Skip to content
Registry StackDocsDocumentation preview
Search

Resolve attribute release

POST
/v1/attribute-releases/{profile_id}/versions/{version}/resolve
curl --request POST \
  --url https://data.example.test/v1/attribute-releases/example/versions/example/resolve \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Data-Purpose: identity_verification' \
  --data '{ "claims": [ "example" ], "subject": { "id_type": "example", "value": "example" } }'

Resolves a single subject against a named release profile and returns the approved claim bundle. The subject identifier is sent in the request body so it does not appear in access logs.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
profile_id
required
string

Attribute release profile identifier.

version
required
string

Attribute release profile version.

Header Parameters

Section titled “Header Parameters”
Data-Purpose
required
string
>= 1 characters <= 256 characters

Purpose of use. The value must exactly match the selected attribute-release profile’s purpose and is checked before any source read. A missing value returns 400 auth.purpose_required; a mismatched value returns 403 auth.purpose_denied. Header names are case-insensitive (Data-Purpose and data-purpose are equivalent).

Example
identity_verification
x-registry-trust-legal-basis
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:legal_basis:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-trust-consent
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:consent:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-trust-assurance
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:assurance:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-trust-jurisdiction
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:jurisdiction:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-subject-ref
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:subject_ref:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-relationship
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:relationship:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-on-behalf-of
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:on_behalf_of:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-credential-format
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:requested_credential_format:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-source-observed-at-unix-seconds
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:source_observed_at_unix_seconds:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

x-registry-source-observed-age-seconds
string
>= 1 characters

Optional PDP trust context. Relay passes this value to policy evaluation only when the authenticated principal has the exact value-bound registry:trust:source_observed_age_seconds:<value> scope. Without that scope, Relay treats the header as absent. Header names are case-insensitive.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

Request body for resolving an attribute release profile against one subject.

object
claims

Optional subset of claim names to return. Absent means the profile default set; an empty array is rejected (400); duplicate or over-bound arrays are rejected (400); any explicit subset must include every required claim; any unknown claim name is denied.

Array<string> | null
>= 1 items <= 32 items unique items
subject
required

The subject to look up.

object
id_type
required

Subject identifier type (e.g. national_id, passport).

string
value
required

Non-blank scalar subject identifier value. String, number, and boolean values are matched without coercion. Never logged or echoed in responses.

string | number | boolean
Examplegenerated
{
  "claims": [
    "example"
  ],
  "subject": {
    "id_type": "example",
    "value": "example"
  }
}

Responses

Section titled “Responses”

200

Section titled “200”

Resolved attribute release claim bundle.

Media typeapplication/json

Resolved attribute release claim bundle. Contains only the approved, minimised claims for the matched subject. Never includes raw source rows, subject identifiers outside released claims, or private source internals.

object
claims
required

Released claim bundle. Keys are claim names; values are the projected or computed claim values.

object
key
additional properties
any
profile_id
required

Identifier of the release profile used to resolve this response.

string
profile_version
required

Version of the release profile used to resolve this response.

string
source

Profile-sourced metadata about the release. Present only when the profile sets response.include_source_metadata: true; a minimising profile omits it entirely. Contains only metadata derived from the profile configuration — never private source table ids, paths, or secrets.

object
cardinality
required

Stable attribute release always requires exactly one subject.

string
Allowed values: one
checked_at
required

ISO 8601 timestamp at which the source was checked.

string format: date-time
dataset
required

Dataset identifier for the backing source.

string
entity
required

Entity name for the backing source.

string
subject_id_type
required

Subject identifier type used in the lookup.

string
Example
{
  "source": {
    "cardinality": "one"
  }
}

400

Section titled “400”

Invalid request: missing Data-Purpose header, malformed or schema-invalid body, unknown id_type, or invalid claims list.

