Shamir Recovery Service API
API for Shamir Secret Sharing key recovery workflows. All endpoints require a Bearer token (SEC-001).
Generated from the ShamirRecovery service's code at build time (api-specs/generated/ShamirRecovery/Essence.Core.ShamirRecovery.Api.json) and drift-checked in CI. It describes what the code registers, which is not the same as what any one deployment has routed.
GuardianAttestation
/api/v1/recovery/attest/{token}Loads an attestation challenge by its single-use token (FR-01.083a). The attestation page (essence-web `/recovery/guardian/attest`) calls this on load; the server stamps the page-loaded observation, records the first load as `attestation-page-loaded` on the recovery audit chain, and returns the bound nonce + expiry.
SEC-001/002 exception — see the controller remarks.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
token | path | string | yes | — |
Request body
No request body.
Responses
GuardianAttestationChallengeResponseProblemDetailsProblemDetails/api/v1/recovery/attest/{token}Submits a guardian attestation (FR-01.083 / FR-01.083a): the client-derived Ed25519 signature over the challenge nonce. The server verifies it against the share's enrolled public key.
SEC-001/002 exception — see the controller remarks. Zero-knowledge: only the signature is submitted.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
token | path | string | yes | — |
Request body
Not marked as required in the document.
SubmitGuardianAttestationRequestasapplication/*+json,application/json,text/json
Responses
GuardianAttestationResultResponseProblemDetailsProblemDetailsProblemDetailsInternalRecoveryCustody
/api/v1/internal/recovery/custody/{userId}Whether the subject still holds startable recovery material.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | path | string (uuid) | yes | The subject to answer about. |
Request body
No request body.
Responses
RecoveryCustodyPostureResultProblemDetailsRecoveryConfiguration
/api/v1/recovery/configurationLists all recovery configurations for the authenticated user.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
RecoveryConfigurationResponse[]ProblemDetails/api/v1/recovery/configurationCreates a new recovery configuration for a user.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateRecoveryConfigurationRequestasapplication/*+json,application/json,text/json
Responses
RecoveryConfigurationResponseProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/configuration/nominationsNominates the named people who will hold this user's recovery shares (FR-01.079), creating the recovery configuration when the caller does not yet have one, and dispatching each nominee's invitation (FR-01.070).
The scheme-only M:Essence.Core.ShamirRecovery.Api.Controllers.RecoveryConfigurationController.CreateRecoveryConfiguration(Essence.Core.ShamirRecovery.Contracts.Requests.CreateRecoveryConfigurationRequest,Essence.Core.ShamirRecovery.Application.Services.IRecoverySettingsStepUpGate,System.Threading.CancellationToken) endpoint records <em>how many</em> shares exist but nothing about <em>who</em> holds them, and share generation requires a checksum and an account id per guardian — so before this endpoint a user's chosen contacts had nowhere to be recorded. Zero-knowledge: only scheme parameters and contact metadata cross the wire; shares are split and wrapped on the device.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
NominateRecoveryContactsRequestasapplication/*+json,application/json,text/json
Responses
RecoveryContactNominationResponseProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/configuration/redistributedRegisters a new-generation recovery configuration in the non-serving `Distributed` state during post-rotation share redistribution (FR-01.068 / AC-01.061). The caller's existing `Active` configuration keeps serving recovery sessions until the new shares reach the k-of-n threshold and are atomically promoted.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RegisterRedistributedRecoveryConfigurationRequestasapplication/*+json,application/json,text/json
Responses
RecoveryConfigurationResponseProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/configuration/redistributed/promoteRecords the client-verified established-share count for a `Distributed` configuration and, when the k-of-n threshold is reached, performs the FR-01.068 atomic swap (AC-01.061): the new configuration is promoted to `Active` and the previously-active configuration is invalidated in a single transaction. If the threshold is not met, the old configuration is retained as the read-valid fallback and a recovery-degraded warning is emitted.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
PromoteRedistributedRecoveryConfigurationRequestasapplication/*+json,application/json,text/json
Responses
PromoteRedistributedRecoveryConfigurationResultProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/configuration/resolveResolves the address a locked-out reader typed into the `recoveryConfigurationId` that `POST /api/v1/recovery/initiate` requires (debt-2026-08-15-106, journey `account-recovery-lost-devices`).
