{"file":"docs/seed/API_Request_Format.txt","start":5,"end":46,"lines":[{"number":5,"text":"Use a fixed, versioned signing input:"},{"number":6,"text":""},{"number":7,"text":"CRE8-REQUEST-V1"},{"number":8,"text":"credential_id:<credential-id>"},{"number":9,"text":"component_version:<version>"},{"number":10,"text":"method:<uppercase-method>"},{"number":11,"text":"path:<normalized-path>"},{"number":12,"text":"query_hash:<sha256-of-normalized-query>"},{"number":13,"text":"body_hash:<sha256-of-exact-body-bytes>"},{"number":14,"text":"timestamp:<unix-seconds>"},{"number":15,"text":"nonce:<random-base64url>"},{"number":16,"text":"audience:<cre8-api-origin>"},{"number":17,"text":""},{"number":18,"text":"The client signs those exact bytes with the authentication private key."},{"number":19,"text":""},{"number":20,"text":"Suggested headers:"},{"number":21,"text":""},{"number":22,"text":"CRE8-Credential-ID"},{"number":23,"text":"CRE8-Component-Version"},{"number":24,"text":"CRE8-Timestamp"},{"number":25,"text":"CRE8-Nonce"},{"number":26,"text":"CRE8-Body-Digest"},{"number":27,"text":"CRE8-Auth-Signature"},{"number":28,"text":"CRE8-Purpose-Signature"},{"number":29,"text":""},{"number":30,"text":"The server must:"},{"number":31,"text":""},{"number":32,"text":"Parse with strict size limits."},{"number":33,"text":"Locate the public authentication component."},{"number":34,"text":"Reject unknown or inactive versions."},{"number":35,"text":"Check the timestamp window."},{"number":36,"text":"atomically record the nonce."},{"number":37,"text":"Reject repeated nonces."},{"number":38,"text":"Recalculate the body digest."},{"number":39,"text":"Verify the authentication signature."},{"number":40,"text":"Verify a purpose signature where required."},{"number":41,"text":"Evaluate effective permissions."},{"number":42,"text":"Apply limits."},{"number":43,"text":"Record the authorization decision."},{"number":44,"text":"Execute the operation."},{"number":45,"text":""},{"number":46,"text":"For signed policy documents and authorship metadata, use a deterministic representation such as JSON Canonicalization Scheme. JCS exists specifically to produce invariant JSON representations suitable for hashing and signing."}]}