.com",
  "trust_domain": "agents.payments.example.com",
  "profile": "spiffe-x509",
  "workload_scope": [
    "/agent/checkout",
    "/agent/refunds"
  ],
  "bundle_url": "https://svid.io/v1/issuer-bindings/bnd_9r2t5w8z1b4d7f0h3k6n9q2s5v/versions/1/bundle",
  "bundle_sha256": "q7Yd3nXk0aV2pLw9sT4uHc8BzE1mR6fJ5gN0oIxK2tA",
  "evidence_summary": {
    "domain_control": "verified",
    "organization_identity": "reviewed",
    "representative_authority": "verified"
  },
  "policy_version": "directory-policy-v1"
}

`Jwk`

Type: object

A public ES256 signing key. Private members are never published.

Field	Type	Required	Description
`kty`	`"EC"`	Yes
`crv`	`"P-256"`	Yes
`x`	string	Yes
`y`	string	Yes
`kid`	string	Yes	RFC 7638 thumbprint.
`use`	`"sig"`	Yes
`alg`	`"ES256"`	Yes

`Jwks`

Type: object

Field	Type	Required	Description
`keys`	array of `Jwk`	Yes	at least 1 items

`SpiffeBundle`

Type: object

A SPIFFE trust bundle in the SPIFFE federation (JWKS) format, exactly as the issuer submitted and the reviewers approved it.

Field	Type	Required	Description
`spiffe_sequence`	integer	No	minimum 0
`spiffe_refresh_hint`	integer	No	minimum 0
`keys`	array of object	Yes	1 to 32 items
`keys[].use`	one of `"x509-svid"`, `"jwt-svid"`	No
`keys[].kty`	string	No
`keys[].crv`	string	No
`keys[].x`	string	No
`keys[].y`	string	No
`keys[].kid`	string	No
`keys[].x5c`	array of string	No	at most 1 items

`ChangeEvent`

Type: object

A public lifecycle event. subject is {trust_domain} for binding events and {domain} for delegation, claim and domain.added events. domain.added: an unlisted domain was added after live DNS and TLS validation (POST /v1/domains); its data is {state: unclaimed, registrable_domain, source: enrollment, observed_at, certificate_class, wildcard_match} and never names who asked. At most 100 domain.added events per UTC hour are published; additions beyond that are summarised, after the hour, by one domain.added.batch event with subject: {period_start} and data: {period_end, count, source}. data carries only the allow-listed public fields below, and fields not known for an event are omitted.

Field	Type	Required	Description
`id`	string	Yes	Stable event id. Deduplicate on it.
`event_type`	one of `"binding.activated"`, `"binding.rotated"`, `"binding.resumed"`, `"binding.suspended"`, `"binding.withdrawn"`, `"binding.expired"`, `"delegation.activated"`, `"delegation.withdrawn"`, `"delegation.expired"`, `"delegation.revoked"`, `"claim.state_changed"`, `"domain.added"`, `"domain.added.batch"`	Yes
`at`	`Timestamp`	Yes
`subject`	one of: object; object; object	Yes
`data`	object	Yes	Event payload (public allow-list).
`data.binding_id`	`BindingId`	No
`data.delegation_id`	`DelegationId`	No
`data.claim_id`	`ClaimId`	No
`data.organization_id`	`OrganizationId`	No
`data.state`	string	No	The new state.
`data.previous_state`	string	No
`data.effective_at`	`Timestamp`	No
`data.expires_at`	`Timestamp`	No
`data.binding_version`	integer	No
`data.previous_binding_version`	integer	No
`data.rotation_kind`	`RotationKind`	No
`data.bundle_sha256`	`BundleDigest`	No
`data.previous_bundle_sha256`	`BundleDigest`	No
`data.overlap_until`	`Timestamp`	No
`data.profile`	string	No
`data.workload_scope`	array of string	No
`data.parent_domain`	string	No
`data.actions`	array of string	No
`data.registrable_domain`	string	No
`data.source`	string	No
`data.observed_at`	`Timestamp`	No
`data.certificate_class`	string or null	No
`data.wildcard_match`	boolean	No
`data.period_end`	`Timestamp`	No
`data.count`	integer	No

`ChangeFeedPage`

Type: object

Field	Type	Required	Description
`events`	array of `ChangeEvent`	Yes
`next_cursor`	string	Yes	Opaque. Persist after processing the page and pass it as `cursor` next time. It advances past every row read, including rows not in the public projection, so a page can have fewer events than `limit` even when `has_more` is true.
`has_more`	boolean	Yes

`AuthProviders`

Type: object

Field	Type	Required
`github`	boolean	Yes
`google`	boolean	Yes
`test_login`	boolean	Yes
`test_login_key_required`	boolean	Yes

`TestLoginRequest`

Type: object

Field	Type	Required	Description
`subject`	string	Yes	pattern `^[A-Za-z0-9._@-]{1,128}$`
`email`	string (email)	Yes	at most 254 characters

`TestLoginResponse`

Type: object

Field	Type	Required
`principal_id`	string	Yes
`has_passkey`	boolean	Yes
`mfa`	`false`	Yes

`SessionInfo`

Type: object

Field	Type	Required	Description
`principal`	object	Yes
`principal.id`	string	Yes
`principal.idp`	string	Yes	`github`, `google` or `test`.
`principal.email`	string or null	Yes
`principal.display_name`	string or null	Yes
`mfa`	boolean	Yes	Whether a passkey assertion has been completed in this session.
`mfa_at`	string (date-time) or null	Yes	The last passkey assertion; step-up needs this within 300 seconds.
`has_passkey`	boolean	Yes
`csrf_token`	string	Yes	Send as `x-art-csrf` on mutations.
`roles`	object	Yes
`roles.platform`	array of string	Yes	Platform roles (internal staff). Empty for organization users.
`roles.organizations`	array of object	Yes
`roles.organizations[].organization_id`	`OrganizationId`	Yes
`roles.organizations[].role`	`OrgRole`	Yes
`expires_at`	`Timestamp`	Yes

`WebAuthnOptions`

Type: object

WebAuthn PublicKeyCredentialCreationOptionsJSON or PublicKeyCredentialRequestOptionsJSON, as produced by SimpleWebAuthn. Pass to the browser's WebAuthn API unchanged.