<b>Always HTTP 200, and deliberately so.</b> Someone who has lost every device holds no session and no user id, so this is necessarily an unauthenticated read against the platform's highest-risk surface — which means it must not become a membership oracle. Unknown account, known account with no recovery configuration, and configuration-not-startable all return the SAME body: `{ resolved: false, recoveryConfigurationId: null }`. A 404 for one of them would be exactly the signal being withheld. <b>Rate-limited by IP</b> (SEC-004) at the same cap as recovery initiation, since there is no principal to partition by; and the address is never a log field on any path.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ResolveRecoveryConfigurationRequestasapplication/*+json,application/json,text/json
Responses
RecoveryConfigurationResolutionResponseProblemDetails/api/v1/recovery/configuration/{configId}Updates an existing recovery configuration's threshold scheme.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
configId | path | string (uuid) | yes | Recovery configuration identifier |
Request body
Not marked as required in the document.
UpdateRecoveryConfigurationRequestasapplication/*+json,application/json,text/json
Responses
RecoveryConfigurationResponseProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/configuration/{configId}Deactivates a recovery configuration (soft delete per DAT-002).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
configId | path | string (uuid) | yes | Recovery configuration identifier |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/recovery/configuration/{userId}Gets the authenticated caller's recovery configuration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | path | string (uuid) | yes | Route value retained for backward-compatible URLs (and the M:Essence.Core.ShamirRecovery.Api.Controllers.RecoveryConfigurationController.CreateRecoveryConfiguration(Essence.Core.ShamirRecovery.Contracts.Requests.CreateRecoveryConfigurationRequest,Essence.Core.ShamirRecovery.Application.Services.IRecoverySettingsStepUpGate,System.Threading.CancellationToken) Location header). It is ignored: the configuration returned is always the caller's own, resolved from the JWT principal. |
Request body
No request body.
Responses
RecoveryConfigurationResponseProblemDetailsRecoveryEnrolmentPosture
/api/v1/internal/recovery-enrolment/events/lookupThe recovery-attempt lifecycle events of the named users in an inclusive window (#22121): `Initiated` at each initiation, `Completed` or `Failed` at each termination.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RecoveryLifecycleEventLookupRequestasapplication/*+json,application/json,text/json
Responses
RecoveryLifecycleEvent[]ProblemDetailsProblemDetailsProblemDetails/api/v1/internal/recovery-enrolment/guardian-links/lookupWhich of the named members depend on which of the named guardians, one edge per (guardian, member) whose share on the member's startable configuration can contribute (#22122).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RecoveryGuardianLinkLookupRequestasapplication/*+json,application/json,text/json
Responses
RecoveryGuardianLink[]ProblemDetailsProblemDetailsProblemDetails/api/v1/internal/recovery-enrolment/posture/lookupThe recovery enrolment posture of each named user, one row per distinct user.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RecoveryEnrolmentPostureLookupRequestasapplication/*+json,application/json,text/json
Responses
RecoveryEnrolmentPosture[]ProblemDetailsProblemDetailsProblemDetailsRecoveryEnrolmentSelfServiceLink
/api/v1/internal/recovery-enrolment/self-service-linkSends the member a link that starts their own guardian recovery.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
SelfServiceRecoveryLinkRequestasapplication/*+json,application/json,text/json
Responses
SelfServiceRecoveryLinkResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetailsRecoveryWorkflow
/api/v1/recovery/attempts/dry-runReads the caller's current recovery dry run (#4718).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
RecoveryDryRunResponseProblemDetailsProblemDetails/api/v1/recovery/attempts/dry-runExtracts the authenticated user identifier from the JWT principal. Reads the standard `NameIdentifier` / `sub` claims. Returns false when no authenticated user id is present or it is not a GUID, so callers can short-circuit with 401 rather than trusting request input (A01 IDOR hardening, sf-2026-05-26-006 / sf-2026-05-26-009).
