{"file":"docs/seed/API_Request_Format.txt","start":1,"end":18,"lines":[{"number":1,"text":"API request format"},{"number":2,"text":""},{"number":3,"text":"Do not sign arbitrary serialized JSON directly."},{"number":4,"text":""},{"number":5,"text":"Use a fixed, versioned signing input:"},{"number":6,"text":""},{"number":7,"text":"CRE8-REQUEST-V1"},{"number":8,"text":"credential_id:<credential-id>"},{"number":9,"text":"component_version:<version>"},{"number":10,"text":"method:<uppercase-method>"},{"number":11,"text":"path:<normalized-path>"},{"number":12,"text":"query_hash:<sha256-of-normalized-query>"},{"number":13,"text":"body_hash:<sha256-of-exact-body-bytes>"},{"number":14,"text":"timestamp:<unix-seconds>"},{"number":15,"text":"nonce:<random-base64url>"},{"number":16,"text":"audience:<cre8-api-origin>"},{"number":17,"text":""},{"number":18,"text":"The client signs those exact bytes with the authentication private key."}]}