`PasskeyCeremonyRequest`

Type: object

Field	Type	Required	Description
`response`	object	Yes	The `RegistrationResponseJSON` or `AuthenticationResponseJSON` from the browser.

`PasskeyRegistered`

Type: object

Field	Type	Required
`credential_id`	string	Yes
`mfa`	`true`	Yes
`mfa_at`	`Timestamp`	Yes

`PasskeyAuthenticated`

Type: object

Field	Type	Required	Description
`mfa`	`true`	Yes
`mfa_at`	`Timestamp`	Yes

`RecoveryState`

Type: one of "pending", "approved", "rejected", "expired", "withdrawn", "superseded_by_recovery"

pending until the reviewers approve (approved), one rejects, the requester withdraws, 30 days pass (expired), or another recovery of the organization is approved (superseded_by_recovery). All but pending are terminal.

`RecoveryRequest`

Type: object

Field	Type	Required	Description
`id`	string	Yes
`organization`	object	Yes
`organization.id`	string	No
`organization.legal_name`	string	No
`state`	`RecoveryState`	Yes
`version`	integer	Yes
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes
`expires_at`	string (date-time)	Yes
`domain_rechecked_at`	string (date-time) or null	Yes	When you passed the fresh DNS challenge for this request.
`approvals`	integer	Yes	Distinct reviewers who approved the current version.
`required_approvals`	integer	Yes
`verified_domains`	array of string	Yes	The organization's verified domains (where a recovery challenge may be issued).
`challenge`	object or null	Yes	The live DNS challenge, never its value.
`challenge.id`	string	No
`challenge.dns_name`	string	No
`challenge.expires_at`	string (date-time)	No
`challenge.attempts`	integer	No
`challenge.remaining`	integer	No
`required_domains`	array of object	Yes	Every domain this recovery must re-prove, and whether you have (within 7 days).
`required_domains[].domain`	string	No
`required_domains[].proven`	boolean	No
`owner_objection`	object or null	No
`owner_objection.at`	string (date-time)	No
`earliest_decision_at`	string (date-time)	Yes	The earliest time the final approval can be recorded (the owners' notice period).
`reason`	string or null	No	What you wrote (private). Only in GET responses; null after the retention period.
`contact_details`	string or null	No	What you wrote (private). Only in GET responses; null after the retention period.
`next_actions`	array of one of `"request_dns_challenge"`, `"publish_txt_record_and_verify"`, `"await_independent_review"`	Yes

`Organization`

Type: object

Field	Type	Required	Description
`id`	`OrganizationId`	Yes
`legal_name`	string	Yes
`jurisdiction`	string	Yes	ISO 3166-1 alpha-2 country, optionally with an ISO 3166-2 subdivision., examples: [US, US-DE]
`registration_reference`	string or null	Yes
`verification_status`	string	Yes	`draft` until identity is verified, then `verified`.
`version`	integer	Yes	Optimistic concurrency token (`expected_version`). minimum 1
`created_at`	`Timestamp`	Yes
`updated_at`	`Timestamp`	Yes
`my_roles`	array of string	No	The caller's roles (a service token's scopes). Present on create, get, update and list.

`CreateOrganizationRequest`

Type: object

Field	Type	Required	Description
`legal_name`	string	Yes	NFC-normalized, trimmed, 1 to 200 code points, no control or bidi characters. 1 to 200 characters
`jurisdiction`	string	Yes	ISO 3166-1 alpha-2 country, optionally with an ISO 3166-2 subdivision (for example `US` or `US-DE`)., examples: [US-DE]
`registration_reference`	string or null	No	at most 100 characters

`UpdateOrganizationRequest`

Type: object

Field	Type	Required	Description
`expected_version`	integer	Yes	minimum 1
`legal_name`	string	No	1 to 200 characters
`jurisdiction`	string	No
`registration_reference`	string or null	No	`null` or `""` clears it. at most 100 characters

`OrganizationList`

Type: object

Field	Type	Required	Description
`organizations`	array of `Organization`	Yes

`ClaimSummary`

Type: object

Field	Type	Required
`id`	`ClaimId`	Yes
`domain`	string	Yes
`state`	`ClaimState`	Yes
`resume_state`	one of: `ClaimState`; null	Yes
`version`	integer	Yes
`created_at`	`Timestamp`	Yes
`updated_at`	`Timestamp`	Yes
`authority_expires_at`	string (date-time) or null	Yes
`permitted_actions`	array of `PermittedAction`	Yes