Nothing is reconstructed and no share is collected. The rehearsal has no transport key, so there is no path from here to key material — the impossibility is structural rather than checked.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
RecoveryDryRunResponseProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/attempts/dry-run/cancelStops the caller's dry run early (#4718).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
RecoveryDryRunResponseProblemDetailsProblemDetails/api/v1/recovery/attempts/{attemptId}Gets a recovery attempt by its ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
attemptId | path | string (uuid) | yes | Recovery attempt identifier |
Request body
No request body.
Responses
RecoveryInitiationQuorumResponseProblemDetails/api/v1/recovery/attempts/{attemptId}/guardian-contextServes a token-bearing guardian the request context they need in order to re-wrap their share under FR-01.062 (debt-2026-08-15-107): who is asking, when they asked, which share this link is for, and the recovering device's transport public key to wrap to.
<b>This read does NOT consume the token.</b> The submission it precedes needs the same single-use token, so spending it here would make the read fatal to the write it exists to enable. Replay is still reported (409) — the ledger is read, never written — and `POST submit-share/by-guardian-token` remains the sole atomic authority for single-use. <b>Zero-knowledge.</b> Display name only, never an email; no guardian roster, no other guardian's state. The recovering user's own screen anonymises their guardians (Decision D-254), and this must not disclose more to a third party than to the account holder.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
attemptId | path | string (uuid) | yes | The recovery attempt the token is bound to. |
X-Guardian-Token | header | string | no | The per-share bearer token (header). |
Request body
No request body.
Responses
GuardianRecoveryContextResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/audit/verifyVerifies the tamper-evident social-recovery audit chain (FR-01.040). Re-computes every entry's hash and confirms the forward-only chain is contiguous, so a stakeholder/auditor can detect any historical edit. An optional sessionId scopes the check to a single recovery session's subchain; omit it to verify the whole chain from genesis.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
sessionId | query | string (uuid) | no | Optional recovery-session scope; verifies the full chain when null. |
Request body
No request body.
Responses
RecoveryAuditChainVerificationResponse/api/v1/recovery/configuration/{configId}/guardians/invitationRecords a guardian's FR-01.070 invitation accept/decline decision, authenticated by an FR-01.007a guardian <b>invitation-acceptance</b> bearer token (debt-2026-06-21-1423) — the path an <b>email-only guardian</b> (no Essence account session) uses. The token is carried in the `X-Guardian-Token` header and is HMAC-bound to `{guardianIdentity, configurationId, nominatedShareIndices}`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
configId | path | string (uuid) | yes | Recovery configuration the nomination belongs to (token-bound). |
X-Guardian-Token | header | string | no | The invitation-acceptance bearer token (header). |
Request body
Not marked as required in the document.
RespondToGuardianInvitationRequestasapplication/*+json,application/json,text/json
Responses
RespondToGuardianInvitationResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/guardians/invitation-contextReads what design board 4d must show a nominated guardian before they answer — who the scheme belongs to, what they would hold, and how many others hold a share — authenticated by the FR-01.007a <b>invitation-acceptance</b> token WITHOUT consuming it (#5723).
<b>This read does NOT consume the token.</b> The accept/decline it precedes needs the same single-use token, so spending it to render the page would make answering impossible. Replay is still reported (409) — the ledger is read, never written — and `POST configuration/{configId}/guardians/invitation` remains the sole atomic authority for single-use. Exactly the split the share-submission pair already makes. <b>The route takes no ids.</b> Everything is derived from the token's MAC-trusted claims: a reader holding only an emailed link asserts no identity and must not be able to name a configuration of their own. That also keeps the emailed URL to a single `?token=` parameter, which is what the notification can actually construct. <b>Zero-knowledge.</b> The arrangement, never the vault: no document count, no field name, nothing derived from contents, and a COUNT of the other holders rather than a roster — board 4b's promise that a guardian never learns "who the other guardians are".
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Guardian-Token | header | string | no | The invitation-acceptance bearer token (header). |
Request body
No request body.
