Produce evidence for one authorized fixed requirement

POST

/v1/evidence

const url = 'https://example.com/v1/evidence';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"holderKeys":[{"alg":"ES256","crv":"P-256","kid":"example","kty":"EC","x":"example","y":"example"}],"purpose":"example","requestNonce":"example","requirement":"https://example.com","subjects":[{"role":"example","selector":{"profile":"example","values":{"additionalProperty":"example"}}}]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example.com/v1/evidence \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "holderKeys": [ { "alg": "ES256", "crv": "P-256", "kid": "example", "kty": "EC", "x": "example", "y": "example" } ], "purpose": "example", "requestNonce": "example", "requirement": "https://example.com", "subjects": [ { "role": "example", "selector": { "profile": "example", "values": { "additionalProperty": "example" } } } ] }'

Missing Accept, /, and the exact application/jose+json media type select the default signed flattened JWS. Only the exact application/vnd.registrystack.evidence-unsigned+json media type selects the unsigned envelope, only the exact application/dc+sd-jwt media type selects the SD-JWT VC serialization of the same assertion, and only the exact application/vnd.registrystack.evidence.batch+json media type selects the holder-bound batch issuance envelope carrying one credential per presented holder key; each is released only when the immutable bundle, the complete matched authority grant, and the requirement’s subject binding mode all permit it. Duplicate, combined, parameterized, weighted, or unknown negotiation returns 406 before source access.

Authorizations

bearerAuth

Request Body^required

application/json

Evidence request Version 1

object

holderKeys

Array<object>

>= 1 items <= 16 items

object

alg

string

Allowed values: ES256

crv

required

string

Allowed values: P-256

kid

string

>= 1 characters <= 256 characters

kty

required

string

Allowed values: EC

required

string

/^[A-Za-z0-9_-]{43}$/

required

string

/^[A-Za-z0-9_-]{43}$/

purpose

required

string

/^[a-z][a-z0-9._:-]{0,127}$/

requestNonce

required

string

/^[A-Za-z0-9_-]{43}$/

requirement

required

string format: uri

>= 1 characters <= 512 characters

subjects

required

Array<object>

>= 1 items <= 8 items

object

role

required

string

/^[a-z][a-z0-9._-]{0,63}$/

selector

required

object

profile

required

string

/^[a-z][a-z0-9._-]{0,127}$/

values

object

>= 1 properties <= 16 properties

key

additional properties

One of:

string

>= 1 characters <= 512 characters

Responses

200

Signed Evidence as flattened JWS JSON Serialization by default, or the explicitly authorized SD-JWT VC serialization, holder-bound batch issuance envelope, or self-identifying unsigned envelope

Compact SD-JWT VC: the issuer-signed JWT, then the root-value and configured structured-field disclosures, then a trailing tilde marking an absent key-binding JWT. The issuer never appends a key-binding JWT.

string

/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(~[A-Za-z0-9_-]+)*~$/

Evidence flattened JWS response Version 1

object

payload

required

string

>= 1 characters /^[A-Za-z0-9_-]+$/

protected

required

string

>= 1 characters /^[A-Za-z0-9_-]+$/

signature

required

string

/^[A-Za-z0-9_-]{86}$/

Example^generated

{
  "payload": "example",
  "protected": "example",
  "signature": "example"
}

Evidence unsigned response envelope Version 1

object

evidence

required

Evidence assertion payload Version 1

object

assuranceProfile

required

string

Allowed values: local production evidence-grade

audience

string format: uri

<= 512 characters

configurationRevision

required

string

/^sha256:[a-f0-9]{64}$/

required

string format: uri

<= 512 characters

isConformantTo

required

string format: uri

<= 512 characters

issuedAt

required

string format: date-time

issuedBy

required

string format: uri

<= 512 characters

observedAt

required

string format: date-time

providedBy

required

string format: uri

<= 512 characters

purpose

required

string

/^[a-z][a-z0-9._:-]{0,127}$/

requestNonce

string

/^[A-Za-z0-9_-]{43}$/

schema

required

string

Allowed values: registry.assertion-evidence/v1

subjectBinding

required

string

Allowed values: audience-scoped holder-bound

subjects

required

Array<object>

>= 1 items <= 8 items

object

binding

required

string

/^urn:evidence:subject:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$/

role

required

string

/^[a-z][a-z0-9._-]{0,63}$/

supportedValues

required

Array<object>

>= 1 items <= 16 items

object

providesValueFor

required

string format: uri

<= 512 characters

value

required

Any of:

boolean

supportsRequirement

required

string format: uri

<= 512 characters

type

required

string

Allowed values: Evidence

validUntil

required

string format: date-time

integrityProtection

required

string

Allowed values: none

schema

required

string

Allowed values: registry.unsigned-evidence-envelope/v1

type

required

string

Allowed values: UnsignedEvidenceEnvelope

warning

required

string

Allowed values: not-cryptographically-verifiable

Example

{
  "evidence": {
    "assuranceProfile": "local",
    "schema": "registry.assertion-evidence/v1",
    "subjectBinding": "audience-scoped",
    "supportedValues": [
      {
        "value": {
          "form": "date-bucket"
        }
      }
    ],
    "type": "Evidence"
  },
  "integrityProtection": "none",
  "schema": "registry.unsigned-evidence-envelope/v1",
  "type": "UnsignedEvidenceEnvelope",
  "warning": "not-cryptographically-verifiable"
}

Evidence SD-JWT VC batch issuance envelope Version 1

object

credentials

required

Array<string>

>= 1 items <= 16 items

schema

required

string

Allowed values: registry.sd-jwt-vc-batch-envelope/v1

type

required

string

Allowed values: SdJwtVcBatchEnvelope

Example

{
  "schema": "registry.sd-jwt-vc-batch-envelope/v1",
  "type": "SdJwtVcBatchEnvelope"
}

Headers

Cache-Control

string

Allowed values: no-store

Evidence responses are never cacheable.

Vary

string

Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

traceparent

string

/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

400

Malformed request or invalid selector

application/problem+json

One of:

object
object

object

One of:

Evidence public problem Version 1

object

code

required

string

Allowed values: evidence.invalid_request

detail

required

string

Allowed values: the Evidence request is invalid

status

required

integer

Allowed values: 400

title

required

string

Allowed values: Evidence request is invalid

traceId

required

string

/^(?!0{32}$)[0-9a-f]{32}$/

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request

code

required

string

Allowed values: evidence.invalid_request

detail

required

string

Allowed values: the Evidence request is invalid

status

required

integer

Allowed values: 400

title

required

string

Allowed values: Evidence request is invalid

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request

Example

{
  "code": "evidence.invalid_request",
  "detail": "the Evidence request is invalid",
  "status": 400,
  "title": "Evidence request is invalid",
  "type": "https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request"
}

Headers

Cache-Control

string

Allowed values: no-store

Evidence responses are never cacheable.

Vary

string

Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

traceparent

string

/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

401

Authentication failed

application/problem+json

object

One of:

Evidence public problem Version 1

object

code

required

string

Allowed values: evidence.invalid_request

detail

required

string

Allowed values: the Evidence request is invalid

status

required

integer

Allowed values: 400

title

required

string

Allowed values: Evidence request is invalid

traceId

required

string

/^(?!0{32}$)[0-9a-f]{32}$/

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request

code

required

string

Allowed values: auth.invalid_credential

detail

required

string

Allowed values: bearer access token validation failed

status

required

integer

Allowed values: 401

title

required

string

Allowed values: Bearer access token is invalid

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/auth/invalid_credential

Example

{
  "code": "auth.invalid_credential",
  "detail": "bearer access token validation failed",
  "status": 401,
  "title": "Bearer access token is invalid",
  "type": "https://id.registrystack.org/problems/registry-evidence/auth/invalid_credential"
}

Headers

Cache-Control

string

Allowed values: no-store

Evidence responses are never cacheable.

Vary

string

Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

WWW-Authenticate

string

Allowed values: Bearer realm="registry-evidence"

traceparent

string

/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

403

Request is not authorized, including a recognized response format the bundle or matched grant does not permit

application/problem+json

object

One of:

Evidence public problem Version 1

object

code

required

string

Allowed values: evidence.invalid_request

detail

required

string

Allowed values: the Evidence request is invalid

status

required

integer

Allowed values: 400

title

required

string

Allowed values: Evidence request is invalid

traceId

required

string

/^(?!0{32}$)[0-9a-f]{32}$/

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request

code

required

string

Allowed values: evidence.denied

detail

required

string

Allowed values: the Evidence request is not permitted

status

required

integer

Allowed values: 403

title

required

string

Allowed values: Evidence request is not permitted

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/denied

Example

{
  "code": "evidence.denied",
  "detail": "the Evidence request is not permitted",
  "status": 403,
  "title": "Evidence request is not permitted",
  "type": "https://id.registrystack.org/problems/registry-evidence/evidence/denied"
}

Headers

Cache-Control

string

Allowed values: no-store

Evidence responses are never cacheable.

