Multi-Device Sync API
API for secure multi-device key synchronization using QR pairing, Shamir recovery, and enterprise escrow. All endpoints require a Bearer token (SEC-001).
Generated from the MultiDeviceSync service's code at build time (api-specs/generated/MultiDeviceSync/Essence.Core.MultiDeviceSync.Api.json) and drift-checked in CI. It describes what the code registers, which is not the same as what any one deployment has routed.
ApproverDirectory
/api/v1/escrow/approversLists the live FR-01.080 quorum-membership set (FR-01.093(b)).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
tenantId | query | string (uuid) | no | — |
cursor | query | string (date-time) | no | — |
limit | query | integer (int32) | no | — |
Request body
No request body.
Responses
ApproverDirectoryListResponseProblemDetailsProblemDetails/api/v1/escrow/approversEnrols a new break-glass approver (FR-01.093(b), AC-01.084).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
EnrolApproverRequestasapplication/*+json,application/json,text/json
Responses
ApproverDirectoryEntryResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/approvers/{approverId}Deprovisions an approver (soft-delete) and re-evaluates any in-flight reconstruction quorum the approver was part of (FR-01.093(c), AC-01.134).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
approverId | path | string (uuid) | yes | — |
tenantId | query | string (uuid) | no | — |
reason | query | string | no | — |
Request body
No request body.
Responses
DeprovisionApproverResultProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/approvers/{approverId}/pinRotates an approver's credential pin after the underlying credential rotates (FR-01.093(c)).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
approverId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
RotateApproverPinRequestasapplication/*+json,application/json,text/json
Responses
ApproverDirectoryEntryResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsAssistedRecovery
/api/v1/recovery/assisted/authorisationsAuthorises a locked-out subject's account recovery (authorise-only). Returns only opaque references — never key material.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
IssueAssistedRecoveryAuthorizationRequestasapplication/*+json,application/json,text/json
Responses
AssistedRecoveryGrantResponseProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/assisted/authorisations/{recoveryTokenRef}/confirmationIndependently confirms that the authorisation identified by recoveryTokenRef issued the CC-061 authorise-only grant and that no decrypt capability was released off the back of it (debt-2026-08-10-012).
The compliance read-back behind the zero-knowledge attestation. Where M:Essence.Core.MultiDeviceSync.Api.Controllers.AssistedRecoveryController.Authorise(Essence.Core.MultiDeviceSync.Contracts.Requests.IssueAssistedRecoveryAuthorizationRequest,System.Threading.CancellationToken) reports what the issuing call did, this re-derives the verdict from the sealed, tamper-evident audit entry — so a reviewer is checking evidence rather than trusting the requesting service's claim about itself. Gated to the same `EscrowAuditExport` compliance policy as the sibling audit read/verify endpoints (a break-glass compliance artifact, not a tenant-user surface), with the same per-enrolment org binding applied inside the handler: a caller whose org has no custody of the resolved enrolment gets 404, not 403, so the endpoint cannot be used to confirm that a reference exists.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
recoveryTokenRef | path | string | yes | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsBiometricMismatchRecovery
/api/v1/recovery/biometric-mismatch/fallback-codeEnrols / replaces the authenticated holder's fallback recovery code (FR-01.072).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
EnrolFallbackRecoveryCodeRequestasapplication/*+json,application/json,text/json
Responses
FallbackRecoveryEnrolmentResponseProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/biometric-mismatch/rebindSpends a verified assurance to re-bind the re-established device and returns the "what changed" delta (FR-01.072). Emits the FR-66.159 confirmation via the outbox.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RebindAfterBiometricMismatchRequestasapplication/*+json,application/json,text/json
Responses
BiometricMismatchRebindResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/biometric-mismatch/verifyVerifies a presented fallback recovery code and, on success, mints a short-lived re-bind assurance (FR-01.072). A wrong code or no enrolled verifier both return a generic 403.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
VerifyBiometricMismatchFallbackRequestasapplication/*+json,application/json,text/json
Responses
BiometricMismatchAssuranceResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsBreakGlassConsent
/api/v1/escrow/break-glass-consentsLists the caller's live break-glass escrow consents (FR-01.030).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
cursor | query | string (date-time) | no | — |
limit | query | integer (int32) | no | — |
Request body
No request body.
Responses
BreakGlassConsentListResponseProblemDetailsProblemDetails/api/v1/escrow/break-glass-consentsRecords a durable break-glass escrow consent for the caller (FR-01.030).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RecordBreakGlassConsentRequestasapplication/*+json,application/json,text/json
Responses
BreakGlassConsentResponseProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/break-glass-consents/exportExports the caller's break-glass escrow consents as a GDPR Article-15 record (FR-01.030).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
BreakGlassConsentExportResponseProblemDetailsProblemDetails/api/v1/escrow/break-glass-consents/grantedThe GRANTEE's read (#22511): the consents in force that name organizationId as the responder organisation. A requester picks the account holder here and opens the break-glass request by subject — it never has to be handed an internal enrolment id.
Every other action on this controller is the owner's. This one is not, so it carries the org-attribution edge gate the requester's `POST /escrow/reconstruct` carries, and the load-bearing binding is the caller's membership of the organisation it names (403 otherwise). #22847: includes the consents held on every peer sovereign this instance is configured to ask, each stamped with its `homeRegion`, and names the peers that could not be asked. localOnly is set by such a peer read so it never fans out again.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | query | string (uuid) | no | — |
cursor | query | string (date-time) | no | — |
limit | query | integer (int32) | no | — |
localOnly | query | boolean | no | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/break-glass-consents/{consentId}Withdraws one of the caller's break-glass escrow consents (FR-01.030).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
consentId | path | string (uuid) | yes | — |
reason | query | string | no | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/break-glass-consents/{consentId}/holder-labelSets, changes or clears the name the caller discloses to the grantee of one of their live consents (#22862), without withdrawing it. `null` or blank clears it. Another user's consent id is a 404.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
consentId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
SetBreakGlassConsentHolderLabelRequestasapplication/*+json,application/json,text/json
Responses
BreakGlassConsentResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/break-glass-consents/{consentId}/scopeReplaces the per-category escrow scope of one of the caller's consents (FR-01.030).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
consentId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
UpdateBreakGlassConsentScopeRequestasapplication/*+json,application/json,text/json
Responses
BreakGlassConsentResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsDeviceIntegrity
/api/v1/devices/{id}/integrityThis device's latest server-verified integrity verdict (FR-01.104). `observed: false` when it has never been attested — not the same as a failure.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID. |
Request body
No request body.
Responses
DeviceIntegrityResponseProblemDetails/api/v1/devices/{id}/integrity-assertionsRe-checks this device's integrity with an App Attest <b>assertion</b> signed by the key it already attested, and records the verdict against its previous one (FR-01.104, #22108).
This is the cheap re-check: Apple rate-limits `attestKey`, so only a device's FIRST check goes to `integrity-attestations` and every later one comes here. The device asks `POST {id}/challenges` for an `Integrity` nonce and calls `DCAppAttestService.generateAssertion(keyId, clientDataHash)` with `clientDataHash = SHA-256(UTF-8(nonce))`. A judged assertion returns 200 whether it passed or failed — including a <b>replay</b>, whose counter did not increase: that verifies cryptographically and so is a statement about the device (`assertion_counter_replayed`), not a request error. Refusals (400/401/403/404/409/503) record nothing.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID. |
Request body
Not marked as required in the document.
SubmitDeviceIntegrityAssertionRequestasapplication/*+json,application/json,text/json
Responses
DeviceIntegrityResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/integrity-attestationsVerifies a platform integrity attestation for this device and records the verdict against its previous one (FR-01.104, #17940). iOS <b>App Attest</b> or Android <b>Play Integrity</b> (#22105); either way it binds an `Integrity` challenge from `POST {id}/challenges`.
A judged attestation returns 200 whether it passed or failed — a failure is a recorded verdict, not a request error. Refusals (400/401/403/404/503) record nothing. The two platforms are configured independently, so one can be judgeable here while the other answers 503.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID. |
Request body
Not marked as required in the document.
SubmitDeviceIntegrityAttestationRequestasapplication/*+json,application/json,text/json
Responses
DeviceIntegrityResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsDeviceIntegrityStepUp
/api/v1/devices/{id}/integrity-step-upsThis device asks another of the account's devices to approve the key-custody request it was just refused. Carries the request's method, path and body DIGEST — never the body.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | This device's registration ID. |
Request body
Not marked as required in the document.
OpenDeviceIntegrityStepUpRequestasapplication/*+json,application/json,text/json
Responses
DeviceIntegrityStepUpResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/integrity-step-ups/pendingThe requests other devices of this account are waiting for THIS device to decide.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | This device's registration ID. |
Request body
No request body.
Responses
DeviceIntegrityStepUpListResponseProblemDetailsProblemDetails/api/v1/devices/{id}/integrity-step-ups/{requestId}This device reads back a request it opened. Once `approved`, `peerProof` is the value to retry with on `X-Device-Peer-Proof`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | This device's registration ID. |
requestId | path | string (uuid) | yes | The step-up request. |
Request body
No request body.
Responses
DeviceIntegrityStepUpResponseProblemDetailsProblemDetails/api/v1/devices/{id}/integrity-step-ups/{requestId}/approvalThis device approves another device's request with a peer proof signed by its own enrolled key, over a fresh `Proof` challenge from `POST {id}/challenges`, bound to the request's method, path and body digest. Checked here (all but spending the nonce) so a proof that would fail is refused now, on this device's screen.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | This (approving) device's registration ID. |
requestId | path | string (uuid) | yes | The step-up request. |
Request body
Not marked as required in the document.
ApproveDeviceIntegrityStepUpRequestasapplication/*+json,application/json,text/json
Responses
DeviceIntegrityStepUpResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/integrity-step-ups/{requestId}/declineThis device's holder declines another device's request.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | This (declining) device's registration ID. |
requestId | path | string (uuid) | yes | The step-up request. |
Request body
No request body.
Responses
DeviceIntegrityStepUpResponseProblemDetailsProblemDetailsProblemDetailsDeviceKeyRotation
/api/v1/devices/{id}/key-exchange-key/rotationReplaces this device's key-exchange public key with one it has just generated, and returns the instant the rotation completed.
Only the PUBLIC half of the new key is sent. The request must carry an X-Device-Proof verified against THIS registration's enrolled signing key, whatever the possession rollout mode: the key-exchange key is what the next master-key rotation is wrapped to, so a bearer token alone must not be able to move it.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | This device's registration ID. |
Request body
Not marked as required in the document.
RotateDeviceKeyExchangeKeyRequestasapplication/*+json,application/json,text/json
Responses
DeviceKeyExchangeKeyRotationResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsDevices
/api/v1/devicesLists all active devices for the current user with keyset pagination (DAT-006).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
cursor | query | string | no | Optional cursor for pagination. |
limit | query | integer (int32) | no | Page size (default 10, max 50). |
Request body
No request body.
Responses
DeviceRegistrationResponseCursorResultProblemDetailsProblemDetails/api/v1/devicesRegisters this device for the authenticated user. Idempotent per device fingerprint.
A repeat registration of a fingerprint already active for the user is not an error and not a second device: it refreshes the existing registration and answers `200 OK` with it. Only a registration that actually admitted a new device answers `201 Created`, and only that branch can be refused by the FR-01.007 cap (#7271 — previously every call inserted a row, so a client registering on each load exhausted the cap and was then refused forever).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RegisterDeviceRequestasapplication/*+json,application/json,text/json
Responses
DeviceRegistrationResponseDeviceRegistrationResponseProblemDetailsProblemDetailsProblemDetails/api/v1/devices/wipe-attestations/{attestationId}Reads / exports a resale wipe attestation certificate (FR-01.060-distinct, debt-2026-07-07-033, journey `device-trade-in-secure-wipe-attestation-to-resale`). The holder retrieves the signed certificate — and its live/revoked state — to present to a resale counterparty. Ownership-scoped: a non-owner sees 404 (no existence oracle).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
attestationId | path | string (uuid) | yes | Wipe attestation ID. |
Request body
No request body.
Responses
WipeAttestationResponseProblemDetailsProblemDetails/api/v1/devices/wipe-attestations/{attestationId}/revokeRevokes a resale wipe attestation certificate (FR-01.060-distinct, debt-2026-07-07-033). Marks the certificate so a counterparty checking it sees it is no longer live — e.g. it was issued in error or the device was not actually wiped. Ownership-scoped (404 for a non-owner); a second revoke is rejected with 409.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
attestationId | path | string (uuid) | yes | Wipe attestation ID. |
Request body
Not marked as required in the document.
