Skip to content
Registry StackDocsDevelopment (unreleased)

Produce evidence for one authorized fixed requirement

POST
/v1/evidence
curl --request POST \
  --url https://example.com/v1/evidence \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "holderKeys": [ { "alg": "ES256", "crv": "P-256", "kid": "example", "kty": "EC", "x": "example", "y": "example" } ], "purpose": "example", "requestNonce": "example", "requirement": "https://example.com", "subjects": [ { "role": "example", "selector": { "profile": "example", "values": { "additionalProperty": "example" } } } ] }'

Missing Accept, /, and the exact application/jose+json media type select the default signed flattened JWS. Only the exact application/vnd.registrystack.evidence-unsigned+json media type selects the unsigned envelope, only the exact application/dc+sd-jwt media type selects the SD-JWT VC serialization of the same assertion, and only the exact application/vnd.registrystack.evidence.batch+json media type selects the holder-bound batch issuance envelope carrying one credential per presented holder key; each is released only when the immutable bundle, the complete matched authority grant, and the requirement’s subject binding mode all permit it. Duplicate, combined, parameterized, weighted, or unknown negotiation returns 406 before source access.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
Evidence request Version 1
object
holderKeys
Array<object>
>= 1 items <= 16 items
object
alg
string
Allowed values: ES256
crv
required
string
Allowed values: P-256
kid
string
>= 1 characters <= 256 characters
kty
required
string
Allowed values: EC
x
required
string
/^[A-Za-z0-9_-]{43}$/
y
required
string
/^[A-Za-z0-9_-]{43}$/
purpose
required
string
/^[a-z][a-z0-9._:-]{0,127}$/
requestNonce
required
string
/^[A-Za-z0-9_-]{43}$/
requirement
required
string format: uri
>= 1 characters <= 512 characters
subjects
required
Array<object>
>= 1 items <= 8 items
object
role
required
string
/^[a-z][a-z0-9._-]{0,63}$/
selector
required
object
profile
required
string
/^[a-z][a-z0-9._-]{0,127}$/
values
object
>= 1 properties <= 16 properties
key
additional properties
One of:
string
>= 1 characters <= 512 characters

Responses

Section titled “Responses”

200

Section titled “200”

Signed Evidence as flattened JWS JSON Serialization by default, or the explicitly authorized SD-JWT VC serialization, holder-bound batch issuance envelope, or self-identifying unsigned envelope

Compact SD-JWT VC: the issuer-signed JWT, then the root-value and configured structured-field disclosures, then a trailing tilde marking an absent key-binding JWT. The issuer never appends a key-binding JWT.

string
/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(~[A-Za-z0-9_-]+)*~$/

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Vary
string
Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

X-Request-Id
string
/^[0-9A-HJKMNP-TV-Z]{26}$/

Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.

400

Section titled “400”

Malformed request or invalid selector

Media typeapplication/problem+json
One of:
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: malformed_request
operation
required
string
/^[0-9A-HJKMNP-TV-Z]{26}$/
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Request is not valid
type
required
string
Allowed values: https://registrystack.org/problems/evidence/malformed_request
code
required
string
Allowed values: malformed_request
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Request is not valid
type
required
string
Allowed values: https://registrystack.org/problems/evidence/malformed_request
Example
{
  "code": "malformed_request",
  "status": 400,
  "title": "Request is not valid",
  "type": "https://registrystack.org/problems/evidence/malformed_request"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Vary
string
Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

X-Request-Id
string
/^[0-9A-HJKMNP-TV-Z]{26}$/

Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.

401

Section titled “401”

Authentication failed

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: malformed_request
operation
required
string
/^[0-9A-HJKMNP-TV-Z]{26}$/
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Request is not valid
type
required
string
Allowed values: https://registrystack.org/problems/evidence/malformed_request
code
required
string
Allowed values: authentication_failed
status
required
integer
Allowed values: 401
title
required
string
Allowed values: Authentication failed
type
required
string
Allowed values: https://registrystack.org/problems/evidence/authentication_failed
Example
{
  "code": "authentication_failed",
  "status": 401,
  "title": "Authentication failed",
  "type": "https://registrystack.org/problems/evidence/authentication_failed"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Vary
string
Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

WWW-Authenticate
string
Allowed values: Bearer
X-Request-Id
string
/^[0-9A-HJKMNP-TV-Z]{26}$/

Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.