Vary

string

Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

traceparent

string

/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

406

Media negotiation is outside the closed Accept matrix

application/problem+json

object

One of:

Evidence public problem Version 1

object

code

required

string

Allowed values: evidence.invalid_request

detail

required

string

Allowed values: the Evidence request is invalid

status

required

integer

Allowed values: 400

title

required

string

Allowed values: Evidence request is invalid

traceId

required

string

/^(?!0{32}$)[0-9a-f]{32}$/

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request

code

required

string

Allowed values: format.unsupported

detail

required

string

Allowed values: the requested format is not supported

status

required

integer

Allowed values: 406

title

required

string

Allowed values: Requested format is not supported

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/format/unsupported

Example

{
  "code": "format.unsupported",
  "detail": "the requested format is not supported",
  "status": 406,
  "title": "Requested format is not supported",
  "type": "https://id.registrystack.org/problems/registry-evidence/format/unsupported"
}

Headers

Cache-Control

string

Allowed values: no-store

Evidence responses are never cacheable.

Vary

string

Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

traceparent

string

/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

422

Evidence could not be produced

application/problem+json

object

One of:

Evidence public problem Version 1

object

code

required

string

Allowed values: evidence.invalid_request

detail

required

string

Allowed values: the Evidence request is invalid

status

required

integer

Allowed values: 400

title

required

string

Allowed values: Evidence request is invalid

traceId

required

string

/^(?!0{32}$)[0-9a-f]{32}$/

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request

code

required

string

Allowed values: evidence.unavailable

detail

required

string

Allowed values: evidence could not be produced for this request

status

required

integer

Allowed values: 422

title

required

string

Allowed values: Evidence could not be produced

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/unavailable

Example

{
  "code": "evidence.unavailable",
  "detail": "evidence could not be produced for this request",
  "status": 422,
  "title": "Evidence could not be produced",
  "type": "https://id.registrystack.org/problems/registry-evidence/evidence/unavailable"
}

Headers

Cache-Control

string

Allowed values: no-store

Evidence responses are never cacheable.

Vary

string

Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

traceparent

string

/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

429

Request rate exceeded

application/problem+json

object

One of:

Evidence public problem Version 1

object

code

required

string

Allowed values: evidence.invalid_request

detail

required

string

Allowed values: the Evidence request is invalid

status

required

integer

Allowed values: 400

title

required

string

Allowed values: Evidence request is invalid

traceId

required

string

/^(?!0{32}$)[0-9a-f]{32}$/

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request

code

required

string

Allowed values: evidence.rate_limited

detail

required

string

Allowed values: the Evidence request rate is exhausted

status

required

integer

Allowed values: 429

title

required

string

Allowed values: Evidence request rate is exhausted

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/rate_limited

Example

{
  "code": "evidence.rate_limited",
  "detail": "the Evidence request rate is exhausted",
  "status": 429,
  "title": "Evidence request rate is exhausted",
  "type": "https://id.registrystack.org/problems/registry-evidence/evidence/rate_limited"
}

Headers

Cache-Control

string

Allowed values: no-store

Evidence responses are never cacheable.

Retry-After

string

Allowed values: 1

Vary

string

Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

traceparent

string

/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

503

Dependency or service temporarily unavailable

application/problem+json

One of:

object
object

object

One of:

Evidence public problem Version 1

object

code

required

string

Allowed values: evidence.invalid_request

detail

required

string

Allowed values: the Evidence request is invalid

status

required

integer

Allowed values: 400

title

required

string

Allowed values: Evidence request is invalid

traceId

required

string

/^(?!0{32}$)[0-9a-f]{32}$/

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/evidence/invalid_request

code

required

string

Allowed values: source.unavailable

detail

required

string

Allowed values: the authoritative source is unavailable

status

required

integer

Allowed values: 503

title

required

string

Allowed values: Authoritative source is unavailable

type

required

string

Allowed values: https://id.registrystack.org/problems/registry-evidence/source/unavailable

Example

{
  "code": "source.unavailable",
  "detail": "the authoritative source is unavailable",
  "status": 503,
  "title": "Authoritative source is unavailable",
  "type": "https://id.registrystack.org/problems/registry-evidence/source/unavailable"
}

Headers

Cache-Control

string

Allowed values: no-store

Evidence responses are never cacheable.

Vary

string

Allowed values: Accept

The response format is negotiated through the exact Accept matrix.

traceparent

string

/^00-(?!0{32}-)[0-9a-f]{32}-(?!0{16}-)[0-9a-f]{16}-[0-9a-f]{2}$/

Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.

Produce evidence for one authorized fixed requirement

Authorizations

Request Bodyrequired

Responses

200

Examplegenerated

Example

Example

Headers

400

Example

Headers

401

Example

Headers

403

Example

Headers

406

Example

Headers

422

Example

Headers

429

Example

Headers

503

Example

Headers

Request Body^required

Example^generated