Responses
GuardianInvitationContextResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/guardians/recovery-contextThe same guardian request context, for a guardian holding ONLY the token — which is all the approval email (board 7g) can carry (#12292). The recovery attempt, the guardian identity and the share index all come from the token's MAC-trusted claims, and the response hands back the attempt id, identity and provenance id the submission needs.
The emailed link was `/recovery/guardian/submit?token=` while the page required four further parameters no producer could supply, so every real approval email dead-ended. The route takes no ids for the reason M:Essence.Core.ShamirRecovery.Api.Controllers.RecoveryWorkflowController.GetGuardianInvitationContext(System.String,System.Threading.CancellationToken) takes none: a reader holding only a link asserts no identity and must not be able to name a recovery of their own. <b>This read does NOT consume the token</b>; replay is reported (409), never caused.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Guardian-Token | header | string | no | The per-share bearer token (header). |
Request body
No request body.
Responses
GuardianRecoveryContextResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/initiateInitiates a key recovery attempt.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
InitiateRecoveryRequestasapplication/*+json,application/json,text/json
Responses
RecoveryInitiationQuorumResponseRecoveryAttemptResponseProblemDetailsProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/initiation-quorums/{quorumId}Gets a recovery attempt by its ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
quorumId | path | string (uuid) | yes | FR-01.103 initiation-quorum id, on the `initiation-quorums/{quorumId}` route only. |
Request body
No request body.
Responses
RecoveryInitiationQuorumResponseProblemDetails/api/v1/recovery/reconstructReconstructs the secret from submitted shares. CRITICAL: Returns shares to the client for client-side reconstruction. Two phases since #17586: a relay (the default) returns the shares and KEEPS them; a confirm (`"confirm": true`) completes the attempt and erases them.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ReconstructSecretRequestasapplication/*+json,application/json,text/json
Responses
ReconstructSecretResponseProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/recovery/rehearseRehearses (dry-runs) a reconstruction without reconstructing the secret. CRITICAL: returns only a readiness verdict — no share material, no UMK unwrap, no data release. This is the EPIC 18 → EPIC 1 pre-mortem seam (journey executor-plan-pre-mortem-rehearsal-dry-run, debt-2026-06-18-295). The rehearsal emits an auditable RecoveryRehearsalCompletedIntegrationEvent (run-type=rehearsal) asserting the zero-knowledge boundary held.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RehearseReconstructionRequestasapplication/*+json,application/json,text/json
Responses
RehearseReconstructionResponseProblemDetailsProblemDetailsProblemDetailsShareManagement
Schemas
CreateRecoveryConfigurationRequest
| Property | Type | Required | Description |
|---|---|---|---|
schemeType | string | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
EnrolGuardianAttestationKeyRequest
| Property | Type | Required | Description |
|---|---|---|---|
attestationPublicKey | string | null | no | — |
GuardianAttestationChallengeResponse
| Property | Type | Required | Description |
|---|---|---|---|
challengeNonce | string | null | no | — |
expiresAt | string (date-time) | no | — |
purpose | string | null | no | — |
token | string | null | no | — |
GuardianAttestationResultResponse
| Property | Type | Required | Description |
|---|---|---|---|
nextAttestationDueAt | string (date-time) | null | no | — |
verified | boolean | no | — |
GuardianInvitationContextResponse
| Property | Type | Required | Description |
|---|---|---|---|
configurationId | string (uuid) | no | — |
expiresAt | string (date-time) | no | — |
guardianDisplayName | string | null | no | — |