403

Section titled “403”

Request is not authorized, including a recognized response format the bundle or matched grant does not permit

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: malformed_request
operation
required
string
/^[0-9A-HJKMNP-TV-Z]{26}$/
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Request is not valid
type
required
string
Allowed values: https://registrystack.org/problems/evidence/malformed_request
code
required
string
Allowed values: not_authorized
status
required
integer
Allowed values: 403
title
required
string
Allowed values: Request is not authorized
type
required
string
Allowed values: https://registrystack.org/problems/evidence/not_authorized
Example
{
  "code": "not_authorized",
  "status": 403,
  "title": "Request is not authorized",
  "type": "https://registrystack.org/problems/evidence/not_authorized"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Vary
string
Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

X-Request-Id
string
/^[0-9A-HJKMNP-TV-Z]{26}$/

Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.

406

Section titled “406”

Media negotiation is outside the closed Accept matrix

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: malformed_request
operation
required
string
/^[0-9A-HJKMNP-TV-Z]{26}$/
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Request is not valid
type
required
string
Allowed values: https://registrystack.org/problems/evidence/malformed_request
code
required
string
Allowed values: response_format_not_acceptable
status
required
integer
Allowed values: 406
title
required
string
Allowed values: Requested response format is not acceptable
type
required
string
Allowed values: https://registrystack.org/problems/evidence/response_format_not_acceptable
Example
{
  "code": "response_format_not_acceptable",
  "status": 406,
  "title": "Requested response format is not acceptable",
  "type": "https://registrystack.org/problems/evidence/response_format_not_acceptable"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Vary
string
Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

X-Request-Id
string
/^[0-9A-HJKMNP-TV-Z]{26}$/

Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.

422

Section titled “422”

Evidence could not be produced

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: malformed_request
operation
required
string
/^[0-9A-HJKMNP-TV-Z]{26}$/
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Request is not valid
type
required
string
Allowed values: https://registrystack.org/problems/evidence/malformed_request
code
required
string
Allowed values: evidence_not_available
status
required
integer
Allowed values: 422
title
required
string
Allowed values: Evidence could not be produced
type
required
string
Allowed values: https://registrystack.org/problems/evidence/evidence_not_available
Example
{
  "code": "evidence_not_available",
  "status": 422,
  "title": "Evidence could not be produced",
  "type": "https://registrystack.org/problems/evidence/evidence_not_available"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Vary
string
Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

X-Request-Id
string
/^[0-9A-HJKMNP-TV-Z]{26}$/

Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.

429

Section titled “429”

Request rate exceeded

Media typeapplication/problem+json
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: malformed_request
operation
required
string
/^[0-9A-HJKMNP-TV-Z]{26}$/
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Request is not valid
type
required
string
Allowed values: https://registrystack.org/problems/evidence/malformed_request
code
required
string
Allowed values: rate_limited
status
required
integer
Allowed values: 429
title
required
string
Allowed values: Request rate exceeded
type
required
string
Allowed values: https://registrystack.org/problems/evidence/rate_limited
Example
{
  "code": "rate_limited",
  "status": 429,
  "title": "Request rate exceeded",
  "type": "https://registrystack.org/problems/evidence/rate_limited"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Retry-After
string
Allowed values: 1
Vary
string
Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

X-Request-Id
string
/^[0-9A-HJKMNP-TV-Z]{26}$/

Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.

503

Section titled “503”

Dependency or service temporarily unavailable

Media typeapplication/problem+json
One of:
object
One of:
Evidence public problem Version 1
object
code
required
string
Allowed values: malformed_request
operation
required
string
/^[0-9A-HJKMNP-TV-Z]{26}$/
status
required
integer
Allowed values: 400
title
required
string
Allowed values: Request is not valid
type
required
string
Allowed values: https://registrystack.org/problems/evidence/malformed_request
code
required
string
Allowed values: dependency_unavailable
status
required
integer
Allowed values: 503
title
required
string
Allowed values: Service temporarily unavailable
type
required
string
Allowed values: https://registrystack.org/problems/evidence/dependency_unavailable
Example
{
  "code": "dependency_unavailable",
  "status": 503,
  "title": "Service temporarily unavailable",
  "type": "https://registrystack.org/problems/evidence/dependency_unavailable"
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Evidence responses are never cacheable.

Vary
string
Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

X-Request-Id
string
/^[0-9A-HJKMNP-TV-Z]{26}$/

Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.