RevokeWipeAttestationRequestasapplication/*+json,application/json,text/json
Responses
WipeAttestationResponseProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}Gets a specific device registration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID |
Request body
No request body.
Responses
DeviceRegistrationResponseProblemDetailsProblemDetails/api/v1/devices/{id}Removes (unpairs) a device via the single authoritative FR-01.049 removal path.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID |
deferRotation | query | boolean | no | FR-01.049 deferred-rotation ("Lock out later") choice (debt-2026-06-18-331). When `false` (the secure default) the UMK is rotated immediately so the removed device loses access at once. When `true` the user has made the informed choice to defer rotation; the residual-access threat is recorded and audit-anchored (`DeviceRemovedEvent.RekeyAction == "deferred-warned"`) rather than rotating now. |
reason | query | string | no | Why the owner is removing the device (FR-01.049, #18043): `user-initiated`, `lost` or `stolen` (`DeviceRemovalReasons.OwnerDeclarable`). Omitted means an ordinary removal. Carried onto `DeviceRemovedEvent.Reason`, so a theft reported here is anchored the same way as one reported on Auth's `DELETE /api/v1/devices/{id}`. |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/challengesIssues a short-lived, single-use challenge for one of the caller's devices (SEC-009(a)).
`Proof` challenges are what an `X-Device-Proof` on a key-custody request signs; they are only issued to the device whose enrolled signing key is bound to this token. `Enrolment` challenges are what a device signs with the key it is enrolling.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID. |
Request body
Not marked as required in the document.
IssueDeviceChallengeRequestasapplication/*+json,application/json,text/json
Responses
DeviceChallengeResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/confirm-held"I still have this device" (#17684): clears the possibly-lost flag a recovery enrolment on another device put on this registration (#17572), so it can approve pairings again.
Must be sent from ANOTHER enrolled device of the account that is not itself flagged, with an X-Device-Proof verified against that device's enrolled key. The handler requires the verified proof whatever the rollout mode: a flagged device cannot clear its own flag.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The flagged device registration ID. |
Request body
No request body.
Responses
DeviceRegistrationResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/pending-rotationReturns the pending wrapped-UMK blob queued for this device by the rotation initiator (FR-01.016), or 204 when the queue is empty. Siblings poll this endpoint after a `KeyRotationCompletedIntegrationEvent` or on periodic sync.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID. |
Request body
No request body.
Responses
PendingKeyRotationResponseProblemDetailsProblemDetails/api/v1/devices/{id}/pending-rotation/ackAcknowledges that the sibling device has unwrapped the queued UMK locally and committed it to its own keystore (FR-01.016). Clears the pending-rotation queue on the device registration row.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID. |
Request body
Not marked as required in the document.
AcknowledgePendingKeyRotationRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/secure-wipeSecurely wipes a device in preparation for resale / trade-in (FR-01.060-distinct "Prepare for resale", debt-2026-06-18-315). Revokes the device's cryptographic access via the authoritative FR-01.049 removal path and returns a tamper-evident wipe attestation. Distinct from account deletion (FR-01.060): only this device loses access; the account and its other devices are untouched. The plain-language confirmation gate is enforced server-side — Essence.Core.MultiDeviceSync.Contracts.Requests.SecureWipeDeviceRequest.ConfirmationAcknowledged must be `true` or the request is rejected with 400.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID. |
Request body
Not marked as required in the document.
SecureWipeDeviceRequestasapplication/*+json,application/json,text/json
Responses
WipeAttestationResponseProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/signing-keyEnrols this device's ES256 signing key (SEC-009(a)) — the key every later key-custody request proves possession of. Needs an `Enrolment` challenge signed by the new key, and the server's authority rule: the account's sole device, a pairing approval by an enrolled peer (`pairingSessionId`), a completed recovery on this device (for a recovery-phrase recovery, the `recoveryEnrolmentTicket` its re-wrap returned, #18062), or a one-time legacy attach inside the grace window.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID. |
Request body
Not marked as required in the document.
EnrolDeviceSigningKeyRequestasapplication/*+json,application/json,text/json
Responses
DeviceRegistrationResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/devices/{id}/sync-statusGets the sync status for a specific device (FR-01.016).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Device registration ID |
Request body
No request body.
Responses
DeviceSyncStatusResponseProblemDetailsProblemDetailsEmergencyAccessAnchors
/api/v1/emergency-access-anchorsLists recorded break-glass anchors, newest first, keyset-paginated (DAT-006).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
originInstanceId | query | string (uuid) | no | Only anchors from this sovereign. |
from | query | string (date-time) | no | Only anchors that occurred at or after this instant (UTC). |
to | query | string (date-time) | no | Only anchors that occurred before this instant (UTC). |
sessionRef | query | string | no | Only the phases of this session (64-char lowercase-hex token). |
phase | query | string | no | `requested` | `granted` | `expired` | `revoked`. |
cursor | query | string | no | The previous page's `NextCursor`. |
limit | query | integer (int32) | no | Page size (default 50, max 200). |
Request body
No request body.
Responses
EmergencyAccessAnchorResponseCursorResultProblemDetailsEmergencyAccessRequest
/api/v1/escrow/emergency-access/historyReturns the authenticated owner's escrow break-glass release / disclosure history (journey `emergency-credential-access-grant-on-inactivity`, FR-01.040 anchor / FR-01.041 notify; debt-2026-07-07-028). One anchored record per terminal event — invoker, ordered approval chain, tamper-evident evidence hash + EPIC 4 anchor reference, categories released, timestamps, and terminal outcome. Backs the essence-web `EmergencyAccessHistory` surface. The subject is ALWAYS the authenticated caller (server-derived) — no client-supplied id participates in the authorisation decision.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/escrow/emergency-access/history/{subjectUserId}Compliance / DPO export of a subject's escrow break-glass release history (FR-01.043 / FR-01.040-041; debt-2026-07-07-028). Gated to the `EscrowAuditExport` policy (`compliance-officer` / `platform-admin`) — the same instance-wide compliance surface as the audit-chain export — so a regulator / DPO can pull the same disclosure the owner sees. Returns only non-secret disclosure metadata; no decrypted credential is ever surfaced.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
subjectUserId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/reconstructOpens a reconstruction request against a configured enrolment (CC-061, FR-01.035). The request is persisted in `requested` state and an outbox event is published for Tier E-3 pickup.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RequestEscrowReconstructionRequestasapplication/*+json,application/json,text/json
Responses
EscrowReconstructionRequestResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/mineThe caller's own break-glass requests for organizationId that can still be resumed (#22510): not reconstructed, not terminal, not past their deadline. A requester whose tab closed finds the request here; resuming it needs the ephemeral key their browser kept. Pinned to the token's subject. Metadata only.
#22852: includes the requests this instance routed to their subjects' home sovereigns, read back from each one (status `unknown` when it cannot be asked). localOnly is set by such a read-back so it never fans out again.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | query | string (uuid) | no | — |
localOnly | query | boolean | no | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/mine/closedThe caller's own break-glass requests for organizationId that have closed (#22590): reconstructed, denied, revoked, or past their deadline. The complement of M:Essence.Core.MultiDeviceSync.Api.Controllers.EmergencyAccessRequestController.ListMyOpenRequests(System.Guid,System.Boolean,System.Threading.CancellationToken), so a requester can find a request again to re-read its justification without keeping the reference. Pinned to the token's subject. Metadata only.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | query | string (uuid) | no | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/{id}Returns the lifecycle snapshot for a reconstruction request (CC-061, FR-01.030 / FR-01.037). Pinned to the requester so the React hook can poll without leaking lifecycle state to other parties.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/{id}/access-extensionThe requester asks for a live granted access window to be extended (FR-01.038(1), #22389). Grants no time: it opens an extension cycle and returns its fresh, single-use `accessExtensionChallengeNonce`, which the re-attestation quorum signs over via `POST /requests/{id}/access-extension/approve`. Refused with 409 when the window has elapsed or ended (FR-01.038(4): open a new request) or already stands at the 72 h cumulative maximum (FR-01.038(2)).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/{id}/access-extension/approveRecords one approver's Ed25519 re-attestation of an access-window extension (FR-01.038(1)-(3), #22389). The signed payload is `escrow-extend:{requestId:N}:{enrolmentId:N}:{approverUserId:N}:{cycle}:{approvedAt:O}:{accessExtensionChallengeNonce}` where `cycle` is `accessExtensionCount + 1`. The quorum-reaching re-attestation extends the window (cut to 72 h cumulative), seals an audit entry and notifies the account holder with `reason='extended'`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
ApproveEscrowReconstructionRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/{id}/approveRecords an Ed25519 approval against an in-flight reconstruction request (CC-061, FR-01.037). When quorum is reached the aggregate stamps the FR-01.033 cool-off `EarliestUnlockAt`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
localOnly | query | boolean | no | — |
Request body
Not marked as required in the document.
ApproveEscrowReconstructionRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/{id}/completeMarks a reconstruction request as completed once the requester has combined the relayed shares locally (CC-061, FR-01.030 / FR-01.037). The aggregate enforces the FR-01.033 cool-off window — the call is rejected with 409 if invoked before `EarliestUnlockAt`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/{id}/denyDenies an in-flight reconstruction request (CC-061, FR-01.037). Any authorised approver can burn the request; the aggregate transitions to `denied` and no further approvals or share submissions are accepted.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
localOnly | query | boolean | no | — |
Request body
Not marked as required in the document.
DenyEscrowReconstructionRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/{id}/justificationReturns the decrypted justification of a reconstruction request to its subject or its requester (FR-01.065 / FR-01.039, #22417), closed requests included. Anyone else, and an unknown id, get the same generic 404 and leave no trace on the audit chain; an authorised read appends a `JustificationRead` entry. A purged request answers `state: "purged"`; a seal that fails authentication is a typed 500.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/requests/{id}/reconstruction-materialReturns the enrolment material the requester's client needs to finish a reconstruction (CC-061, FR-01.037 / FR-01.039, #22335): the Shamir scheme, the holder roster, and the scoped vault keys wrapped under the EAK. Requester only; released under the same cool-off and access-window gate as the relay shares, and never once the session is terminal or zeroized.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsEmergencyAccessRevokeLink
/api/v1/escrow/emergency-access/revoke-by-linkEnd the emergency-access grant a receipt's "Revoke now" link names.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RevokeEmergencyAccessBySignedLinkRequestasapplication/*+json,application/json,text/json
Responses
RevokeEmergencyAccessBySignedLinkResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsEmergencyCardRead
/api/v1/emergency-card-readsRecords a wearable emergency-card read (FR-01.040/041). Anchors the read to EPIC 4 and queues the CRITICAL owner + nominated-contact notification in one unit of work; returns only when both committed.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RecordEmergencyCardReadRequestasapplication/*+json,application/json,text/json
Responses
EmergencyCardReadResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsEscrow
/api/v1/sync/escrow/audit/exportFR-01.043 — exports the tamper-evident escrow audit chain for regulator/SRE review. Gated to the `EscrowAuditExport` policy (compliance-officer or platform-admin roles). Runs the chain verifier before serialising: on a mismatch the endpoint returns 409 Conflict with the failure details in a ProblemDetails body — we DO NOT ship a payload that might encode tampered history without an explicit "chain broken" signal, since downstream consumers are likely to treat a 200 body as authoritative.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
enrolmentId | query | string (uuid) | no | Optional scope — omit for a full-chain export. |
format | query | string | no | "json" (default) or "csv". |
Request body
No request body.
Responses
string (binary)ProblemDetailsProblemDetails/api/v1/sync/escrow/enrolmentsCreates a new EAK enrolment with its custody shares.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
EnrolEakRequestasapplication/*+json,application/json,text/json
Responses
EakEnrolmentResponseProblemDetailsProblemDetails/api/v1/sync/escrow/enrolments/{id}Gets an EAK enrolment (without encrypted share payloads).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
EakEnrolmentResponseProblemDetailsEscrowEnrolment
/api/v1/escrow/auditReturns the tamper-evident escrow audit chain (CC-061, FR-01.038). Keyset-paged per DAT-006 — callers resume by passing the previous response's `NextCursor` back in the cursor query param. Optionally scoped to a single `enrolmentId`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
enrolmentId | query | string (uuid) | no | Optional enrolment scope. |
cursor | query | string | no | Opaque cursor from a previous page (null for first page). |
limit | query | integer (int32) | no | Page size (default 500, max 1000). Values <=0 fall back to the default. |
Request body
No request body.