guardianIdentity | string | null | no | — |
invitationStatus | string | null | no | — |
nominatedAt | string (date-time) | null | no | — |
otherGuardiansCount | integer (int32) | no | — |
requesterDisplayName | string | null | no | — |
requesterUserId | string (uuid) | no | — |
shareIndex | integer (int32) | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
GuardianRecoveryContextResponse
| Property | Type | Required | Description |
|---|---|---|---|
guardianIdentity | string | null | no | — |
initiatedAt | string (date-time) | no | — |
recoveryAttemptId | string (uuid) | no | — |
recoveryTransportPublicKeyJwk | RsaPublicKeyJwk | no | — |
requesterDisplayName | string | null | no | — |
shareIndex | integer (int32) | no | — |
submittedByContactId | string (uuid) | no | — |
InitiateRecoveryRequest
| Property | Type | Required | Description |
|---|---|---|---|
guardianQuorumId | string (uuid) | null | no | — |
recoveryConfigurationId | string (uuid) | no | — |
recoveryTransportPublicKey | string | null | no | — |
requestGuardianQuorum | boolean | no | — |
stepUpToken | string | null | no | — |
withdrawGuardianQuorumId | string (uuid) | null | no | — |
NominateRecoveryContactsRequest
| Property | Type | Required | Description |
|---|---|---|---|
contacts | RecoveryContactNominationInput[] | null | no | — |
schemeType | string | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
ProblemDetails
| Property | Type | Required | Description |
|---|---|---|---|
detail | string | null | no | — |
instance | string | null | no | — |
status | integer (int32) | null | no | — |
title | string | null | no | — |
type | string | null | no | — |
PromoteRedistributedRecoveryConfigurationRequest
| Property | Type | Required | Description |
|---|---|---|---|
establishedShareCount | integer (int32) | no | — |
newConfigurationId | string (uuid) | no | — |
PromoteRedistributedRecoveryConfigurationResult
| Property | Type | Required | Description |
|---|---|---|---|
activeConfigurationId | string (uuid) | no | — |
establishedShareCount | integer (int32) | no | — |
invalidatedConfigurationId | string (uuid) | no | — |
newConfigurationId | string (uuid) | no | — |
swapped | boolean | no | — |
threshold | integer (int32) | no | — |
userId | string (uuid) | no | — |
ReconstructSecretRequest
| Property | Type | Required | Description |
|---|---|---|---|
confirm | boolean | no | — |
recoveringDeviceFingerprint | string | null | no | — |
recoveryAttemptId | string (uuid) | no | — |
ReconstructSecretResponse
| Property | Type | Required | Description |
|---|---|---|---|
accessToken | string | null | no | — |
alreadyConfirmed | boolean | no | — |
completedAt | string (date-time) | no | — |
confirmed | boolean | no | — |
recoveryAttemptId | string (uuid) | no | — |
refreshToken | string | null | no | — |
refreshTokenExpiresAt | string (date-time) | null | no | — |
sessionExpiresAt | string (date-time) | null | no | — |
shares | SubmittedShareDto[] | null | no | — |
sharesHeld | boolean | no | — |
sharesReturned | integer (int32) | no | — |
success | boolean | no | — |
RecoveryAttemptResponse
| Property | Type | Required | Description |
|---|---|---|---|
anchorConfirmed | boolean | null | no | — |
assuranceLevel | string | null | no | — |
completedAt | string (date-time) | null | no | — |
hasSufficientShares | boolean | no | — |
id | string (uuid) | no | — |
initiatedAt | string (date-time) | no | — |
ipAddress | string | null | no | — |
recoveryConfigurationId | string (uuid) | no | — |
recoveryTransportPublicKey | string | null | no | — |
relayedAt | string (date-time) | null | no | — |
sharesHeld | boolean | no | — |
sharesSubmitted | integer (int32) | no | — |
status | string | null | no | — |
thresholdRequired | integer (int32) | no | — |
userAgent | string | null | no | — |
userId | string (uuid) | no | — |
RecoveryAuditChainPrefixResponse
| Property | Type | Required | Description |
|---|---|---|---|
anchorEntryId | string (uuid) | no | — |
declaredAt | string (date-time) | no | — |