Media typeapplication/problem+json

RFC 9457 Problem Details, returned for every non-2xx response.

object
code
required
string
detail
required
string
request_id
required
string
status
required
integer format: int32
title
required
string
type
required
string format: uri
key
additional properties
any
Example
{
  "code": "auth.missing_credential",
  "detail": "no credential provided in Authorization or x-api-key header",
  "request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "status": 401,
  "title": "Missing credential",
  "type": "https://id.registrystack.org/problems/registry-relay/auth/missing_credential"
}

401

Section titled “401”

Missing or invalid bearer credential.

Media typeapplication/problem+json

RFC 9457 Problem Details, returned for every non-2xx response.

object
code
required
string
detail
required
string
request_id
required
string
status
required
integer format: int32
title
required
string
type
required
string format: uri
key
additional properties
any
Example
{
  "code": "auth.missing_credential",
  "detail": "no credential provided in Authorization or x-api-key header",
  "request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "status": 401,
  "title": "Missing credential",
  "type": "https://id.registrystack.org/problems/registry-relay/auth/missing_credential"
}

403

Section titled “403”

Purpose denied, or subject denied because it was not found, was ambiguous, failed the release condition, or lacked a required claim. The response does not distinguish subject-denial cases.

Media typeapplication/problem+json

RFC 9457 Problem Details, returned for every non-2xx response.

object
code
required
string
detail
required
string
request_id
required
string
status
required
integer format: int32
title
required
string
type
required
string format: uri
key
additional properties
any
Example
{
  "code": "auth.missing_credential",
  "detail": "no credential provided in Authorization or x-api-key header",
  "request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "status": 401,
  "title": "Missing credential",
  "type": "https://id.registrystack.org/problems/registry-relay/auth/missing_credential"
}

404

Section titled “404”

Profile not found or not visible to the authenticated principal. Does not confirm whether the profile ever existed.

Media typeapplication/problem+json

RFC 9457 Problem Details, returned for every non-2xx response.

object
code
required
string
detail
required
string
request_id
required
string
status
required
integer format: int32
title
required
string
type
required
string format: uri
key
additional properties
any
Example
{
  "code": "auth.missing_credential",
  "detail": "no credential provided in Authorization or x-api-key header",
  "request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "status": 401,
  "title": "Missing credential",
  "type": "https://id.registrystack.org/problems/registry-relay/auth/missing_credential"
}

415

Section titled “415”

Unsupported media type: request body must be application/json.

Media typeapplication/problem+json

RFC 9457 Problem Details, returned for every non-2xx response.

object
code
required
string
detail
required
string
request_id
required
string
status
required
integer format: int32
title
required
string
type
required
string format: uri
key
additional properties
any
Example
{
  "code": "auth.missing_credential",
  "detail": "no credential provided in Authorization or x-api-key header",
  "request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "status": 401,
  "title": "Missing credential",
  "type": "https://id.registrystack.org/problems/registry-relay/auth/missing_credential"
}

503

Section titled “503”

Source unavailable.

Media typeapplication/problem+json

RFC 9457 Problem Details, returned for every non-2xx response.

object
code
required
string
detail
required
string
request_id
required
string
status
required
integer format: int32
title
required
string
type
required
string format: uri
key
additional properties
any
Example
{
  "code": "auth.missing_credential",
  "detail": "no credential provided in Authorization or x-api-key header",
  "request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "status": 401,
  "title": "Missing credential",
  "type": "https://id.registrystack.org/problems/registry-relay/auth/missing_credential"
}

default

Section titled “default”

Problem Details error response.

Media typeapplication/problem+json

RFC 9457 Problem Details, returned for every non-2xx response.

object
code
required
string
detail
required
string
request_id
required
string
status
required
integer format: int32
title
required
string
type
required
string format: uri
key
additional properties
any
Example
{
  "code": "auth.missing_credential",
  "detail": "no credential provided in Authorization or x-api-key header",
  "request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "status": 401,
  "title": "Missing credential",
  "type": "https://id.registrystack.org/problems/registry-relay/auth/missing_credential"
}