Responses
EscrowAuditChainResponseProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/audit/verifyRe-verifies the stored audit chain hashes (CC-061, FR-01.038). Does not mutate state; returns the verification outcome regardless of validity so operators can diagnose the first failing entry.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
enrolmentId | query | string (uuid) | no | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/escrow/configurePersists the Tier E-1 `EscrowEnrolmentArtefacts` tuple produced by the client-side `enrolEmergencyAccessKey()` ceremony (CC-061, FR-01.031). Returns the masked enrolment summary.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ConfigureEscrowRequestasapplication/*+json,application/json,text/json
Responses
EscrowEnrolmentStatusResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/enrolments/{id}Returns a single enrolment by ID (masked). 404 when missing; the ownership check is enforced in the handler and flows through the exception pipeline as 403 when the caller is not the owner.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | — |
Request body
No request body.
Responses
EscrowEnrolmentStatusResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/enrolments/{id}/revokeRevokes an enrolment and cascades to any non-terminal reconstruction requests (CC-061, FR-01.040). The enrolment's soft-delete flag frees the partial unique index on `(user_id, is_deleted=false)` for re-enrolment.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | — |
Request body
Not marked as required in the document.
RevokeEscrowEnrolmentRequestasapplication/*+json,application/json,text/json
Responses
EscrowEnrolmentStatusResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/statusReturns the caller's Tier E-2 enrolments (masked — SR-5 — never returns ciphertexts). Supports keyset pagination (DAT-006) via the `cursor` query parameter: pass the `createdAt` of the last row from the previous page to continue.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
cursor | query | string (date-time) | no | — |
limit | query | integer (int32) | no | — |
Request body
No request body.
Responses
EscrowEnrolmentStatusResponse[]ProblemDetailsProblemDetailsExecutorCredentialBequest
/api/v1/keys/executor-bequestsA donor seals a bequest of credentials for their executor (debt-2026-07-07-007). Idempotent per (donor, executor, estate grant) — 409 if one already exists.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
SealExecutorBequestRequestasapplication/*+json,application/json,text/json
Responses
SealExecutorBequestResponseProblemDetailsProblemDetailsProblemDetails/api/v1/keys/executor-bequests/releaseReleases a sealed bequest when the scoped legacy-release grant fires (debt-2026-07-07-007). The `estateGrantId` must match the grant the bequest was sealed under. Idempotent.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ReleaseExecutorBequestRequestasapplication/*+json,application/json,text/json
Responses
ReleaseExecutorBequestResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/executor-bequests/{bequestId}The authenticated executor fetches a bequest's metadata (debt-2026-07-07-007) — status and per-item labels/statuses that back the reveal surface's list. No key material. A caller who is not the bequest's executor is answered 404 (no existence disclosure).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
bequestId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ExecutorBequestSummaryResponseProblemDetailsProblemDetailsProblemDetails/api/v1/keys/executor-bequests/{bequestId}A donor withdraws a bequest (debt-2026-07-07-007) — revoked while alive, or the estate closed. Cryptographically erases every sealed envelope. Only the donor may revoke.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
bequestId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/keys/executor-bequests/{bequestId}/items/{itemId}/revealThe authenticated executor reveals one bequeathed credential (debt-2026-07-07-007) — backs `onReveal`. Returns the sealed envelope for client-side reconstruction (never plaintext).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
bequestId | path | string (uuid) | yes | — |
itemId | path | string | yes | — |
Request body
No request body.
Responses
RevealedBequeathedCredentialResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/executor-bequests/{bequestId}/reveal-allThe authenticated executor reveals every currently-available bequeathed credential (debt-2026-07-07-007) — backs `onRevealAll`. Returns each item's sealed envelope for client-side reconstruction (never plaintext).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
bequestId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
RevealAllBequeathedCredentialsResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsExecutorRehearsal
/api/v1/sync/escrow/executor-rehearsalConducts a non-destructive executor-release rehearsal. Returns the readiness report + audit anchor reference — never key material.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ConductExecutorRehearsalRequestasapplication/*+json,application/json,text/json
Responses
ExecutorRehearsalResponseProblemDetailsProblemDetailsProblemDetailsInternalAssistedRecoveryConfirmation
/api/v1/internal/recovery/assisted/confirmation/lookupEPIC 1's evidenced confirmation of one authorisation, for the organisation named.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
AssistedRecoveryGrantConfirmationLookupRequestasapplication/*+json,application/json,text/json
Responses
AssistedRecoveryGrantConfirmationResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsInternalDeviceIntegrityDecision
/api/v1/internal/device-integrity/key-custody-decisionsDecides one custody request served on another instance, for the device the caller's token names. 200 with `evaluated:false` when the token names no enrolled device, when integrity was skipped, or when a refused possession ended the decision; with `possession` when it was asked for.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
KeyCustodyIntegrityDecisionRequestasapplication/*+json,application/json,text/json
Responses
KeyCustodyIntegrityDecisionResponseProblemDetailsProblemDetailsProblemDetailsInternalDeviceSigningKey
/api/v1/internal/device-signing-keys/lookupThe public JWK of the active, enrolled device key `keyThumbprint` of `userId`. 200 in both cases: `{"found": true, …}`, or the uniform `{"found": false}`.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
DeviceSigningKeyLookupRequestasapplication/*+json,application/json,text/json
Responses
DeviceSigningKeyLookupResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsKeyGeneration
/api/v1/keys/wrapped-umk/generationThe caller's current key generation.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
CurrentKeyGenerationResponseProblemDetailsKeyRotation
/api/v1/rotation/sessionsInitiates a new key rotation session.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
InitiateKeyRotationRequestasapplication/*+json,application/json,text/json
Responses
KeyRotationSessionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/rotation/sessions/{id}Gets the status of a key rotation session.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Key rotation session ID |
Request body
No request body.
Responses
KeyRotationSessionResponseProblemDetailsProblemDetails/api/v1/rotation/sessions/{id}/checkpointSaves a checkpoint during key rotation for resume capability.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Key rotation session ID |
Request body
Not marked as required in the document.
CheckpointRotationRequestasapplication/*+json,application/json,text/json
Responses
KeyRotationSessionResponseProblemDetailsProblemDetailsProblemDetails/api/v1/rotation/sessions/{id}/completeCompletes a key rotation session, persisting the new key generation (#19068).
The body's `newGenerationEnvelope` is the new UMK wrapped under the account's password KEK. It is held even when the answer is the retryable `coverage-incomplete`, and completion makes it the current envelope while revoking every passkey, recovery-phrase and duress envelope of the outgoing generation. Without one ever sent the rotation cannot complete. With no body the call only observes the session. `passkeyRewraps` (#19144) carries the new UMK re-wrapped under each passkey the user keeps; those passkeys get a new-generation envelope instead of being revoked. Held with the envelope across `coverage-incomplete`. A credential with no live vault-unlock envelope refuses the call (409 `rotation-passkey-not-enrolled`) and nothing is staged.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Key rotation session ID |
Request body
Not marked as required in the document.
CompleteKeyRotationRequestasapplication/*+json,application/json,text/json
Responses
KeyRotationSessionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/rotation/sessions/{id}/notify-devicesNotifies all registered devices about a completed key rotation (FR-01.016). The initiating device calls this after completing rotation to push the new wrapped UMK to all sibling devices.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Key rotation session ID |
Request body
Not marked as required in the document.
NotifyDevicesRequestasapplication/*+json,application/json,text/json
Responses
NotifyDevicesResponseProblemDetailsProblemDetailsProblemDetailsKeyRotationCancellation
/api/v1/rotation/sessions/{id}/cancelCancels an open key rotation session at the user's request (FR-01.051).
The OLD key generation stays write-authoritative and the single-active-rotation slot (FR-01.050) is freed, so a rotation interrupted by a closed tab no longer blocks the next one until the abandonment reaper runs (#7278). Like the other continuation calls it does not re-ask for step-up: it acts on a session only an elevated `POST` can have opened, and it moves the vault toward the key already in force, never away from it.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Key rotation session ID |
Request body
No request body.
Responses
KeyRotationSessionResponseProblemDetailsProblemDetailsProblemDetailsMergeRewrap
/api/v1/keys/merge-rewrap/pendingThe re-wrap work the calling member's device should pick up on unlock. This read is what makes an adjudicated merge's key work schedulable rather than session-bound.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
take | query | integer (int32) | no | — |
Request body
No request body.
Responses
PendingMergeRewrapTasksResponseProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessionsOpens the re-wrap task for an approved merge. Idempotent per merge session — a retried approval is answered 409 rather than forking the work in two.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
OpenMergeRewrapTaskRequestasapplication/*+json,application/json,text/json
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessions/{mergeSessionId}Reads one task as a member of the merge (survivor sees the material it must unwrap).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
mergeSessionId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessions/{mergeSessionId}/cancelCancels the task — the merge was refused, withdrawn or abandoned.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
mergeSessionId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
CancelMergeRewrapRequestBodyasapplication/*+json,application/json,text/json
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessions/{mergeSessionId}/checkpointRecords a resume point and renews the lease.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
mergeSessionId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
CheckpointMergeRewrapRequestasapplication/*+json,application/json,text/json
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessions/{mergeSessionId}/claimTakes (or renews) the work lease for one of the survivor's devices. A lapsed lease is claimable by another device, so a member whose phone died is not locked out of their own merge by their own dead phone.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
mergeSessionId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
ClaimMergeRewrapRequestasapplication/*+json,application/json,text/json
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessions/{mergeSessionId}/completeThe leasing device reports the re-wrap finished. Refused while items remain — a partial re-wrap must not release the adjudication's key-rewrap hold.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
mergeSessionId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
CompleteMergeRewrapRequestasapplication/*+json,application/json,text/json
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessions/{mergeSessionId}/handoverParks the retiring account's UMK wrapped to the surviving member's public key, so the survivor's device can unwrap the retiring per-item DEKs days later. Posted by whichever of the two identities' devices holds the retiring key material.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
mergeSessionId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
PostMergeHandoverRequestasapplication/*+json,application/json,text/json
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessions/{mergeSessionId}/releaseThe leasing device gives the task back without completing. Progress and checkpoint are kept so the next device resumes rather than restarts.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
mergeSessionId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
ReleaseMergeRewrapRequestasapplication/*+json,application/json,text/json
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/merge-rewrap/sessions/{mergeSessionId}/statusThe adjudicating service's release gate: is the re-wrap done? Deliberately returns no key material — a staff surface can see that a merge is held without ever holding the envelope. This is the poll-side twin of the completion event, so the release gate never depends on a single message delivery.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
mergeSessionId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
MergeRewrapTaskResponseProblemDetailsProblemDetailsProblemDetailsPairingSessions
/api/v1/pairing/sessionsCreates a new pairing session (Device A).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreatePairingSessionRequestasapplication/*+json,application/json,text/json
Responses
PairingSessionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/pairing/sessions/{id}Gets a pairing session by ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Pairing session ID |
Request body
No request body.
Responses
PairingSessionResponseProblemDetailsProblemDetails/api/v1/pairing/sessions/{id}Cancels a pairing session. Only the session initiator can cancel.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Pairing session ID |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/pairing/sessions/{id}/confirmConfirms fingerprint verification during pairing (FR-01.006). Both devices call this after visually confirming the fingerprint match.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Pairing session ID |
Request body
Not marked as required in the document.
ConfirmPairingRequestasapplication/*+json,application/json,text/json
Responses
PairingSessionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/pairing/sessions/{id}/exchangeDevice A completes the pairing by providing the wrapped master key.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Pairing session ID |
Request body
Not marked as required in the document.
CompletePairingRequestasapplication/*+json,application/json,text/json
Responses
PairingSessionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/pairing/sessions/{id}/extendExtends a pre-key-exchange pairing session's expiry within the FR-01.006 window (debt-2026-07-03-006). Backs the approval surface's warn-at-20% + one-action "Extend" so the user can avoid the WCAG 2.2.1 timing cut-off without re-pairing — the same QR/comparison code is preserved.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Pairing session ID |
Request body
No request body.
Responses
PairingSessionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/pairing/sessions/{id}/joinDevice B responds to a pairing session after scanning QR code.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | Pairing session ID |
Request body
Not marked as required in the document.
RespondToPairingRequestasapplication/*+json,application/json,text/json
Responses
PairingSessionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsPasswordChangeSaga
/api/v1/keys/password-change-saga/statusConsults the authoritative `password_change_sagas` record for a user (End-B producer, FR-01.073/078). Returns `{ isOpen, retryAfterSeconds }`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | query | string (uuid) | no | The account whose would-be-failing auth attempt is being disambiguated. |
Request body
No request body.
Responses
PasswordChangeSagaStatusResponseProblemDetailsProtectionStatus
/api/v1/protection-status/alternate-passphraseReports whether the owner currently has a duress/alternate passphrase provisioned, and optionally re-acknowledges the behaviour explanation on an armed arrangement.