`ClaimList`

Type: object

Field	Type	Required	Description
`claims`	array of `ClaimSummary`	Yes

`IssuerBindingSummary`

Type: object

Field	Type	Required	Description
`id`	`BindingId`	Yes
`trust_domain`	`TrustDomain`	Yes
`verified_domain`	string or null	Yes
`mapping`	one of `"dns"`, `"explicit"`, `null`	Yes
`profile`	`"spiffe-x509"`	Yes
`workload_scope`	`WorkloadScope`	Yes
`environment`	one of `"production"`, `"test"`	Yes
`status`	`BindingStatus`	Yes
`version`	integer	Yes
`current_version`	integer	Yes	The served bundle version; 0 until first activation.
`expires_at`	string (date-time) or null	Yes
`created_at`	`Timestamp`	Yes
`updated_at`	`Timestamp`	Yes
`latest_version`	integer or null	Yes

`IssuerBindingList`

Type: object

Field	Type	Required	Description
`issuer_bindings`	array of `IssuerBindingSummary`	Yes

`Member`

Type: object

Field	Type	Required	Description
`principal_id`	string	Yes
`role`	`OrgRole`	Yes
`status`	string	Yes
`version`	integer	Yes	Use as `expected_version`.
`display_name`	string or null	Yes
`idp`	string	Yes
`email`	string or null	No	Only shown to owners, and only for active members.
`created_at`	`Timestamp`	Yes
`updated_at`	`Timestamp`	Yes

`MemberList`

Type: object

Field	Type	Required	Description
`members`	array of `Member`	Yes

`UpdateMemberRequest`

Type: object

Field	Type	Required	Description
`role`	`OrgRole`	Yes
`expected_version`	integer	Yes	minimum 1

`RemoveMemberRequest`

Type: object

expected_version is required when removing another member and optional when leaving (me).

Field	Type	Required	Description
`expected_version`	integer	No	minimum 1

`CreateInvitationRequest`

Type: object

Field	Type	Required	Description
`email`	string (email)	Yes	at most 254 characters
`role`	`OrgRole`	Yes

`InvitationCreated`

Type: object

Field	Type	Required
`invitation_id`	string	Yes
`organization_id`	`OrganizationId`	Yes
`role`	`OrgRole`	Yes
`status`	`"pending"`	Yes
`expires_at`	`Timestamp`	Yes

`OrganizationInvitationList`

Type: object

Field	Type	Required
`invitations`	array of object	Yes
`invitations[].id`	string	Yes
`invitations[].role`	`OrgRole`	Yes
`invitations[].status`	`"pending"`	Yes
`invitations[].invited_by`	string	Yes
`invitations[].created_at`	`Timestamp`	Yes
`invitations[].expires_at`	`Timestamp`	Yes

`MyInvitationList`

Type: object

Field	Type	Required
`invitations`	array of object	Yes
`invitations[].id`	string	Yes
`invitations[].organization`	object	Yes
`invitations[].organization.id`	`OrganizationId`	Yes
`invitations[].organization.legal_name`	string	Yes
`invitations[].role`	`OrgRole`	Yes
`invitations[].created_at`	`Timestamp`	Yes
`invitations[].expires_at`	`Timestamp`	Yes

`InvitationAccepted`

Type: object

Field	Type	Required
`organization_id`	`OrganizationId`	Yes
`role`	`OrgRole`	Yes
`status`	`"active"`	Yes

`CreateServiceTokenRequest`

Type: object

Field	Type	Required	Description
`name`	string	Yes	1 to 100 characters
`scopes`	array of `ServiceTokenScope`	Yes	at least 1 items; unique items
`expires_in_days`	integer	No	1 to 90; default `30`

`ServiceToken`

Type: object

Field	Type	Required
`id`	string	Yes
`name`	string	Yes
`scopes`	array of `ServiceTokenScope`	Yes
`expires_at`	`Timestamp`	Yes
`created_by`	string	Yes
`created_at`	`Timestamp`	Yes
`revoked_at`	string (date-time) or null	Yes
`last_used_at`	string (date-time) or null	Yes

`ServiceTokenCreated`

Type: ServiceToken and object

`ServiceTokenList`

Type: object

Field	Type	Required	Description
`service_tokens`	array of `ServiceToken`	Yes

`Claim`

Type: object

Field	Type	Required	Description
`id`	`ClaimId`	Yes
`organization_id`	`OrganizationId`	Yes
`domain`	string	Yes
`state`	`ClaimState`	Yes
`resume_state`	one of: `ClaimState`; null	Yes	The pending step to return to after `needs_information`, a dispute or a rejection.
`version`	integer	Yes	Optimistic concurrency token. minimum 1
`claimant_id`	string	Yes
`created_at`	`Timestamp`	Yes
`updated_at`	`Timestamp`	Yes
`expires_at`	string (date-time) or null	Yes
`domain_verified_at`	string (date-time) or null	Yes
`identity_verified_at`	string (date-time) or null	Yes
`authority_verified_at`	string (date-time) or null	Yes
`authority_expires_at`	string (date-time) or null	Yes
`permitted_actions`	array of `PermittedAction`	Yes	What the reviewed representative authority permits.

`ClaimEnvelope`

Type: object

Field	Type	Required	Description
`claim`	`Claim`	Yes

`CreateClaimRequest`

Type: object

Field	Type	Required	Description
`organization_id`	`OrganizationId`	Yes
`domain`	string	Yes	An exact hostname. It is canonicalized; a name that is not a valid registrable-domain hostname is a field error carrying the reason.