declaredEntries | integer (int32) | null | no | — |
entriesBeforeAnchor | integer (int32) | no | — |
reason | string | null | no | — |
verdict | string | null | no | — |
RecoveryAuditChainVerificationResponse
| Property | Type | Required | Description |
|---|---|---|---|
entriesChecked | integer (int32) | no | — |
failureReason | string | null | no | — |
firstFailureEntryId | string (uuid) | null | no | — |
firstFailureIndex | integer (int32) | null | no | — |
isValid | boolean | no | — |
prefix | RecoveryAuditChainPrefixResponse | no | — |
RecoveryConfigurationResolutionResponse
| Property | Type | Required | Description |
|---|---|---|---|
recoveryConfigurationId | string (uuid) | null | no | — |
resolved | boolean | no | — |
RecoveryConfigurationResponse
| Property | Type | Required | Description |
|---|---|---|---|
acceptedContactCount | integer (int32) | no | — |
contacts | RecoveryContactStateDto[] | null | no | — |
createdAt | string (date-time) | no | — |
declinedContactCount | integer (int32) | no | — |
establishedShareCount | integer (int32) | no | — |
id | string (uuid) | no | — |
isActive | boolean | no | — |
lastUpdatedAt | string (date-time) | null | no | — |
nominatedContactCount | integer (int32) | no | — |
pendingContactCount | integer (int32) | no | — |
schemeType | string | null | no | — |
shareMetadata | ShareMetadataDto[] | null | no | — |
state | string | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
usableShareCount | integer (int32) | no | — |
userId | string (uuid) | no | — |
RecoveryContactNominationInput
| Property | Type | Required | Description |
|---|---|---|---|
distributionMethod | string | null | no | — |
email | string | null | no | — |
essenceAccountId | string (uuid) | null | no | — |
name | string | null | no | — |
phone | string | null | no | — |
RecoveryContactNominationResponse
| Property | Type | Required | Description |
|---|---|---|---|
configurationId | string (uuid) | no | — |
invitationsSentAtIso | string (date-time) | null | no | — |
nominations | RecoveryContactNominationState[] | null | no | — |
scheme | string | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
RecoveryContactNominationState
| Property | Type | Required | Description |
|---|---|---|---|
awaitingShareGeneration | boolean | no | — |
email | string | null | no | — |
guardianIdentityType | string | null | no | — |
invitationDispatchedAt | string (date-time) | null | no | — |
invitationStatus | string | null | no | — |
name | string | null | no | — |
shareIndex | integer (int32) | no | — |
shareMetadataId | string (uuid) | no | — |
RecoveryContactStateDto
| Property | Type | Required | Description |
|---|---|---|---|
accepted | boolean | no | — |
awaitingShareGeneration | boolean | no | — |
canContributeToRecovery | boolean | no | — |
contactEmail | string | null | no | — |
displayName | string | null | no | — |
guardianIdentityType | string | null | no | — |
invitationDispatched | boolean | no | — |
invitationStatus | string | null | no | — |
isInvalidated | boolean | no | — |
linkedEssenceAccountId | string (uuid) | null | no | — |
nominatedAt | string (date-time) | null | no | — |
respondedAt | string (date-time) | null | no | — |
shareIndexes | (integer (int32))[] | null | no | — |
RecoveryCustodyPostureResult
| Property | Type | Required | Description |
|---|---|---|---|
hasSurvivingConfiguration | boolean | no | — |
userId | string (uuid) | no | — |
RecoveryDryRunResponse
| Property | Type | Required | Description |
|---|---|---|---|
concludedAt | string (date-time) | null | no | — |
expiresAt | string (date-time) | no | — |
guardiansAsked | integer (int32) | no | — |
guardiansResponded | integer (int32) | no | — |
initiatedAt | string (date-time) | no | — |
noSecretReconstructed | boolean | no | — |
outcome | string | null | no | — |
rehearsalId | string (uuid) | no | — |
thresholdRequired | integer (int32) | no | — |
verdictMeaning | string | null | no | — |
RecoveryEnrolmentPosture
| Property | Type | Required | Description |
|---|---|---|---|
guardianCount | integer (int32) | no | — |