FR-66.182 (#22211): with `behaviourAcknowledgementVersion` this is how an owner who armed under an earlier explanation confirms the current one, without re-arming. It is a phase of this action rather than an action of its own because the controller is at its CAP-011b origin ceiling.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
SetAlternatePassphraseStatusRequestasapplication/*+json,application/json,text/json
Responses
ProtectionStatusResponseProblemDetailsProblemDetailsProblemDetails/api/v1/protection-status/backup-vaultReports the backup/decoy vault's presence and last-review freshness.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
SetBackupVaultStatusRequestasapplication/*+json,application/json,text/json
Responses
ProtectionStatusResponseProblemDetailsProblemDetailsRecoverySessions
/api/v1/recovery/sessionsInitiates a recovery session, stamping the FR-01.064 timeout window.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
InitiateRecoverySessionRequestasapplication/*+json,application/json,text/json
Responses
RecoverySessionResponseProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/sessions/{id}Reads a recovery session's server-authoritative timeout window.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
RecoverySessionResponseProblemDetailsProblemDetails/api/v1/recovery/sessions/{id}/keepaliveRe-arms the idle window ("Need more time?"). Refuses past the absolute security ceiling / extension cap (409) and on a lapsed / terminal session (422) — the server-side enforcement of the recovery-timeout ceiling.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
RecoverySessionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsResponderHolder
/api/v1/escrow/holdersLists the live responder-holder organisations (FR-01.033).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
tenantId | query | string (uuid) | no | — |
cursor | query | string (date-time) | no | — |
limit | query | integer (int32) | no | — |
Request body
No request body.
Responses
ResponderHolderListResponseProblemDetailsProblemDetails/api/v1/escrow/holdersEnrols an organisation as a break-glass escrow holder (FR-01.033).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
EnrolResponderHolderRequestasapplication/*+json,application/json,text/json
Responses
ResponderHolderResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/holders/{organisationId}Revokes an organisation's holder authority (FR-01.033).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organisationId | path | string (uuid) | yes | — |
tenantId | query | string (uuid) | no | — |
reason | query | string | no | — |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/holders/{organisationId}/respondersCredentials an individual responder under a holder organisation (FR-01.033).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organisationId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
CredentialResponderRequestasapplication/*+json,application/json,text/json
Responses
ResponderHolderResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/escrow/holders/{organisationId}/responders/{responderId}Withdraws an individual responder's credentialing (FR-01.033).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organisationId | path | string (uuid) | yes | — |
responderId | path | string (uuid) | yes | — |
tenantId | query | string (uuid) | no | — |
reason | query | string | no | — |
Request body
No request body.
Responses
ResponderHolderResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsRotationObligations
/api/v1/rotation/obligationsLists the caller's open device-removal rotation obligations, oldest removal first.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
KeyRotationObligationResponse[]ProblemDetails/api/v1/rotation/obligations/emergency-keyLists the caller's open emergency-key rotation obligations, oldest exposure first (FR-01.042(d), #22167): rotations owed because a break-glass grant was revoked after its Emergency Access Key had been reconstructed, so the key is treated as known-exposed.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
EakRotationObligationResponse[]ProblemDetails/api/v1/rotation/obligations/emergency-key/{id}/deferDefers one of the caller's emergency-key rotations for one cadence period (FR-01.043 / AC-01.044 (c), #22248). The defer is recorded on the escrow audit chain and anchored to the EPIC 4 ledger as "offered, chose to defer, residual exposure window"; the reminder returns when it runs out. One defer per reminder — the rotation can be put off, never suppressed.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The obligation id from `GET /api/v1/rotation/obligations/emergency-key`. |
Request body
No request body.
Responses
EakRotationDeferralResponseProblemDetailsProblemDetailsProblemDetailsSharedCredentialWrap
UserPrivateKeyEnvelope
/api/v1/keys/private-envelopeFetches the caller's wrapped private-key envelope so another device can re-derive the UMK and unwrap the account keyset locally. Rate-limited (default 5/hour/account) mirroring the wrapped-UMK envelope fetch throttle (FR-01.074-style — defends online guessing/harvesting of a stolen envelope).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
UserPrivateKeyEnvelopeResponseProblemDetailsProblemDetailsProblemDetails/api/v1/keys/private-envelopeMints or replaces the caller's wrapped private-key envelope. Create-vs-replace is decided server-side by whether the caller already has a row; a replace submitted with a `keyEpoch` older than the stored epoch is rejected 409 (concurrent-mint convergence guard — the caller lost a race against a newer mint and must retry against the current epoch).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
UpsertUserPrivateKeyEnvelopeRequestasapplication/*+json,application/json,text/json
Responses
UserPrivateKeyEnvelopeResponseProblemDetailsProblemDetailsProblemDetailsWrappedUmk
/api/v1/keys/wrapped-umkFetches the wrapped-UMK envelope set so a fresh device can derive the KEK and unwrap the UMK with the password alone (FR-01.074). Returns the current envelope plus any retiring prior-generation envelope during a rotation dual-key window. Rate-limited (default 5/hour/account) to defend online guessing of a stolen envelope; a 429 increments the throttled-fetch count and raises the FR-01.N66.011 anomaly notification.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
GetWrappedUmkEnvelopeResponseProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umkRe-wraps the same UMK under a freshly-derived KEK after a password change or PBKDF2-iteration upgrade (FR-01.073). Gated behind a re-auth proof; the UMK / key hierarchy / stored ciphertext are untouched and the generation does not advance.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RewrapWrappedUmkEnvelopeRequestasapplication/*+json,application/json,text/json
Responses
RewrapWrappedUmkEnvelopeResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umkCreates the wrapped-UMK envelope at registration (FR-01.075). Idempotent per account — returns 409 if an envelope already exists (use `PUT` to re-wrap). Atomically seeds the genesis `key_generations` row.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateWrappedUmkEnvelopeRequestasapplication/*+json,application/json,text/json
Responses
CreateWrappedUmkEnvelopeResponseProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/duress-envelopeEnrols the account's <strong>decoy</strong> vault-unlock envelope plus the sealed manifest of the curated subset it exposes (journey `duress-passphrase-silent-alarm-and-decoy-unlock`).
The client derives a KEK from the owner's alternate ("duress") passphrase, wraps a freshly-generated DECOY UMK under it, re-wraps the file keys of the documents the owner curated, and seals that list under the decoy UMK. Only opaque ciphertext reaches here: the server never sees the alternate passphrase, the decoy UMK, or which documents were chosen. Unlike `POST` (the registration create) this does <b>not</b> 409 against the account's existing primary envelope — a decoy occupies a different slot. The single-current-envelope guarantee is preserved per slot by `unq_wrapped_umk_current` keyed on `(user_id, kind)`, so a second envelope of the SAME kind still conflicts exactly as before. Re-enrolling under a new alternate passphrase re-wraps the existing decoy in place.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
EnrolDuressEnvelopeRequestasapplication/*+json,application/json,text/json
Responses
CreateWrappedUmkEnvelopeResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/majority-transition-rekeyPerforms the offline-capable EPIC-1 re-key leg of the CC-070 minor→adult majority transition (journey `guardian-minor-vault-to-adulthood-handover`, FR-30.011). Re-wraps the same UMK under the new adult's KEK — transferring sole key custody and severing the guardian-pre-enrolled transition envelope — and enqueues the discrete `MinorMajorityVaultRekeyedIntegrationEvent` so EPIC 4 writes the superseding attestation the transition compliance report evidences.
Authorised by a one-shot `purpose=majority-transition-rekey` token minted by the EPIC 30/9 CC-070 orchestration after it verified majority + identity — not a current-envelope re-auth proof (the first-time-claiming adult cannot produce one) and never a live guardian (FR-30.011 makes the guardian non-essential). Mirrors the FR-01.092 `purpose=envelope-provisioning` registration gate. Zero-knowledge: only the re-wrapped ciphertext + KEK parameters reach the server.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RekeyMajorityTransitionRequestasapplication/*+json,application/json,text/json
Responses
RekeyMajorityTransitionResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/passkeyLists the account's passkey vault-unlockers and the device each is linked to (FR-01.049, #17493). A device removal revokes only the envelopes linked to that device, so an envelope listed with `enrolledByDevice: null` survives every removal and is for its owner to see and remove. Metadata only (no ciphertext or KDF input), so it is held to the default rate limit, not the FR-01.074 envelope-fetch budget.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ListPasskeyUnlockersResponseProblemDetails/api/v1/keys/wrapped-umk/passkeyEnrols an ADDITIONAL passkey vault-unlock envelope onto the authenticated account (FR-01.058 passkey passwordless vault-unlock). The client wraps the account's UMK under a KEK HKDF-derived from the passkey's WebAuthn-PRF output; this stores that envelope keyed by resident credential. Unlike `POST` (the registration create), it coexists with the account's password / other passkey envelopes and does not seed a generation. Idempotent per credential — a re-enrol of the same credential returns 409.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
EnrollPasskeyEnvelopeRequestasapplication/*+json,application/json,text/json
Responses
CreateWrappedUmkEnvelopeResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/passkey/{credentialId}Removes the passkey vault-unlock envelope for a resident credential (FR-01.058 cryptographic revocation, §5). Call this whenever the passkey itself is removed so the wrapped UMK for that credential becomes unreachable. Idempotent — a non-existent credential envelope still returns 204.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
credentialId | path | string | yes | — |
Request body
No request body.
Responses
ProblemDetails/api/v1/keys/wrapped-umk/passkey/{credentialId}/attestReports that this device has just unlocked the vault with a passkey (FR-01.049, #17609). An envelope listed with `enrolledByDevice: null` is linked to the device that proves possession here, so removing that device revokes it; an envelope already linked keeps its link.
Sent by the client after a successful local unwrap. The device is the one whose enrolled key verified the request's `X-Device-Proof` — never a body-supplied id (SEC-009(a)). Under the soak's `Audit` mode an unproven request still reaches here and records nothing (`outcome: device-proof-unverified`). Not on the `wrapped-umk-fetch` budget: it returns no key material.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
credentialId | path | string | yes | — |
Request body
No request body.
Responses
AttestPasskeyEnvelopeResponseProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/password-changeInitiates the FR-01.078 cross-service password change. EPIC 1 (the saga orchestrator) re-wraps the wrapped-UMK envelope, retains the prior version for compensation, and asks EPIC 9 to swap the login auth-hash. Returns 202 Accepted with the `saga_id`: the envelope re-wrap has committed and the saga is in its `AwaitingAuthHashSwap` window. Distinct from the envelope-only re-wrap (`PUT`) used by the FR-01.072(d) post-recovery path.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ChangePasswordRequestasapplication/*+json,application/json,text/json
Responses
ChangePasswordResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/recovery-phraseFetches the account's recovery-phrase envelope (D-126 phase 2) so the client can re-derive the KEK from the phrase + stored salt and unwrap the UMK locally. Accepts an ordinary session JWT (the owner checking / rehearsing recovery), a one-shot EPIC 9 token carrying `purpose=recovery-rewrap` (a forgotten-password recoverer who has just proved possession of the phrase), OR the session a guardian recovery minted at its threshold (`purpose=recovery_session` + `amr=recovery`, #15645) — the recovering device opens this envelope with the recovery KEK it rebuilt from the guardians' shares. Any other purpose (envelope-provisioning, majority-transition-rekey, recovery_refresh, …) is 403. Rate-limited by the same `wrapped-umk-fetch` policy as the main envelope fetch (FR-01.074) to defend online guessing of a stolen phrase envelope.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
GetRecoveryPhraseEnvelopeResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/recovery-phraseEnrols — or REPLACES — the account's <strong>recovery-phrase</strong> vault-unlock envelope (Decision D-126 phase 2). The client wraps the account's SAME UMK under a KEK HKDF-derived from the user's 24-word BIP39 phrase over a random salt; this stores that envelope tagged `Recovery-Phrase`. Like the passkey enrol it coexists with the password / passkey envelopes and does not seed a generation.