`DnsChallenge`

Type: object

Field	Type	Required	Description
`id`	string	Yes
`purpose`	`"recheck"`	No	Present only on recheck challenges.
`dns_name`	string	Yes	Where to publish the TXT record., examples: [_workload-directory.payments.example.com]
`record_type`	`"TXT"`	Yes
`expires_at`	`Timestamp`	Yes
`max_attempts`	integer	Yes
`attempts`	integer	No	Present on recheck challenges.
`value`	string or null	Yes	The exact TXT value (`art-verify=<token>`), shown once. `null` in an idempotent replay (with `value_redacted: true`).
`value_redacted`	`true`	No

`ClaimCreated`

Type: object

Field	Type	Required
`claim`	`Claim`	Yes
`challenge`	`DnsChallenge`	Yes
`instructions`	string	Yes

`ChallengeCreated`

Type: object

Field	Type	Required	Description
`challenge`	`DnsChallenge`	Yes
`instructions`	string	Yes

`ChallengeStatus`

Type: object

A challenge as shown after creation: status only, never the value.

Field	Type	Required
`id`	string	Yes
`purpose`	one of `"claim"`, `"recheck"`	Yes
`principal_id`	string	Yes
`dns_name`	string	Yes
`expires_at`	`Timestamp`	Yes
`consumed_at`	string (date-time) or null	Yes
`attempts`	integer	Yes
`status`	one of `"pending"`, `"consumed"`, `"failed"`, `"expired"`, `"superseded"`, `"cancelled"`	Yes
`last_failure`	string or null	Yes
`last_checked_at`	string (date-time) or null	Yes
`created_at`	`Timestamp`	Yes

`ClaimEvidence`

Type: object

Evidence as the organization may see it. description, details and files appear only for the organization's own submitted rows.

Field	Type	Required
`id`	string	Yes
`kind`	string	Yes
`result`	string	Yes
`observed_at`	`Timestamp`	Yes
`expires_at`	string (date-time) or null	Yes
`description`	string or null	No
`details`	object or null	No
`files`	array of object	No
`files[].id`	string	Yes
`files[].name`	string	Yes
`files[].content_type`	`EvidenceContentType`	Yes
`files[].size`	integer	Yes
`files[].status`	`EvidenceFileStatus`	Yes
`files[].rejection_reason`	string or null	Yes
`files[].sha256`	string or null	Yes
`files[].uploaded_at`	string (date-time) or null	Yes

`ClaimDetail`

Type: object

Field	Type	Required	Description
`claim`	`Claim`	Yes
`information_request`	object or null	Yes	While the claim is `needs_information`: what the reviewer asked the organization to provide. `message` is the reviewer's organization-visible request text (null if none was given). The reviewer's private reason and identity are never returned.
`information_request.check`	one of `"identity"`, `"authority"`	Yes
`information_request.message`	string or null	Yes	at most 2000 characters
`information_request.requested_at`	`Timestamp`	Yes
`checks`	object	Yes
`checks.domain_control`	one of `"passed"`, `"pending"`	Yes
`checks.organization_identity`	one of `"passed"`, `"pending"`	Yes
`checks.representative_authority`	one of `"passed"`, `"pending"`	Yes
`challenges`	array of `ChallengeStatus`	Yes	The five most recent, newest first.
`evidence`	array of `ClaimEvidence`	Yes	Up to 50, newest first.
`failed_checks`	array of object	Yes
`failed_checks[].check`	`"domain_control"`	Yes
`failed_checks[].challenge_id`	string	Yes
`failed_checks[].reason`	string	Yes
`failed_checks[].attempts`	integer	Yes
`failed_checks[].at`	string (date-time) or null	Yes
`next_actions`	array of string	Yes	Suggested next steps (stable codes such as `publish_txt_record_and_verify`, `request_new_challenge`, `submit_organization_identity_evidence`, `submit_representative_authority_evidence`, `provide_requested_information`, `await_review`, `await_dispute_review`, `complete_domain_recheck`, `request_domain_recheck`, `file_a_new_claim`).
`domain_recheck`	object or null	Yes	Present when a 90-day recheck challenge is open.
`domain_recheck.challenge_id`	string	Yes
`domain_recheck.dns_name`	string	Yes
`domain_recheck.record_type`	`"TXT"`	Yes
`domain_recheck.expires_at`	`Timestamp`	Yes
`domain_recheck.domain_control_fresh_until`	string (date-time) or null	Yes
`domain_recheck.value`	null	Yes
`domain_recheck.reveal`	string	Yes	The request that reveals a (rotated) value.

`JobAccepted`

Type: object

Field	Type	Required
`job_id`	string	Yes
`status`	`JobState`	Yes
`challenge_id`	string	Yes

`JobState`

Type: one of "queued", "running", "retry", "done", "failed", "cancelled"

`Job`

Type: object

Field	Type	Required	Description
`id`	string	Yes
`kind`	string	Yes
`state`	`JobState`	Yes
`attempts`	integer	Yes
`result`	object or null	Yes	The job outcome once `done`. `verify_dns`: `outcome` is `verified`, `no_match`, `rejected` or `not_pending`. `domain_enroll`: `added` (with `domain_id` and the `observation` summary), `present`, or `rejected` (with `reason` and a plain-words `message`).
`created_at`	`Timestamp`	Yes
`updated_at`	`Timestamp`	Yes

`AppealRequest`

Type: object

Field	Type	Required	Description
`reason`	string	Yes	Plain text, no control characters. Kept in the audit trail for the reviewer; never public. 1 to 2000 characters
`expected_version`	integer	No	If sent, must equal the claim's current version.