guardianRecentlyDeparted | boolean | no | — |
lastAttestationAt | string (date-time) | null | no | — |
thresholdRequired | integer (int32) | no | — |
userRef | string (uuid) | no | — |
RecoveryEnrolmentPostureLookupRequest
| Property | Type | Required | Description |
|---|---|---|---|
userRefs | (string (uuid))[] | null | no | — |
RecoveryGuardianLink
| Property | Type | Required | Description |
|---|---|---|---|
alreadyBelowThreshold | boolean | no | — |
guardianRef | string (uuid) | no | — |
userRef | string (uuid) | no | — |
RecoveryGuardianLinkLookupRequest
| Property | Type | Required | Description |
|---|---|---|---|
guardianRefs | (string (uuid))[] | null | no | — |
userRefs | (string (uuid))[] | null | no | — |
RecoveryInitiationQuorumResponse
| Property | Type | Required | Description |
|---|---|---|---|
expiresAt | string (date-time) | no | — |
guardiansAsked | integer (int32) | no | — |
guardiansConfirmed | integer (int32) | no | — |
id | string (uuid) | no | — |
recoveryAttemptId | string (uuid) | null | no | — |
recoveryConfigurationId | string (uuid) | no | — |
requestedAt | string (date-time) | no | — |
status | string | null | no | — |
thresholdMet | boolean | no | — |
thresholdRequired | integer (int32) | no | — |
RecoveryLifecycleEvent
| Property | Type | Required | Description |
|---|---|---|---|
id | string (uuid) | no | — |
occurredAt | string (date-time) | no | — |
outcome | string | null | no | — |
type | string | null | no | — |
userRef | string (uuid) | no | — |
RecoveryLifecycleEventLookupRequest
| Property | Type | Required | Description |
|---|---|---|---|
from | string (date-time) | no | — |
until | string (date-time) | no | — |
userRefs | (string (uuid))[] | null | no | — |
RegisterRedistributedRecoveryConfigurationRequest
| Property | Type | Required | Description |
|---|---|---|---|
schemeType | string | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |
RehearseReconstructionRequest
| Property | Type | Required | Description |
|---|---|---|---|
recoveryAttemptId | string (uuid) | no | — |
simulatedActorType | string | null | no | — |
RehearseReconstructionResponse
| Property | Type | Required | Description |
|---|---|---|---|
noDataReleased | boolean | no | — |
noUmkUnwrapped | boolean | no | — |
rehearsalSessionId | string (uuid) | no | — |
rehearsedAt | string (date-time) | no | — |
runType | string | null | no | — |
sharesAvailable | integer (int32) | no | — |
sharesRequired | integer (int32) | no | — |
simulatedActorType | string | null | no | — |
wouldReconstruct | boolean | no | — |
ResolveRecoveryConfigurationRequest
| Property | Type | Required | Description |
|---|---|---|---|
accountEmail | string | null | no | — |
RespondToGuardianInvitationRequest
| Property | Type | Required | Description |
|---|---|---|---|
accepted | boolean | no | — |
guardianIdentity | string | null | no | — |
RespondToGuardianInvitationResponse
| Property | Type | Required | Description |
|---|---|---|---|
accepted | boolean | no | — |
configurationId | string (uuid) | no | — |
guardianIdentity | string | null | no | — |
sharesAffected | integer (int32) | no | — |
RsaPublicKeyJwk
| Property | Type | Required | Description |
|---|---|---|---|
alg | string | null | no | — |
e | string | null | no | — |
ext | boolean | no | — |
key_ops | string[] | null | no | — |
kty | string | null | no | — |
n | string | null | no | — |
SelfServiceRecoveryLinkRequest
| Property | Type | Required | Description |
|---|---|---|---|
organizationId | string (uuid) | no | — |
userRef | string (uuid) | no | — |
SelfServiceRecoveryLinkResponse
| Property | Type | Required | Description |
|---|---|---|---|
sent | boolean | no | — |
SubmitGuardianAttestationRequest
| Property | Type | Required | Description |
|---|---|---|---|
attestationSignature | string | null | no | — |
UpdateRecoveryConfigurationRequest
| Property | Type | Required | Description |
|---|---|---|---|
schemeType | string | null | no | — |
threshold | integer (int32) | no | — |
totalShares | integer (int32) | no | — |