<b>Re-enrolment replaces.</b> A user who re-generates their phrase must be able to re-enrol, so an existing recovery-phrase envelope is soft-deleted (DAT-002) and the new one inserted in the same unit of work — this returns 201, not 409. Only a concurrent enrolment losing the unique-guard race returns 409 (`reason=recovery_phrase_envelope_exists`). Zero-knowledge: no plaintext key material is ever received here — only ciphertext, GCM parameters and the PUBLIC random HKDF salt. The phrase, KEK and UMK never leave the device.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
EnrolRecoveryPhraseEnvelopeRequestasapplication/*+json,application/json,text/json
Responses
CreateWrappedUmkEnvelopeResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/recovery-phraseRemoves the account's recovery-phrase vault-unlock envelope (D-126 — the user disabled phrase recovery). The phrase-wrapped UMK becomes unreachable, so the phrase can no longer recover the vault. Idempotent — returns 204 when none exists.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/recovery-rewrapCompletes a D-126 forgotten-password recovery: replaces the CURRENT primary password envelope with the same UMK re-wrapped under a NEW password and relays the new EPIC 9 auth-hash through the FR-01.078 password-change saga — exactly as `POST .../password-change`, but WITHOUT a current-password precondition or step-up gate. The proof is the one-shot EPIC 9 token carrying `purpose=recovery-rewrap`, minted only after the user proved possession of their recovery phrase — or the session a guardian recovery minted at its threshold (`purpose=recovery_session` + `amr=recovery`, FR-01.072(d), #15645), which buys ONE re-wrap (a second since its `iat` is 409 `recovery_session_rewrap_spent`). An ordinary session JWT is rejected (403). Returns 202 with the `saga_id`: the envelope re-wrap has committed and the saga awaits the EPIC 9 auth-hash swap. The recovery-phrase envelope itself is untouched. A phrase recovery's response also carries the single-use `recoveryEnrolmentTicket` (#18062) that lets this browser enrol its signing key once after it signs in.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RecoveryRewrapRequestasapplication/*+json,application/json,text/json
Responses
RecoveryRewrapResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/registrationProvisions the wrapped-UMK envelope at registration via the FR-01.092 inverted, envelope-first handshake (Decision D-127, option b). The caller presents a one-shot EPIC 9 envelope-provisioning token (a JWT carrying `purpose=envelope-provisioning` + the user's `sub`); EPIC 1 commits the envelope + genesis generation, opens the registration saga, and asks EPIC 9 to finalise the login auth-hash. Returns 202 Accepted with the `saga_id`: the account becomes loginable only once EPIC 9 finalises, so no observable user ever has an auth-hash without a matching envelope.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ProvisionRegistrationEnvelopeRequestasapplication/*+json,application/json,text/json
Responses
ProvisionRegistrationEnvelopeResponseProblemDetailsProblemDetailsProblemDetails/api/v1/keys/wrapped-umk/unlock-resolutionReports a locally-resolved unlock — normal OR duress — so its audit / silent-alarm side effects are handed to the off-critical-path indistinguishability seam (FR-01.074, journey:duress-passphrase-silent-alarm-and-decoy-unlock, debt-2026-06-13-1072). Under zero-knowledge the server never sees the passphrase and cannot resolve duress vs normal itself; the client (having unwrapped the genuine or decoy UMK locally) reports the outcome here.
The client MUST call this on <b>every</b> unlock with an identically-shaped body, differing only in Essence.Core.MultiDeviceSync.Contracts.Requests.SignalUnlockResolutionRequest.Kind, so a coerced session cannot tell the two apart. The response is a constant `202 Accepted` for both kinds and whether or not the seam actually queued the signal — no accepted/dropped and no duress/normal tell. It is deliberately NOT on the `wrapped-umk-fetch` budget, only the platform default limiter (#9513). The envelope fetch's five-per-hour budget can be drained by the victim's own session; if the resolution shared it, a coercer could drain it and then compel an unlock the alarm could not report. For the same reason there is no per-account hourly budget of its own, which would be drainable the same way. A client whose fetch was refused reports Essence.Core.MultiDeviceSync.Contracts.Requests.UnlockResolutionKinds.Unresolved.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
SignalUnlockResolutionRequestasapplication/*+json,application/json,text/json
Responses
SignalUnlockResolutionResponseProblemDetailsProblemDetailsSchemas
AcknowledgePendingKeyRotationRequest
| Property | Type | Required | Description |
|---|---|---|---|
rotationSessionId | string (uuid) | no | — |
ApproveDeviceIntegrityStepUpRequest
| Property | Type | Required | Description |
|---|---|---|---|
proof | string | null | no | — |
ApproveEscrowReconstructionRequest
| Property | Type | Required | Description |
|---|---|---|---|
approvedAt | string (date-time) | no | — |
approverKeyId | string | null | no | — |
signatureBase64 | string | null | no | — |
ApproverDirectoryEntryResponse
| Property | Type | Required | Description |
|---|---|---|---|
approverId | string (uuid) | no | — |
createdAt | string (date-time) | no | — |
credentialType | string | null | no | — |
effectiveFrom | string (date-time) | no | — |
effectiveUntil | string (date-time) | null | no | — |
enrolmentAdminId | string (uuid) | no | — |
entryId | string | null | no | — |
isQuarantined | boolean | no | — |
signingKeyId | string | null | no | — |
tenantId | string (uuid) | null | no | — |
ApproverDirectoryListResponse
| Property | Type | Required | Description |
|---|---|---|---|
approvers | ApproverDirectoryEntryResponse[] | null | no | — |
nextCursor | string (date-time) | null | no | — |
AssistedRecoveryGrantConfirmationLookupRequest
| Property | Type | Required | Description |
|---|---|---|---|
organizationId | string (uuid) | no | — |
recoveryTokenRef | string | null | no | — |
AssistedRecoveryGrantConfirmationResponse
| Property | Type | Required | Description |
|---|---|---|---|
anchorRef | string | null | no | — |
attestationMatchesCanonical | boolean | no | — |
auditEntryHash | string | null | no | — |
auditEntryId | string (uuid) | no | — |
authorisedAt | string (date-time) | no | — |
authorisingAdminId | string (uuid) | no | — |
confirmed | boolean | no | — |
enrolmentId | string (uuid) | no | — |
grantScopeAuthoriseOnly | boolean | no | — |
grantType | string | null | no | — |
noDecryptCapabilityReleased | boolean | no | — |
recoveryTokenRef | string | null | no | — |
sealVerified | boolean | no | — |
subjectUserId | string (uuid) | no | — |
unconfirmedReason | string | null | no | — |
zkAttestation | string | null | no | — |
AssistedRecoveryGrantResponse
| Property | Type | Required | Description |
|---|---|---|---|
anchorRef | string | null | no | — |
authorisingAdminId | string (uuid) | no | — |
enrolmentId | string (uuid) | no | — |
issuedAt | string (date-time) | no | — |
recoveryTokenRef | string | null | no | — |
scope | string | null | no | — |
stepUpAssuranceLevel | string | null | no | — |
subjectUserId | string (uuid) | no | — |
zkAttestation | string | null | no | — |
AttestPasskeyEnvelopeResponse
| Property | Type | Required | Description |
|---|---|---|---|
credentialId | string | null | no | — |
enrolledByDeviceRegistrationId | string (uuid) | null | no | — |
outcome | string | null | no | — |
AuthHashUpdateRequest
| Property | Type | Required | Description |
|---|---|---|---|
breachCheck | string | null | no | — |
newAuthDerivationParams | string | null | no | — |
newAuthHash | string | null | no | — |
passwordPolicyVersion | integer (int32) | null | no | — |
BequeathedCredentialItemDto
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
executorKeyRef | string | null | no | — |
itemId | string | null | no | — |
itemName | string | null | no | — |
iv | string | null | no | — |
sealedSecret | string | null | no | — |
BiometricMismatchAssuranceResponse
| Property | Type | Required | Description |
|---|---|---|---|
assuranceRef | string | null | no | — |
expiresAt | string (date-time) | no | — |
BiometricMismatchRebindResponse
| Property | Type | Required | Description |
|---|---|---|---|
assuranceRef | string | null | no | — |
deviceName | string | null | no | — |
keysRebound | boolean | no | — |
previousDeviceName | string | null | no | — |
previousDeviceStatus | string | null | no | — |
reestablishedAt | string (date-time) | no | — |
BreakGlassConsentExportEntry
| Property | Type | Required | Description |
|---|---|---|---|
grantee | string | null | no | — |
granteeType | string | null | no | — |
holderLabel | string | null | no | — |
legalBasis | string | null | no | — |
purpose | string | null | no | — |
recordedAt | string | null | no | — |
scope | string[] | null | no | — |
status | string | null | no | — |
windowEnd | string | null | no | — |
windowStart | string | null | no | — |
BreakGlassConsentExportResponse
| Property | Type | Required | Description |
|---|---|---|---|
article | string | null | no | — |
entries | BreakGlassConsentExportEntry[] | null | no | — |
generatedAt | string (date-time) | no | — |
ownerUserId | string (uuid) | no | — |
record | string | null | no | — |
BreakGlassConsentListResponse
| Property | Type | Required | Description |
|---|---|---|---|
consents | BreakGlassConsentResponse[] | null | no | — |
nextCursor | string (date-time) | null | no | — |
BreakGlassConsentResponse
| Property | Type | Required | Description |
|---|---|---|---|
consentId | string | null | no | — |
granteeId | string (uuid) | no | — |
granteeLabel | string | null | no | — |
granteeType | string | null | no | — |
holderLabel | string | null | no | — |
homeRegion | string | null | no | — |
legalBasis | string | null | no | — |
legalBasisLabel | string | null | no | — |
ownerUserId | string (uuid) | no | — |
purpose | string | null | no | — |
recordedAt | string (date-time) | no | — |
scopeCategories | string[] | null | no | — |
status | string | null | no | — |
tenantId | string (uuid) | null | no | — |
windowEnd | string (date-time) | null | no | — |
windowStart | string (date-time) | no | — |
withdrawalReason | string | null | no | — |
withdrawnAt | string (date-time) | null | no | — |
BreakGlassGrantedConsentListResponse
| Property | Type | Required | Description |
|---|---|---|---|
consents | BreakGlassConsentResponse[] | null | no | — |
nextCursor | string (date-time) | null | no | — |
unreachableRegions | string[] | null | no | — |
CancelMergeRewrapRequestBody
Body for the cancel action.