`ExpectedVersionRequest`

Type: object

Field	Type	Required	Description
`expected_version`	integer	Yes	The `version` you last read; a stale value is `409`. minimum 1

`WithdrawRequest`

Type: object

Field	Type	Required	Description
`expected_version`	integer	Yes	The `version` you last read; a stale value is `409`.
`reason`	string	No	Free text (newlines allowed, no other control characters). at most 2000 characters

`WithdrawBindingRequest`

Type: object

Field	Type	Required	Description
`expected_version`	integer	Yes	The `version` you last read; a stale value is `409`.
`reason`	string	Yes	Required. Free text (newlines allowed, no other control characters); audit log only, never public. 1 to 2000 characters

`EvidenceContentType`

Type: one of "application/pdf", "image/png", "image/jpeg"

`EvidenceFileStatus`

Type: one of "awaiting_upload", "uploading", "stored", "rejected"

`EvidenceDetails`

Type: object

Kind-specific structured details. Allowed keys depend on kind: organization_identity accepts type (ca_certificate, registry_record, other), certificate_reference, registry_url, registry_number, registry_name; representative_authority accepts type (independent_contact, delegated_authority_letter, company_email, other), contact_name, contact_role, contact_channel, company_email. Unknown keys are rejected. See the operation for which keys each type requires.

Field	Type	Required	Description
`type`	string	Yes
`certificate_reference`	string	No	at most 500 characters
`registry_url`	string (uri)	No	An `https` URL. at most 500 characters
`registry_number`	string	No	at most 100 characters
`registry_name`	string	No	at most 200 characters
`contact_name`	string	No	at most 200 characters
`contact_role`	string	No	at most 200 characters
`contact_channel`	string	No	at most 200 characters
`company_email`	string (email)	No	at most 254 characters

`DeclaredFile`

Type: object

Field	Type	Required	Description
`name`	string	Yes	A file name; `/` and `\` are rejected. 1 to 200 characters
`content_type`	`EvidenceContentType`	Yes
`size`	integer	Yes	Exact size in bytes (at most 10 MiB). 1 to 10485760

`SubmitEvidenceRequest`

Type: object

Field	Type	Required	Description
`kind`	one of `"organization_identity"`, `"representative_authority"`	Yes
`description`	string	Yes	Plain text for the reviewer. 1 to 2000 characters
`details`	`EvidenceDetails`	Yes
`files`	array of `DeclaredFile`	No	at most 5 items

`EvidenceSubmitted`

Type: object

Field	Type	Required	Description
`evidence`	object	Yes
`evidence.id`	string	Yes
`evidence.claim_id`	`ClaimId`	Yes
`evidence.kind`	one of `"organization_identity"`, `"representative_authority"`	Yes
`evidence.result`	`"submitted"`	Yes
`evidence.created_at`	`Timestamp`	Yes
`evidence.files`	array of object	Yes
`evidence.files[].id`	string	Yes
`evidence.files[].name`	string	Yes
`evidence.files[].content_type`	`EvidenceContentType`	Yes
`evidence.files[].size`	integer	Yes
`evidence.files[].status`	`"awaiting_upload"`	Yes
`evidence.files[].upload_expires_at`	`Timestamp`	Yes
`evidence.files[].upload`	object	Yes	How to upload this file. The token is shown once (`null` and `upload_redacted: true` in an idempotent replay).
`evidence.files[].upload_redacted`	`true`	No

`EvidenceFileStored`

Type: object

Field	Type	Required	Description
`id`	string	Yes
`evidence_id`	string	Yes
`status`	`"stored"`	Yes
`size`	integer	Yes
`sha256`	string	Yes	Hex SHA-256 of the stored bytes.

`BindingStatus`

Type: string

draft, pending_review, active, suspended, withdrawn or expired. Other terminal values may appear.

`CreateIssuerBindingRequest`

Type: object

Field	Type	Required	Description
`claim_id`	`ClaimId`	Yes
`trust_domain`	`TrustDomain`	Yes
`profile`	`"spiffe-x509"`	Yes	The only supported profile. Needs at least one `x509-svid` key.
`bundle_endpoint`	string (uri)	Yes	`https`, port 443, DNS host (no IP literal), no credentials or fragment. Must be at or under the verified domain. at most 2048 characters
`bundle`	string	Yes	The exact SPIFFE bundle JSON text (a string, not an object), UTF-8, no BOM, at most 64 KiB and 32 keys. The directory stores and hashes these exact bytes. at most 65536 characters
`workload_scope`	`WorkloadScope`	Yes
`environment`	one of `"production"`, `"test"`	No	Production deployments accept only `production`. default `"production"`
`mapping`	one of `"dns"`, `"explicit"`	No	`dns`: the trust domain is the claim's domain or a DNS name under it. `explicit`: a single-label trust domain (no dots) mapped by a reviewer. default `"dns"`

`BindingVersion`

Type: object

Field	Type	Required	Description
`version`	integer	Yes	minimum 1
`status`	string	Yes	`proposed`, `active`, `superseded`, `rejected`, `quarantined` or `replaced`.
`endpoint`	string (uri)	Yes
`bundle_sha256`	`BundleDigest`	Yes
`bundle_size`	integer	Yes
`keys`	array of object	Yes	A summary of the keys in the bundle (type, curve and use; no key material).
`created_at`	`Timestamp`	Yes
`approved_at`	string (date-time) or null	Yes
`effective_at`	string (date-time) or null	Yes
`endpoint_checked_at`	string (date-time) or null	Yes
`overlap_until`	string (date-time) or null	Yes
`superseded_by`	integer or null	Yes
`rotation_of`	integer or null	Yes
`overlap_seconds`	integer or null	Yes
`rotation_kind`	one of: `RotationKind`; null	Yes	The kind of rotation this version is (null for a first registration).
`issuer_control`	object or null	Yes	The issuer-control evidence behind this version.
`ceremony_components`	array of object	Yes

`BindingRotation`

Type: object

A rotation in flight (version N+1 proposed against the served version N).