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | Why the task was cancelled, in words a member and an auditor can both read. |
ChangePasswordRequest
| Property | Type | Required | Description |
|---|---|---|---|
authHashUpdate | AuthHashUpdateRequest | no | — |
authTag | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
wrappedUmk | string | null | no | — |
ChangePasswordResponse
| Property | Type | Required | Description |
|---|---|---|---|
requestedAt | string (date-time) | no | — |
sagaId | string (uuid) | no | — |
status | string | null | no | — |
CheckpointMergeRewrapRequest
| Property | Type | Required | Description |
|---|---|---|---|
checkpointData | string | null | no | — |
deviceId | string | null | no | — |
rewrappedItems | integer (int32) | no | — |
CheckpointRotationRequest
| Property | Type | Required | Description |
|---|---|---|---|
checkpointData | string | null | no | — |
rotatedItems | integer (int32) | no | — |
ClaimMergeRewrapRequest
| Property | Type | Required | Description |
|---|---|---|---|
deviceId | string | null | no | — |
leaseMinutes | integer (int32) | null | no | — |
CompleteKeyRotationRequest
| Property | Type | Required | Description |
|---|---|---|---|
newGenerationEnvelope | RotationEnvelopeRequest | no | — |
passkeyRewraps | RotationPasskeyRewrapRequest[] | null | no | — |
CompleteMergeRewrapRequest
| Property | Type | Required | Description |
|---|---|---|---|
deviceId | string | null | no | — |
CompletePairingRequest
| Property | Type | Required | Description |
|---|---|---|---|
approvedJoinerSigningKeyThumbprint | string | null | no | — |
wrappedMasterKey | string | null | no | — |
ConductExecutorRehearsalRequest
| Property | Type | Required | Description |
|---|---|---|---|
depth | string | null | no | — |
enrolmentId | string | null | no | — |
ConfigureEscrowRequest
| Property | Type | Required | Description |
|---|---|---|---|
enrolmentId | string | null | no | — |
fingerprint | string | null | no | — |
shares | ConfigureEscrowShareEnvelope[] | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
wrappedVaultKeys | ConfigureEscrowVaultKeyWrap[] | null | no | — |
ConfigureEscrowVaultKeyWrap
| Property | Type | Required | Description |
|---|---|---|---|
aad | string | null | no | — |
authTag | string (byte) | null | no | — |
ciphertext | string (byte) | null | no | — |
nonce | string (byte) | null | no | — |
vaultCategory | string | null | no | — |
ConfirmPairingRequest
| Property | Type | Required | Description |
|---|---|---|---|
deviceId | string (uuid) | no | — |
fingerprintConfirmed | boolean | no | — |
sasConfirmation | string | null | no | — |
CreatePairingSessionRequest
| Property | Type | Required | Description |
|---|---|---|---|
challenge | string | null | no | — |
deviceAId | string (uuid) | no | — |
deviceAPublicKey | string | null | no | — |
expiresAt | string (date-time) | no | — |
CreateWrappedUmkEnvelopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
passkeyBindingToken | string | null | no | — |
passkeyCredentialId | string | null | no | — |
wrappedUmk | string | null | no | — |
CreateWrappedUmkEnvelopeResponse
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
version | integer (int32) | no | — |
CredentialedResponderSummary
| Property | Type | Required | Description |
|---|---|---|---|
credentialedAt | string (date-time) | no | — |
responderClass | string | null | no | — |
responderId | string (uuid) | no | — |
revokedAt | string (date-time) | null | no | — |
status | string | null | no | — |
CredentialResponderRequest
| Property | Type | Required | Description |
|---|---|---|---|
responderClass | string | null | no | — |
responderId | string (uuid) | no | — |
tenantId | string (uuid) | null | no | — |
CurrentKeyGenerationResponse
| Property | Type | Required | Description |
|---|---|---|---|
currentGeneration | string | null | no | — |
pendingRotationSessionId | string (uuid) | null | no | — |
DenyEscrowReconstructionRequest
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | — |
DeprovisionApproverResult
| Property | Type | Required | Description |
|---|---|---|---|
approverId | string (uuid) | no | — |
quorumsReverted | integer (int32) | no | — |
DeviceChallengeResponse
| Property | Type | Required | Description |
|---|---|---|---|
challengeId | string (uuid) | no | — |
deviceRegistrationId | string (uuid) | no | — |
expiresAt | string (date-time) | no | — |
nonce | string | null | no | — |
purpose | string | null | no | — |
DeviceIntegrityResponse
| Property | Type | Required | Description |
|---|---|---|---|
appAttestRiskMetric | integer (int32) | null | no | — |
appAttestRiskMetricReadAt | string (date-time) | null | no | — |
change | string | null | no | — |
deviceRegistrationId | string (uuid) | no | — |
observed | boolean | no | — |
observedAt | string (date-time) | null | no | — |
platform | string | null | no | — |
posture | string | null | no | — |
postureReason | string | null | no | — |
priorVerdict | string | null | no | — |
reason | string | null | no | — |
stale | boolean | no | — |
verdict | string | null | no | — |
DeviceIntegrityStepUpListResponse
| Property | Type | Required | Description |
|---|---|---|---|
requests | DeviceIntegrityStepUpResponse[] | null | no | — |
DeviceIntegrityStepUpResponse
| Property | Type | Required | Description |
|---|---|---|---|
bodyDigest | string | null | no | — |
createdAt | string (date-time) | no | — |
decidedByDeviceRegistrationId | string (uuid) | null | no | — |
expiresAt | string (date-time) | no | — |
method | string | null | no | — |
path | string | null | no | — |
peerProof | string | null | no | — |
requestingDeviceName | string | null | no | — |
requestingDeviceRegistrationId | string (uuid) | no | — |
status | string | null | no | — |
stepUpRequestId | string (uuid) | no | — |
DeviceKeyExchangeKeyRotationResponse
| Property | Type | Required | Description |
|---|---|---|---|
deviceRegistrationId | string (uuid) | no | — |
publicKeyFingerprint | string | null | no | — |
rotatedAt | string (date-time) | no | — |
DeviceRegistrationResponse
| Property | Type | Required | Description |
|---|---|---|---|
deviceId | string | null | no | — |
deviceName | string | null | no | — |
deviceType | string | null | no | — |
id | string (uuid) | no | — |
isActive | boolean | no | — |
lastSeenAt | string (date-time) | no | — |
publicKey | string | null | no | — |
registeredAt | string (date-time) | no | — |
signingKeyEnrolledAt | string (date-time) | null | no | — |
signingKeyEnrolmentMethod | string | null | no | — |
signingKeyThumbprint | string | null | no | — |
suspectedLostAt | string (date-time) | null | no | — |
suspectedLostRecoverySessionId | string (uuid) | null | no | — |
userId | string (uuid) | no | — |
DeviceRegistrationResponseCursorResult
| Property | Type | Required | Description |
|---|---|---|---|
hasMore | boolean | no | — |
items | DeviceRegistrationResponse[] | null | no | — |
nextCursor | string | null | no | — |
pageSize | integer (int32) | no | — |
previousCursor | string | null | no | — |
DeviceSigningKeyLookupRequest
| Property | Type | Required | Description |
|---|---|---|---|
keyThumbprint | string | null | no | — |
userId | string (uuid) | no | — |
DeviceSigningKeyLookupResponse
| Property | Type | Required | Description |
|---|---|---|---|
deviceRegistrationId | string (uuid) | null | no | — |
found | boolean | no | — |
keyThumbprint | string | null | no | — |
publicJwk | string | null | no | — |
DeviceSyncStatusResponse
| Property | Type | Required | Description |
|---|---|---|---|
deviceId | string (uuid) | no | — |
isOnline | boolean | no | — |
keyGeneration | integer (int32) | no | — |
lastSyncedAt | string (date-time) | no | — |
pendingUpdates | integer (int32) | no | — |
EakEnrolmentResponse
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
escrowKeyFingerprint | string | null | no | — |
expiresAt | string (date-time) | no | — |
id | string (uuid) | no | — |
isEnabled | boolean | no | — |
jurisdiction | string | null | no | — |
revocationReason | string | null | no | — |
revokedAt | string (date-time) | null | no | — |
shares | EakShareCustodySummary[] | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
updatedAt | string (date-time) | null | no | — |
userId | string (uuid) | no | — |
vaultCategory | string | null | no | — |
EakRotationDeferralResponse
| Property | Type | Required | Description |
|---|---|---|---|
anchorReference | string | null | no | — |
deferralCount | integer (int32) | no | — |
deferredAt | string (date-time) | no | — |
deferredUntil | string (date-time) | no | — |
exposedAt | string (date-time) | no | — |
obligationId | string (uuid) | no | — |
EakRotationObligationResponse
| Property | Type | Required | Description |
|---|---|---|---|
canDefer | boolean | no | — |
cause | string | null | no | — |
deferredUntil | string (date-time) | null | no | — |
exposedAt | string (date-time) | no | — |
id | string (uuid) | no | — |
nextDueAt | string (date-time) | no | — |
reSurfaceDays | integer (int32) | no | — |
sessionId | string (uuid) | no | — |
EmergencyAccessAnchorResponse
| Property | Type | Required | Description |
|---|---|---|---|
actorRef | string | null | no | — |
anchorId | string (uuid) | no | — |
blockchainAnchorId | string | null | no | — |
configRef | string | null | no | — |
occurredOn | string (date-time) | no | — |
originInstanceId | string (uuid) | no | — |
phase | string | null | no | — |
recordedAt | string (date-time) | no | — |
requesterOrgRef | string | null | no | — |
requesterRef | string | null | no | — |
sessionRef | string | null | no | — |
subjectRef | string | null | no | — |
urgency | string | null | no | — |
EmergencyAccessAnchorResponseCursorResult
| Property | Type | Required | Description |
|---|---|---|---|
hasMore | boolean | no | — |
items | EmergencyAccessAnchorResponse[] | null | no | — |
nextCursor | string | null | no | — |
pageSize | integer (int32) | no | — |
previousCursor | string | null | no | — |
EmergencyAccessReleaseHistoryResponse
| Property | Type | Required | Description |
|---|---|---|---|
events | EmergencyAccessReleaseRecordDto[] | null | no | — |
generatedAt | string (date-time) | no | — |
subjectUserId | string (uuid) | no | — |
EmergencyAccessReleaseRecordDto
| Property | Type | Required | Description |
|---|---|---|---|
anchorRef | string | null | no | — |
approvalChain | string[] | null | no | — |
eventId | string (uuid) | no | — |
evidenceHash | string | null | no | — |
fieldsReleased | string[] | null | no | — |
grantEndedAt | string (date-time) | null | no | — |
invokerLabel | string | null | no | — |
occurredAt | string (date-time) | no | — |
outcome | string | null | no | — |
releasePath | string | null | no | — |
EmergencyCardReadResponse
| Property | Type | Required | Description |
|---|---|---|---|
anchorId | string | null | no | — |
anchoredHash | string | null | no | — |
notifiedRecipientCount | integer (int32) | no | — |
occurredAt | string (date-time) | no | — |
readEventId | string (uuid) | no | — |
EnrolApproverRequest
| Property | Type | Required | Description |
|---|---|---|---|
approverId | string (uuid) | no | — |
attestation | string | null | no | — |
credentialPin | string | null | no | — |
credentialType | string | null | no | — |
effectiveFrom | string (date-time) | no | — |
effectiveUntil | string (date-time) | null | no | — |
tenantId | string (uuid) | null | no | — |
EnrolDeviceSigningKeyRequest
| Property | Type | Required | Description |
|---|---|---|---|
enrolmentProof | string | null | no | — |
pairingSessionId | string (uuid) | null | no | — |
recoveryEnrolmentTicket | string | null | no | — |
signingKeyJwk | string | null | no | — |
EnrolDuressEnvelopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
behaviourAcknowledgementVersion | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
manifestAuthTag | string | null | no | — |
manifestIv | string | null | no | — |
sealedManifest | string | null | no | — |
wrappedUmk | string | null | no | — |
EnrolEakRequest
| Property | Type | Required | Description |
|---|---|---|---|
escrowKeyFingerprint | string | null | no | — |
expiresAt | string (date-time) | no | — |
jurisdiction | string | null | no | — |
shares | EnrolEakShareRequest[] | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
vaultCategory | string | null | no | — |
EnrolFallbackRecoveryCodeRequest
| Property | Type | Required | Description |
|---|---|---|---|
recoveryCode | string | null | no | — |
EnrollPasskeyEnvelopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
passkeyBindingToken | string | null | no | — |
passkeyCredentialId | string | null | no | — |
prfInput | string | null | no | — |
wrappedUmk | string | null | no | — |
EnrolRecoveryPhraseEnvelopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
phraseSalt | string | null | no | — |
wrappedUmk | string | null | no | — |
EnrolResponderHolderRequest
| Property | Type | Required | Description |
|---|---|---|---|
credentialedClasses | string[] | null | no | — |
holderRole | string | null | no | — |
organisationId | string (uuid) | no | — |
tenantId | string (uuid) | null | no | — |
EscrowAuditChainResponse
| Property | Type | Required | Description |
|---|---|---|---|
entries | EscrowAuditEntryDto[] | null | no | — |
hasMore | boolean | no | — |
headHash | string | null | no | — |
nextCursor | string | null | no | — |
pageSize | integer (int32) | no | — |
EscrowAuditChainVerificationResponse
| Property | Type | Required | Description |
|---|---|---|---|
entriesChecked | integer (int32) | no | — |
failureReason | string | null | no | — |
firstFailureEntryId | string (uuid) | null | no | — |
firstFailureIndex | integer (int32) | null | no | — |
isValid | boolean | no | — |
EscrowAuditEntryDto
| Property | Type | Required | Description |
|---|---|---|---|
action | string | null | no | — |
actorId | string (uuid) | no | — |
blockchainAnchorId | string | null | no | — |
enrolmentId | string (uuid) | null | no | — |
entryHash | string | null | no | — |
id | string (uuid) | no | — |
occurredAt | string (date-time) | no | — |
payloadJson | string | null | no | — |
previousHash | string | null | no | — |
requestId | string (uuid) | null | no | — |
EscrowEnrolmentStatusResponse
| Property | Type | Required | Description |
|---|---|---|---|
attestationStaleUnverified | boolean | no | — |
belowReconstructionThresholdForDisplay | boolean | no | — |
createdAt | string (date-time) | no | — |
displayAvailableHolderCount | integer (int32) | no | — |
enrolmentId | string | null | no | — |
fingerprint | string | null | no | — |
freshnessWindowDays | integer (int32) | no | — |
holders | EscrowShareHolderSummary[] | null | no | — |
revocationReason | string | null | no | — |
revokedAt | string (date-time) | null | no | — |
status | string | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
updatedAt | string (date-time) | null | no | — |
userId | string (uuid) | no | — |
vaultCategories | string[] | null | no | — |
EscrowReconstructionHolderDto
| Property | Type | Required | Description |
|---|---|---|---|
holderId | string | null | no | — |
holderType | string | null | no | — |
role | string | null | no | — |
shareIndex | integer (int32) | no | — |
EscrowReconstructionJustificationResponse
| Property | Type | Required | Description |
|---|---|---|---|
justification | string | null | no | — |
readerRole | string | null | no | — |
requestId | string (uuid) | no | — |
state | string | null | no | — |
EscrowReconstructionLifecycleResponse
| Property | Type | Required | Description |
|---|---|---|---|
accessExpiresAt | string (date-time) | null | no | — |
accessExtensionChallengeNonce | string | null | no | — |
accessExtensionCount | integer (int32) | no | — |
accessWindowCeiling | string (date-time) | null | no | — |
approvalChallengeNonce | string | null | no | — |
approvalCount | integer (int32) | no | — |
earliestUnlockAt | string (date-time) | null | no | — |
enrolmentId | string | null | no | — |
expiresAt | string (date-time) | no | — |
requestId | string (uuid) | no | — |
shareSubmissionCount | integer (int32) | no | — |
status | string | null | no | — |
updatedAt | string (date-time) | null | no | — |
zeroizationSignalledAt | string (date-time) | null | no | — |
EscrowReconstructionMaterialResponse
| Property | Type | Required | Description |
|---|---|---|---|
accessExpiresAt | string (date-time) | null | no | — |
enrolmentId | string (uuid) | no | — |
holders | EscrowReconstructionHolderDto[] | null | no | — |
requestId | string (uuid) | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
vaultKeyWraps | EscrowVaultKeyWrapDto[] | null | no | — |
EscrowReconstructionRequestResponse
| Property | Type | Required | Description |
|---|---|---|---|
approvalChallengeNonce | string | null | no | — |
enrolmentId | string | null | no | — |
expiresAt | string (date-time) | null | no | — |
requestId | string (uuid) | no | — |
requestedAt | string (date-time) | no | — |
status | string | null | no | — |
EscrowRequesterClosedRequestDto
| Property | Type | Required | Description |
|---|---|---|---|
expiresAt | string (date-time) | no | — |
requestId | string (uuid) | no | — |
requestedAt | string (date-time) | no | — |
status | string | null | no | — |
subjectUserId | string (uuid) | no | — |
EscrowRequesterClosedRequestsResponse
| Property | Type | Required | Description |
|---|---|---|---|
requests | EscrowRequesterClosedRequestDto[] | null | no | — |
EscrowRequesterOpenRequestDto
| Property | Type | Required | Description |
|---|---|---|---|
earliestUnlockAt | string (date-time) | null | no | — |
expiresAt | string (date-time) | null | no | — |
homeRegion | string | null | no | — |
requestId | string (uuid) | no | — |
requestedAt | string (date-time) | no | — |
status | string | null | no | — |
subjectUserId | string (uuid) | null | no | — |
EscrowRequesterOpenRequestsResponse
| Property | Type | Required | Description |
|---|---|---|---|
requests | EscrowRequesterOpenRequestDto[] | null | no | — |
EscrowVaultKeyWrapDto
| Property | Type | Required | Description |
|---|---|---|---|
aad | string | null | no | — |
authTagBase64 | string | null | no | — |
ciphertextBase64 | string | null | no | — |
nonceBase64 | string | null | no | — |
vaultCategory | string | null | no | — |
ExecutorBequestItemSummaryResponse
| Property | Type | Required | Description |
|---|---|---|---|
itemId | string | null | no | — |
itemName | string | null | no | — |
lastRevealedAt | string (date-time) | null | no | — |
revealCount | integer (int32) | no | — |
status | string | null | no | — |
ExecutorBequestSummaryResponse
| Property | Type | Required | Description |
|---|---|---|---|
bequestId | string (uuid) | no | — |
donorUserId | string (uuid) | no | — |
items | ExecutorBequestItemSummaryResponse[] | null | no | — |
releasedAt | string (date-time) | null | no | — |
status | string | null | no | — |
triggerLabel | string | null | no | — |
ExecutorRehearsalResponse
| Property | Type | Required | Description |
|---|---|---|---|
anchorRef | string | null | no | — |
assertion | string | null | no | — |
conductedAt | string (date-time) | no | — |
dataReleased | boolean | no | — |
depth | string | null | no | — |
enrolmentId | string (uuid) | no | — |
gateResults | RehearsalGateResultDto[] | null | no | — |
isReady | boolean | no | — |
readinessGapCount | integer (int32) | no | — |
readinessPassCount | integer (int32) | no | — |
runType | string | null | no | — |
simulatedActor | boolean | no | — |
umkUnwrapped | boolean | no | — |
FallbackRecoveryEnrolmentResponse
| Property | Type | Required | Description |
|---|---|---|---|
enrolledAt | string (date-time) | no | — |
GetRecoveryPhraseEnvelopeResponse
| Property | Type | Required | Description |
|---|---|---|---|
envelope | WrappedUmkEnvelopeDto | no | — |
GetWrappedUmkEnvelopeResponse
| Property | Type | Required | Description |
|---|---|---|---|
currentGeneration | string | null | no | — |
envelopes | WrappedUmkEnvelopeDto[] | null | no | — |
pendingRotation | PendingRotationEnvelopeDto | no | — |
InitiateKeyRotationRequest
| Property | Type | Required | Description |
|---|---|---|---|
deviceId | string | null | no | — |
totalItems | integer (int32) | no | — |
trigger | string | null | no | — |
InitiateRecoverySessionRequest
| Property | Type | Required | Description |
|---|---|---|---|
configId | string (uuid) | null | no | — |
reason | string | null | no | — |
IssueAssistedRecoveryAuthorizationRequest
| Property | Type | Required | Description |
|---|---|---|---|
enrolmentId | string (uuid) | no | — |
proofingEvidenceRef | string | null | no | — |
IssueDeviceChallengeRequest
| Property | Type | Required | Description |
|---|---|---|---|
purpose | string | null | no | — |
KdfParametersDto
| Property | Type | Required | Description |
|---|---|---|---|
algorithm | string | null | no | — |
iterations | integer (int32) | no | — |
salt | string | null | no | — |
KdfParametersRequest
| Property | Type | Required | Description |
|---|---|---|---|
algorithm | string | null | no | — |
calibrationMode | integer (int32) | no | — |
iterations | integer (int32) | no | — |
salt | string | null | no | — |
KeyCustodyIntegrityDecisionRequest
| Property | Type | Required | Description |
|---|---|---|---|
bodySha256 | string | null | no | — |
deviceProof | string | null | no | — |
method | string | null | no | — |
path | string | null | no | — |
peerProof | string | null | no | — |
possessionRefusesUnverified | boolean | no | — |
skipIntegrity | boolean | no | — |
verifyPossession | boolean | no | — |
KeyCustodyIntegrityDecisionResponse
| Property | Type | Required | Description |
|---|---|---|---|
evaluated | boolean | no | — |
indeterminate | boolean | no | — |
outcome | string | null | no | — |
peerOutcome | string | null | no | — |
possession | KeyCustodyPossessionVerdict | no | — |
posture | string | null | no | — |
stale | boolean | no | — |
stepUpDeviceRegistrationIds | (string (uuid))[] | null | no | — |
KeyCustodyPossessionVerdict
| Property | Type | Required | Description |
|---|---|---|---|
deviceRegistrationId | string (uuid) | null | no | — |
outcome | string | null | no | — |
verified | boolean | no | — |
KeyRotationObligationResponse
| Property | Type | Required | Description |
|---|---|---|---|
disposition | string | null | no | — |
id | string (uuid) | no | — |
removedAt | string (date-time) | no | — |
removedDeviceId | string (uuid) | no | — |
removedDeviceName | string | null | no | — |
KeyRotationSessionResponse
| Property | Type | Required | Description |
|---|---|---|---|
carriedPasskeyCount | integer (int32) | null | no | — |
checkpointData | string | null | no | — |
completedAt | string (date-time) | null | no | — |
coverageConfirmed | boolean | no | — |
coveredItemCount | integer (int32) | null | no | — |
deviceId | string | null | no | — |
dualKeyWindowExpiresAt | string (date-time) | no | — |
failureReason | string | null | no | — |
id | string (uuid) | no | — |
introducedGeneration | string | null | no | — |
lastCheckpointAt | string (date-time) | null | no | — |
newGenerationEnvelopeHeld | boolean | no | — |
oldGenerationItemCount | integer (int32) | null | no | — |
progressPercentage | number (double) | no | — |
revokedPasskeyCount | integer (int32) | null | no | — |
rotatedItems | integer (int32) | no | — |
startedAt | string (date-time) | no | — |
status | string | null | no | — |
totalItems | integer (int32) | no | — |
trigger | string | null | no | — |
userId | string (uuid) | no | — |
ListPasskeyUnlockersResponse
| Property | Type | Required | Description |
|---|---|---|---|
items | PasskeyUnlockerDto[] | null | no | — |
MergeRewrapTaskResponse
| Property | Type | Required | Description |
|---|---|---|---|
cancellationReason | string | null | no | — |
caseReference | string | null | no | — |
checkpointData | string | null | no | — |
claimedByDeviceId | string | null | no | — |
completedAt | string (date-time) | null | no | — |
expiresAt | string (date-time) | no | — |
handoverAlgorithm | string | null | no | — |
handoverEnvelope | string | null | no | — |
handoverPosted | boolean | no | — |
leaseExpiresAt | string (date-time) | null | no | — |
mergeSessionId | string (uuid) | no | — |
remainingItems | integer (int32) | no | — |
retiringUserId | string (uuid) | no | — |
rewrappedItems | integer (int32) | no | — |
status | string | null | no | — |
survivingUserId | string (uuid) | no | — |
survivorKeyRef | string | null | no | — |
taskId | string (uuid) | no | — |
totalItems | integer (int32) | no | — |
NotifyDevicesRequest
| Property | Type | Required | Description |
|---|---|---|---|
perDeviceWrappedKeyMaterial | map<string, string> | null | no | — |
NotifyDevicesResponse
| Property | Type | Required | Description |
|---|---|---|---|
devicesNotified | integer (int32) | no | — |
notifiedDeviceIds | (string (uuid))[] | null | no | — |
skippedDeviceFingerprints | string[] | null | no | — |
unmatchedDeviceFingerprints | string[] | null | no | — |
OpenDeviceIntegrityStepUpRequest
| Property | Type | Required | Description |
|---|---|---|---|
bodyDigest | string | null | no | — |
method | string | null | no | — |
path | string | null | no | — |
OpenMergeRewrapTaskRequest
| Property | Type | Required | Description |
|---|---|---|---|
caseReference | string | null | no | — |
mergeSessionId | string (uuid) | no | — |
retiringUserId | string (uuid) | no | — |
survivingUserId | string (uuid) | no | — |
totalItems | integer (int32) | no | — |
workWindowDays | integer (int32) | null | no | — |
PairingSessionResponse
| Property | Type | Required | Description |
|---|---|---|---|
completedAt | string (date-time) | null | no | — |
createdAt | string (date-time) | no | — |
deviceAId | string (uuid) | no | — |
deviceBId | string (uuid) | null | no | — |
deviceBPublicKey | string | null | no | — |
expiresAt | string (date-time) | no | — |
isExpired | boolean | no | — |
joinedAt | string (date-time) | null | no | — |
joinerFriendlyName | string | null | no | — |
joinerProvenance | string | null | no | — |
joinerSigningKeyApprovedAt | string (date-time) | null | no | — |
joinerSigningKeyThumbprint | string | null | no | — |
pairingSessionId | string (uuid) | no | — |
status | string | null | no | — |
timeRemaining | string (date-span) | null | no | — |
wrappedMasterKey | string | null | no | — |
PasskeyUnlockerDeviceDto
| Property | Type | Required | Description |
|---|---|---|---|
deviceName | string | null | no | — |
isActive | boolean | no | — |
registrationId | string (uuid) | no | — |
PasskeyUnlockerDto
| Property | Type | Required | Description |
|---|---|---|---|
credentialId | string | null | no | — |
enrolledAt | string (date-time) | no | — |
enrolledByDevice | PasskeyUnlockerDeviceDto | no | — |
isPrimary | boolean | no | — |
PasswordChangeSagaStatusResponse
| Property | Type | Required | Description |
|---|---|---|---|
isOpen | boolean | no | — |
retryAfterSeconds | integer (int32) | no | — |
PendingKeyRotationResponse