Field	Type	Required	Description
`version`	integer	Yes
`rotation_of`	integer	Yes
`kind`	one of: `RotationKind`; null	Yes	Null for a proposal made before kinds existed.
`overlap_seconds`	integer	Yes
`continuity`	boolean	Yes	The new bundle shares at least one x509-svid authority with the served version.
`required_approvals`	one of `1`, `2`	Yes
`ceremony_complete`	boolean	Yes

`Binding`

Type: object

Field	Type	Required	Description
`id`	`BindingId`	Yes
`organization_id`	`OrganizationId`	Yes
`claim_id`	`ClaimId`	Yes
`delegation_id`	one of: `DelegationId`; null	Yes
`trust_domain`	`TrustDomain`	Yes
`verified_domain`	string or null	Yes
`mapping`	one of `"dns"`, `"explicit"`, `null`	Yes
`profile`	`"spiffe-x509"`	Yes
`workload_scope`	`WorkloadScope`	Yes
`environment`	one of `"production"`, `"test"`	Yes
`required_approvals`	integer	Yes	Independent reviewer approvals this binding needs in the current deployment.
`status`	`BindingStatus`	Yes
`status_reason`	string or null	Yes
`version`	integer	Yes	Optimistic concurrency token (`expected_version`). minimum 1
`current_version`	integer	Yes	The served bundle version; 0 until first activation. minimum 0
`expires_at`	string (date-time) or null	Yes
`created_at`	`Timestamp`	Yes
`updated_at`	`Timestamp`	Yes
`endpoint_drift`	boolean	Yes	The federation endpoint no longer serves the approved keys.
`endpoint_drift_at`	string (date-time) or null	Yes
`rotation`	one of: `BindingRotation`; null	Yes
`versions`	array of `BindingVersion`	Yes
`next_actions`	array of string	Yes	Suggested next steps (`complete_issuer_control_ceremony`, `submit_new_version`, `await_review`, `await_rotation_review`, `rotate`, `rotate_to_endpoint_keys_or_restore_endpoint`).

`BindingEnvelope`

Type: object

Field	Type	Required	Description
`binding`	`Binding`	Yes

`Ceremony`

Type: object

Human-readable instructions for the issuer-control ceremony of one binding version.

Field	Type	Required	Description
`version`	integer	Yes
`bundle_sha256`	`BundleDigest`	Yes
`challenge`	string	Yes
`required`	array of string	Yes
`methods`	object	Yes	Instructions keyed by proof method.
`methods.federation_endpoint`	string	No
`methods.x509_svid`	string	No
`methods.signed_statement`	string	No
`after`	string	Yes

`BindingWithCeremony`

Type: object

Field	Type	Required	Description
`binding`	`Binding`	Yes
`ceremony`	`Ceremony`	Yes

`CreateBindingVersionRequest`

Type: object

Field	Type	Required	Description
`expected_version`	integer	Yes	The binding's `version`.
`bundle`	string	Yes	The exact SPIFFE bundle JSON text. at most 65536 characters
`bundle_endpoint`	string (uri)	No	Defaults to the previous version's endpoint. at most 2048 characters

`RotationKind`

Type: one of "add", "remove", "renewal", "emergency"

See POST /v1/issuer-bindings/{id}/rotate for the rules of each kind.

`RotateBindingRequest`

Type: object

Field	Type	Required	Description
`expected_version`	integer	Yes	The binding's `version`.
`bundle`	string	Yes	The exact SPIFFE bundle JSON text of the new version. at most 65536 characters
`bundle_endpoint`	string (uri)	No	Defaults to the served version's endpoint. at most 2048 characters
`overlap_seconds`	integer	Yes	The overlap recorded on an `add` step: the earliest a later `remove` step may drop the old authorities (activation + this). 330 s to 7 days; at least 86400 s for an `add` step in production. Required for every kind. 330 to 604800
`emergency`	boolean	No	Declare an emergency rotation (compromise response): replaces or drops authorities at once, always 2 approvals. Needs `reason`. default `false`
`reason`	string	No	Required with `emergency: true`, refused otherwise. Newlines allowed, no other control characters. 1 to 2000 characters

`RotationPreviewRequest`

Type: object

The body of RotateBindingRequest, with expected_version optional.

Field	Type	Required	Description
`expected_version`	integer	No
`bundle`	string	Yes	at most 65536 characters
`bundle_endpoint`	string (uri)	No	at most 2048 characters
`overlap_seconds`	integer	Yes	330 to 604800
`emergency`	boolean	No	default `false`
`reason`	string	No	1 to 2000 characters