| Property | Type | Required | Description |
|---|---|---|---|
queuedAt | string (date-time) | no | — |
rotationSessionId | string (uuid) | no | — |
wrappedKeyMaterial | string | null | no | — |
PendingMergeRewrapTasksResponse
| Property | Type | Required | Description |
|---|---|---|---|
tasks | MergeRewrapTaskResponse[] | null | no | — |
PendingRotationEnvelopeDto
| Property | Type | Required | Description |
|---|---|---|---|
envelope | WrappedUmkEnvelopeDto | no | — |
keyGeneration | string | null | no | — |
passkeyEnvelopes | WrappedUmkEnvelopeDto[] | null | no | — |
rotationSessionId | string (uuid) | no | — |
PostMergeHandoverRequest
| Property | Type | Required | Description |
|---|---|---|---|
algorithm | string | null | no | — |
handoverEnvelope | string | null | no | — |
survivorKeyRef | string | null | no | — |
ProblemDetails
| Property | Type | Required | Description |
|---|---|---|---|
detail | string | null | no | — |
instance | string | null | no | — |
status | integer (int32) | null | no | — |
title | string | null | no | — |
type | string | null | no | — |
ProtectionStatusResponse
| Property | Type | Required | Description |
|---|---|---|---|
alternatePassphraseChangedAt | string (date-time) | null | no | — |
alternatePassphraseProvisioned | boolean | no | — |
backupVaultChangedAt | string (date-time) | null | no | — |
backupVaultLastReviewedAt | string (date-time) | null | no | — |
backupVaultPresent | boolean | no | — |
behaviourAcknowledgedAt | string (date-time) | null | no | — |
behaviourAcknowledgementVersion | string | null | no | — |
ProvisionRegistrationEnvelopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
wrappedUmk | string | null | no | — |
ProvisionRegistrationEnvelopeResponse
| Property | Type | Required | Description |
|---|---|---|---|
requestedAt | string (date-time) | no | — |
sagaId | string (uuid) | no | — |
status | string | null | no | — |
RebindAfterBiometricMismatchRequest
| Property | Type | Required | Description |
|---|---|---|---|
assuranceRef | string | null | no | — |
authTag | string | null | no | — |
deviceId | string | null | no | — |
deviceName | string | null | no | — |
deviceType | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
publicKey | string | null | no | — |
revokePreviousDevice | boolean | no | — |
wrappedUmk | string | null | no | — |
RecordBreakGlassConsentRequest
| Property | Type | Required | Description |
|---|---|---|---|
granteeId | string (uuid) | no | — |
granteeLabel | string | null | no | — |
granteeType | string | null | no | — |
holderLabel | string | null | no | — |
legalBasis | string | null | no | — |
purpose | string | null | no | — |
scopeCategories | string[] | null | no | — |
tenantId | string (uuid) | null | no | — |
windowEnd | string (date-time) | null | no | — |
windowStart | string (date-time) | no | — |
RecordEmergencyCardReadRequest
| Property | Type | Required | Description |
|---|---|---|---|
channel | string | null | no | — |
disclosureLevel | string | null | no | — |
instanceId | string (uuid) | no | — |
nominatedContactUserIds | (string (uuid))[] | null | no | — |
occurredAt | string (date-time) | null | no | — |
responderType | string | null | no | — |
subjectUserId | string (uuid) | no | — |
RecoveryRewrapRequest
| Property | Type | Required | Description |
|---|---|---|---|
authHashUpdate | AuthHashUpdateRequest | no | — |
authTag | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
wrappedUmk | string | null | no | — |
RecoveryRewrapResponse
| Property | Type | Required | Description |
|---|---|---|---|
recoveryEnrolmentTicket | string | null | no | — |
requestedAt | string (date-time) | no | — |
sagaId | string (uuid) | no | — |
status | string | null | no | — |
RecoverySessionResponse
| Property | Type | Required | Description |
|---|---|---|---|
absoluteExpiresAt | string (date-time) | no | — |
canExtend | boolean | no | — |
configId | string (uuid) | null | no | — |
effectiveDeadline | string (date-time) | no | — |
expiresAt | string (date-time) | no | — |
extensionCount | integer (int32) | no | — |
extensionsRemaining | integer (int32) | no | — |
id | string (uuid) | no | — |
initiatedAt | string (date-time) | no | — |
status | string | null | no | — |
userId | string (uuid) | no | — |
RegisterDeviceRequest
| Property | Type | Required | Description |
|---|---|---|---|
deviceFingerprint | string | null | no | — |
deviceName | string | null | no | — |
deviceType | string | null | no | — |
publicKey | string | null | no | — |
RehearsalGateResultDto
| Property | Type | Required | Description |
|---|---|---|---|
detail | string | null | no | — |
gate | string | null | no | — |
passed | boolean | no | — |
RekeyMajorityTransitionRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
transitionId | string (uuid) | no | — |
wrappedUmk | string | null | no | — |
RekeyMajorityTransitionResponse
| Property | Type | Required | Description |
|---|---|---|---|
keyGeneration | string | null | no | — |
rekeyedAt | string (date-time) | no | — |
transitionId | string (uuid) | no | — |
version | integer (int32) | no | — |
ReleaseExecutorBequestRequest
| Property | Type | Required | Description |
|---|---|---|---|
bequestId | string (uuid) | no | — |
estateGrantId | string (uuid) | no | — |
ReleaseExecutorBequestResponse
| Property | Type | Required | Description |
|---|---|---|---|
availableItemCount | integer (int32) | no | — |
bequestId | string (uuid) | no | — |
releasedAt | string (date-time) | null | no | — |
status | string | null | no | — |
ReleaseMergeRewrapRequest
| Property | Type | Required | Description |
|---|---|---|---|
deviceId | string | null | no | — |
reason | string | null | no | — |
RequestEscrowReconstructionRequest
| Property | Type | Required | Description |
|---|---|---|---|
enrolmentId | string | null | no | — |
justification | string | null | no | — |
requesterPublicKeyJwk | string | null | no | — |
requestingOrgId | string (uuid) | no | — |
resolveHereOnly | boolean | no | — |
subjectUserId | string (uuid) | null | no | — |
vaultCategory | string | null | no | — |
ResponderHolderListResponse
| Property | Type | Required | Description |
|---|---|---|---|
holders | ResponderHolderResponse[] | null | no | — |
nextCursor | string (date-time) | null | no | — |
ResponderHolderResponse
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
credentialedClasses | string[] | null | no | — |
credentialedResponders | CredentialedResponderSummary[] | null | no | — |
enrolmentAdminId | string (uuid) | no | — |
holderId | string | null | no | — |
holderRole | string | null | no | — |
organisationId | string (uuid) | no | — |
revokedAt | string (date-time) | null | no | — |
status | string | null | no | — |
tenantId | string (uuid) | null | no | — |
RespondToPairingRequest
| Property | Type | Required | Description |
|---|---|---|---|
challengeSolution | string | null | no | — |
deviceBId | string (uuid) | no | — |
deviceBPublicKey | string | null | no | — |
deviceBSigningKeyJwk | string | null | no | — |
deviceFriendlyName | string | null | no | — |
deviceProvenance | string | null | no | — |
RevealAllBequeathedCredentialsResponse
| Property | Type | Required | Description |
|---|---|---|---|
bequestId | string (uuid) | no | — |
items | RevealedBequeathedCredentialResponse[] | null | no | — |
RevealedBequeathedCredentialResponse
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
executorKeyRef | string | null | no | — |
itemId | string | null | no | — |
itemName | string | null | no | — |
iv | string | null | no | — |
revealCount | integer (int32) | no | — |
revealedAt | string (date-time) | no | — |
sealedSecret | string | null | no | — |
RevokeEmergencyAccessBySignedLinkRequest
| Property | Type | Required | Description |
|---|---|---|---|
expiresAtUnix | integer (int64) | no | — |
sessionId | string (uuid) | no | — |
signature | string | null | no | — |
userId | string (uuid) | no | — |
RevokeEmergencyAccessBySignedLinkResponse
| Property | Type | Required | Description |
|---|---|---|---|
alreadyEnded | boolean | no | — |
endedAs | string | null | no | — |
endedAt | string (date-time) | null | no | — |
revoked | boolean | no | — |
RevokeEscrowEnrolmentRequest
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | — |
RevokeWipeAttestationRequest
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | — |
RewrapWrappedUmkEnvelopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
postRecoveryBypass | boolean | no | — |
wrappedUmk | string | null | no | — |
RewrapWrappedUmkEnvelopeResponse
| Property | Type | Required | Description |
|---|---|---|---|
updatedAt | string (date-time) | no | — |
version | integer (int32) | no | — |
RotateApproverPinRequest
| Property | Type | Required | Description |
|---|---|---|---|
attestation | string | null | no | — |
credentialPin | string | null | no | — |
tenantId | string (uuid) | null | no | — |
RotateDeviceKeyExchangeKeyRequest
| Property | Type | Required | Description |
|---|---|---|---|
publicKey | string | null | no | — |
RotationEnvelopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersRequest | no | — |
wrappedUmk | string | null | no | — |
RotationPasskeyRewrapRequest
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
passkeyCredentialId | string | null | no | — |
prfInput | string | null | no | — |
wrappedUmk | string | null | no | — |
SealExecutorBequestRequest
| Property | Type | Required | Description |
|---|---|---|---|
estateGrantId | string (uuid) | no | — |
executorUserId | string (uuid) | no | — |
items | BequeathedCredentialItemDto[] | null | no | — |
triggerLabel | string | null | no | — |
SealExecutorBequestResponse
| Property | Type | Required | Description |
|---|---|---|---|
bequestId | string (uuid) | no | — |
createdAt | string (date-time) | no | — |
executorUserId | string (uuid) | no | — |
itemCount | integer (int32) | no | — |
status | string | null | no | — |
SecureWipeDeviceRequest
| Property | Type | Required | Description |
|---|---|---|---|
attesterClass | string | null | no | — |
attesterLabel | string | null | no | — |
confirmationAcknowledged | boolean | no | — |
signatureAlgorithm | string | null | no | — |
signatureThumbprint | string | null | no | — |
wipeStandardClaimed | string | null | no | — |
SetAlternatePassphraseStatusRequest
| Property | Type | Required | Description |
|---|---|---|---|
behaviourAcknowledgementVersion | string | null | no | — |
provisioned | boolean | no | — |
SetBackupVaultStatusRequest
| Property | Type | Required | Description |
|---|---|---|---|
lastReviewedAt | string (date-time) | null | no | — |
present | boolean | no | — |
SetBreakGlassConsentHolderLabelRequest
| Property | Type | Required | Description |
|---|---|---|---|
holderLabel | string | null | no | — |
SignalUnlockResolutionRequest
| Property | Type | Required | Description |
|---|---|---|---|
duressChannel | string | null | no | — |
kind | string | null | no | — |
SignalUnlockResolutionResponse
| Property | Type | Required | Description |
|---|---|---|---|
status | string | null | no | — |
SubmitDeviceIntegrityAssertionRequest
| Property | Type | Required | Description |
|---|---|---|---|
assertionObject | string | null | no | — |
keyId | string | null | no | — |
nonce | string | null | no | — |
platform | string | null | no | — |
SubmitDeviceIntegrityAttestationRequest
| Property | Type | Required | Description |
|---|---|---|---|
attestationObject | string | null | no | — |
integrityToken | string | null | no | — |
keyId | string | null | no | — |
nonce | string | null | no | — |
platform | string | null | no | — |
UpdateBreakGlassConsentScopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
scopeCategories | string[] | null | no | — |
UpsertUserPrivateKeyEnvelopeRequest
| Property | Type | Required | Description |
|---|---|---|---|
algo | string | null | no | — |
ciphertext | string | null | no | — |
iv | string | null | no | — |
keyEpoch | integer (int32) | no | — |
UserPrivateKeyEnvelopeResponse
| Property | Type | Required | Description |
|---|---|---|---|
algo | string | null | no | — |
ciphertext | string | null | no | — |
iv | string | null | no | — |
keyEpoch | integer (int32) | no | — |
VerifyBiometricMismatchFallbackRequest
| Property | Type | Required | Description |
|---|---|---|---|
recoveryCode | string | null | no | — |
WipeAttestationResponse
| Property | Type | Required | Description |
|---|---|---|---|
algorithm | string | null | no | — |
attestationDigest | string | null | no | — |
attestationId | string (uuid) | no | — |
attesterClass | string | null | no | — |
attesterLabel | string | null | no | — |
deviceId | string (uuid) | no | — |
deviceIdentifier | string | null | no | — |
deviceName | string | null | no | — |
isRevoked | boolean | no | — |
revocationReason | string | null | no | — |
revokedAt | string (date-time) | null | no | — |
signatureAlgorithm | string | null | no | — |
signatureThumbprint | string | null | no | — |
statement | string | null | no | — |
wipeStandardClaimed | string | null | no | — |
wipedAt | string (date-time) | no | — |
WrappedUmkEnvelopeDto
| Property | Type | Required | Description |
|---|---|---|---|
authTag | string | null | no | — |
iv | string | null | no | — |
kdf | KdfParametersDto | no | — |
keyGeneration | string | null | no | — |
kind | string | null | no | — |
manifestAuthTag | string | null | no | — |
manifestIv | string | null | no | — |
passkeyCredentialId | string | null | no | — |
sealedManifest | string | null | no | — |
wrappedUmk | string | null | no | — |