`RotationPreview`

Type: object

Field	Type	Required	Description
`allowed`	boolean	Yes	Whether rotate would accept this body now.
`dry_run`	`true`	Yes
`refusal`	object or null	Yes
`refusal.code`	string	Yes
`refusal.status`	integer	Yes
`refusal.message`	string	Yes
`refusal.field_errors`	array of `FieldError`	Yes
`rotation`	object or null	Yes
`rotation.version`	integer	No
`rotation.rotation_of`	integer	No
`rotation.kind`	`RotationKind`	No
`rotation.overlap_seconds`	integer	No
`rotation.continuity`	boolean	No
`rotation.renewal`	boolean	No
`rotation.emergency`	boolean	No
`rotation.shared_authorities`	array of string	No
`rotation.added_authorities`	array of string	No
`rotation.removed_authorities`	array of string	No
`rotation.required_approvals`	one of `1`, `2`	No
`rotation.bundle_sha256`	`BundleDigest`	No
`rotation.bundle_endpoint`	string	No
`rotation.replaces_pending_version`	integer or null	No	A proposal not yet activated that the submit would replace.
`rotation.overlap_until_if_activated_now`	string (date-time) or null	No
`overlap_rules`	object	Yes
`overlap_rules.min_overlap_seconds`	integer	No
`overlap_rules.max_overlap_seconds`	integer	No
`overlap_rules.min_add_overlap_seconds`	integer	No	86400 in a production deployment.
`overlap_rules.served_overlap_until`	string (date-time) or null	No
`overlap_rules.earliest_remove_at`	string (date-time)	No
`overlap_rules.assertion_bound_seconds`	integer	No
`next_steps`	array of string	Yes

`RotationProposed`

Type: object

Field	Type	Required	Description
`binding`	`Binding`	Yes
`rotation`	object	Yes
`rotation.version`	integer	Yes
`rotation.rotation_of`	integer	Yes
`rotation.kind`	`RotationKind`	Yes
`rotation.overlap_seconds`	integer	Yes
`rotation.continuity`	boolean	Yes
`rotation.renewal`	boolean	Yes	The new bundle is byte-identical to the served one (`kind` is `renewal`).
`rotation.emergency`	boolean	Yes	`kind` is `emergency`.
`rotation.shared_authorities`	array of string	Yes	Fingerprints of x509-svid authorities in both bundles.
`rotation.added_authorities`	array of string	Yes	Fingerprints only in the new bundle.
`rotation.removed_authorities`	array of string	Yes	Fingerprints only in the served bundle.
`rotation.required_approvals`	one of `1`, `2`	Yes
`ceremony`	`Ceremony`	Yes

`ControlChallengeStatus`

Type: object

Field	Type	Required	Description
`challenge`	object or null	Yes	The live challenge's status (never its nonce), or null if none is usable.
`challenge.id`	string	Yes
`challenge.version`	integer	Yes
`challenge.bundle_sha256`	`BundleDigest`	Yes
`challenge.expires_at`	`Timestamp`	Yes
`challenge.attempts`	integer	Yes
`challenge.max_attempts`	integer	Yes
`challenge.nonce`	null	Yes
`challenge.value_redacted`	`true`	Yes
`issue`	string	Yes	The request that issues a challenge.
`ceremony`	`Ceremony`	Yes

`ControlChallengeIssued`

Type: object

Field	Type	Required	Description
`challenge`	object	Yes
`challenge.id`	string	Yes
`challenge.version`	integer	Yes
`challenge.bundle_sha256`	`BundleDigest`	Yes
`challenge.expires_at`	`Timestamp`	Yes
`challenge.max_attempts`	integer	Yes
`challenge.nonce`	string or null	Yes	The one-time nonce, shown once. `null` in an idempotent replay.
`challenge.challenge_kid`	string or null	Yes	The `kid` the federation endpoint must publish: `art-challenge-<nonce>`.
`challenge.value_redacted`	`true`	No
`ceremony`	`Ceremony`	Yes

`ControlProofRequest`

Type: object

Field	Type	Required	Description
`method`	one of `"federation_endpoint"`, `"x509_svid"`, `"signed_statement"`	Yes
`svids`	array of string	No	Required for `x509_svid` and forbidden otherwise. One PEM chain (leaf first) per x509-svid CA in the bundle.
`statements`	array of string	No	Required for `signed_statement` and forbidden otherwise. One compact JWS per jwt-svid key (1 to 32). 1 to 32 items
`expected_version`	integer	No	If sent, must equal the binding's `version`.

`ControlProofResult`

Type: object

Field	Type	Required	Description
`binding`	`Binding`	Yes
`component`	object	Yes	The proof component just recorded, with a public summary of what it showed.
`component.id`	string	Yes
`component.kind`	one of `"issuer_surface"`, `"ca_possession"`, `"jwt_key_possession"`	Yes
`component.result`	`"pass"`	Yes
`ceremony_status`	object	Yes
`ceremony_status.challenge_id`	string	Yes
`ceremony_status.required`	array of one of `"issuer_surface"`, `"ca_possession"`, `"jwt_key_possession"`	Yes
`ceremony_status.passed`	array of one of `"issuer_surface"`, `"ca_possession"`, `"jwt_key_possession"`	Yes
`ceremony_status.complete`	boolean	Yes

`BindingWithdrawn`

Type: object

Field	Type	Required	Description
`status`	`BindingStatus`	Yes
`committed_at`	`Timestamp`	Yes
`assertion_bound_seconds`	`330`	Yes	Worst case, in seconds after `committed_at`, that an assertion signed before the commit may still be accepted (300 s lifetime plus 30 s verifier clock skew).
`binding`	`Binding`	Yes

`CreateDelegationRequest`

Type: object

Field	Type	Required	Description
`parent_claim_id`	`ClaimId`	Yes
`child_domain`	string	Yes	A strict DNS descendant of the parent claim's domain.
`recipient_organization_id`	`OrganizationId`	Yes
`scope`	`WorkloadScope`	Yes
`actions`	array of one of `"authorize_issuer"`, `"manage_domain"`	Yes	What the recipient may do. `delegate` (redelegation) is refused. at least 1 items; unique items
`expires_at`	string (date-time)	Yes	ISO 8601 with a time zone; more than 1 minute and at most 1 year ahead, and not after the parent's representative authority.

`Delegation`

Type: object

Field	Type	Required	Description
`id`	`DelegationId`	Yes
`status`	one of `"pending_review"`, `"active"`, `"rejected"`, `"withdrawn"`, `"expired"`, `"revoked"`	Yes
`status_reason`	string or null	Yes
`version`	integer	Yes	Optimistic concurrency token (`expected_version`). minimum 1
`direction`	one of `"outgoing"`, `"incoming"`	Yes	`outgoing` from the parent's side, `incoming` from the recipient's.
`parent`	object	Yes
`parent.organization_id`	`OrganizationId`	Yes
`parent.organization_name`	string	Yes
`parent.claim_id`	`ClaimId`	Yes
`parent.domain`	string	Yes
`child_domain`	string	Yes
`recipient`	object	Yes
`recipient.organization_id`	`OrganizationId`	Yes
`recipient.organization_name`	string	Yes
`actions`	array of string	Yes
`workload_scope`	`WorkloadScope`	Yes
`expires_at`	`Timestamp`	Yes
`created_at`	`Timestamp`	Yes
`accepted_at`	string (date-time) or null	Yes
`activated_at`	string (date-time) or null	Yes
`ended_at`	string (date-time) or null	Yes
`review`	object	Yes
`review.status`	one of `"pending"`, `"approved"`, `"rejected"`, `"not_applicable"`	Yes
`dependent_bindings`	integer	Yes	Draft, pending or active issuer bindings that depend on this delegation.
`next_actions`	array of string	Yes	`accept`, `await_recipient_acceptance`, `await_review`, `register_issuers_under_child_domain`, `withdraw`.

`DelegationEnvelope`

Type: object

Field	Type	Required	Description
`delegation`	`Delegation`	Yes

`DelegationList`

Type: object

Field	Type	Required	Description
`delegations`	array of `Delegation`	Yes

ErrorCode#

FieldError#

Error#

CursorExpired#

Timestamp#

OrganizationId#

ClaimId#

BindingId#

DelegationId#

TrustDomain#

WorkloadScope#

BundleDigest#

OrgRole#

ServiceTokenScope#

PermittedAction#

ClaimState#

Health#

ObservationSummary#

DomainSummary#

SourceList#

PublicOrganization#

PublicDelegation#

DomainPage#

Observation#

DomainDetail#

ResolveActive#

ResolveInactive#

ResolveResponse#

ResolutionAssertionPayload#

Jwk#

Jwks#

SpiffeBundle#

ChangeEvent#

ChangeFeedPage#

AuthProviders#

TestLoginRequest#

TestLoginResponse#

SessionInfo#

WebAuthnOptions#

PasskeyCeremonyRequest#

PasskeyRegistered#

PasskeyAuthenticated#

RecoveryState#

RecoveryRequest#

Organization#

CreateOrganizationRequest#

UpdateOrganizationRequest#

OrganizationList#

ClaimSummary#

ClaimList#

IssuerBindingSummary#

IssuerBindingList#

Member#

MemberList#

UpdateMemberRequest#

RemoveMemberRequest#

CreateInvitationRequest#

InvitationCreated#

OrganizationInvitationList#

MyInvitationList#

InvitationAccepted#

CreateServiceTokenRequest#

ServiceToken#

ServiceTokenCreated#

ServiceTokenList#

Claim#

ClaimEnvelope#

CreateClaimRequest#

DnsChallenge#

ClaimCreated#

ChallengeCreated#

ChallengeStatus#

ClaimEvidence#

ClaimDetail#

JobAccepted#

JobState#

Job#

AppealRequest#

ExpectedVersionRequest#

WithdrawRequest#

`ErrorCode`

`FieldError`

`Error`

`CursorExpired`

`Timestamp`

`OrganizationId`

`ClaimId`

`BindingId`

`DelegationId`

`TrustDomain`

`WorkloadScope`

`BundleDigest`

`OrgRole`

`ServiceTokenScope`

`PermittedAction`

`ClaimState`

`Health`

`ObservationSummary`

`DomainSummary`

`SourceList`

`PublicOrganization`

`PublicDelegation`

`DomainPage`

`Observation`

`DomainDetail`

`ResolveActive`

`ResolveInactive`

`ResolveResponse`

`ResolutionAssertionPayload`

`Jwk`

`Jwks`

`SpiffeBundle`

`ChangeEvent`

`ChangeFeedPage`

`AuthProviders`

`TestLoginRequest`

`TestLoginResponse`

`SessionInfo`

`WebAuthnOptions`

`PasskeyCeremonyRequest`

`PasskeyRegistered`

`PasskeyAuthenticated`

`RecoveryState`

`RecoveryRequest`

`Organization`

`CreateOrganizationRequest`

`UpdateOrganizationRequest`

`OrganizationList`

`ClaimSummary`

`ClaimList`

`IssuerBindingSummary`

`IssuerBindingList`

`Member`

`MemberList`

`UpdateMemberRequest`

`RemoveMemberRequest`

`CreateInvitationRequest`

`InvitationCreated`

`OrganizationInvitationList`

`MyInvitationList`

`InvitationAccepted`

`CreateServiceTokenRequest`

`ServiceToken`

`ServiceTokenCreated`

`ServiceTokenList`

`Claim`

`ClaimEnvelope`

`CreateClaimRequest`

`DnsChallenge`

`ClaimCreated`

`ChallengeCreated`

`ChallengeStatus`

`ClaimEvidence`

`ClaimDetail`

`JobAccepted`

`JobState`

`Job`

`AppealRequest`

`ExpectedVersionRequest`

`WithdrawRequest`