C8Human Guide

Source-qualified discovery inventory

Requests apis routes

Signing inputs, headers, verification, route families, authentication descriptions, and operation signatures.

Open raw data editor08-requests-apis-routes.json

Document context

How to read this page

Every value below mirrors the JSON document. Friendly labels and explanations add context without replacing the exact field name or recorded value. Follow any “raw record” link to inspect or edit the same data.

Schema versionschema_version

Version of the discovery-inventory document shape.

0.1.0
Catalogue statuscatalogue_status

Maturity of this catalogue data, not implementation status.

discovery_inventory
Authorityauthority

How this document may be used and what it must not be mistaken for.

Evidence-derived inventory; not a final implementation-governing SSOT. Preserve source modality and consult conflicts.json.
Categorycategory

Stable subject area used to organize the inventory.

requests_apis_routes
Descriptiondescription

Human-language explanation preserved by the inventory.

Signing inputs, headers, verification, route families, authentication descriptions, and operation signatures.

Structured collection

Items

8 top-level entries. Nested values are expanded inside each entry.

Open this raw section →

Protocol component

CRE8-REQUEST-V1 signing input

Open editable raw record →

Fixed versioned byte input signed by Authentication private key; arbitrary serialized JSON must not be signed directly.

What this represents

This entry is recorded as Protocol component in the Items section.

Statement status: Firm statement

The source states this firmly, rather than as a suggestion.

IdidStable catalogue identity. Ordinary edits should preserve it.
api.signing_input
NamenameRecorded inventory field; its exact name and structure are preserved.
CRE8-REQUEST-V1 signing input
KindkindStructural role of this entry within the catalogue.
protocol_component
DescriptiondescriptionHuman-language explanation preserved by the inventory.
Fixed versioned byte input signed by Authentication private key; arbitrary serialized JSON must not be signed directly.
ModalitymodalityStrength or status of the source statement.
firm_statement
SourcessourcesHistorical evidence supporting this inventory entry.
  1. docs/seed/API_Request_Format.txtlines 1-18 · open exact evidence
FieldsfieldsRecorded inventory field; its exact name and structure are preserved.
  1. credential_id
  2. component_version
  3. method uppercase
  4. normalized path
  5. SHA-256 normalized query hash
  6. SHA-256 exact-body hash
  7. Unix timestamp
  8. random base64url nonce
  9. CRE8 API origin audience

Protocol component

Suggested CRE8 headers

Open editable raw record →

Candidate request headers for credential, version, freshness, digest, and signatures.

What this represents

This entry is recorded as Protocol component in the Items section.

Statement status: Recommendation

This is recommended guidance rather than a final requirement.

IdidStable catalogue identity. Ordinary edits should preserve it.
api.headers
NamenameRecorded inventory field; its exact name and structure are preserved.
Suggested CRE8 headers
KindkindStructural role of this entry within the catalogue.
protocol_component
DescriptiondescriptionHuman-language explanation preserved by the inventory.
Candidate request headers for credential, version, freshness, digest, and signatures.
ModalitymodalityStrength or status of the source statement.
recommendation
SourcessourcesHistorical evidence supporting this inventory entry.
  1. docs/seed/API_Request_Format.txtlines 20-28 · open exact evidence
HeadersheadersRecorded inventory field; its exact name and structure are preserved.
  1. CRE8-Credential-ID
  2. CRE8-Component-Version
  3. CRE8-Timestamp
  4. CRE8-Nonce
  5. CRE8-Body-Digest
  6. CRE8-Auth-Signature
  7. CRE8-Purpose-Signature

Protocol flow

Server verification sequence

Open editable raw record →

Strict parsing, component lookup/status, freshness/replay/digest/signature checks, authorization/limits, decision record, execution.

What this represents

This entry is recorded as Protocol flow in the Items section.

Statement status: Firm statement

The source states this firmly, rather than as a suggestion.

IdidStable catalogue identity. Ordinary edits should preserve it.
api.verification
NamenameRecorded inventory field; its exact name and structure are preserved.
Server verification sequence
KindkindStructural role of this entry within the catalogue.
protocol_flow
DescriptiondescriptionHuman-language explanation preserved by the inventory.
Strict parsing, component lookup/status, freshness/replay/digest/signature checks, authorization/limits, decision record, execution.
ModalitymodalityStrength or status of the source statement.
firm_statement
SourcessourcesHistorical evidence supporting this inventory entry.
  1. docs/seed/API_Request_Format.txtlines 30-44 · open exact evidence
StepsstepsRecorded inventory field; its exact name and structure are preserved.
  1. Parse with strict size limits
  2. Locate authentication public component
  3. Reject unknown/inactive versions
  4. Check timestamp window
  5. Atomically record nonce
  6. Reject replay
  7. Recalculate body digest
  8. Verify Authentication signature
  9. Verify purpose signature when required
  10. Evaluate effective permissions
  11. Apply limits
  12. Record authorization decision
  13. Execute

Protocol component

Signed document canonicalization

Open editable raw record →

Deterministic representation such as JCS is proposed for policy documents and authorship metadata.

What this represents

This entry is recorded as Protocol component in the Items section.

Statement status: Recommendation

This is recommended guidance rather than a final requirement.

IdidStable catalogue identity. Ordinary edits should preserve it.
api.canonicalization
NamenameRecorded inventory field; its exact name and structure are preserved.
Signed document canonicalization
KindkindStructural role of this entry within the catalogue.
protocol_component
DescriptiondescriptionHuman-language explanation preserved by the inventory.
Deterministic representation such as JCS is proposed for policy documents and authorship metadata.
ModalitymodalityStrength or status of the source statement.
recommendation
SourcessourcesHistorical evidence supporting this inventory entry.
  1. docs/seed/API_Request_Format.txtlines 46 · open exact evidence

Route family

Public route surface

Open editable raw record →

Public routes listed as /, /health, /.well-known/jwks.json, /ui*, and authentication bootstrap routes.

What this represents

This entry is recorded as Route family in the Items section.

Statement status: Source description

This records how the historical source describes the system.

IdidStable catalogue identity. Ordinary edits should preserve it.
route.public
NamenameRecorded inventory field; its exact name and structure are preserved.
Public route surface
KindkindStructural role of this entry within the catalogue.
route_family
DescriptiondescriptionHuman-language explanation preserved by the inventory.
Public routes listed as /, /health, /.well-known/jwks.json, /ui*, and authentication bootstrap routes.
ModalitymodalityStrength or status of the source statement.
source_description
SourcessourcesHistorical evidence supporting this inventory entry.
  1. docs/seed/Composition_Dependencies.txtlines 40-42 · open exact evidence
RoutesroutesRecorded inventory field; its exact name and structure are preserved.
  1. /
  2. /health
  3. /.well-known/jwks.json
  4. /ui*
  5. auth bootstrap routes

Route family

Gateway route surface

Open editable raw record →

/api/* described as protected by key JWT, device header, and use-key constraints; conflicts with signed-request model.

What this represents

This entry is recorded as Route family in the Items section.

Statement status: Conflict

The evidence contains competing descriptions; this page does not choose a winner.

IdidStable catalogue identity. Ordinary edits should preserve it.
route.gateway
NamenameRecorded inventory field; its exact name and structure are preserved.
Gateway route surface
KindkindStructural role of this entry within the catalogue.
route_family
DescriptiondescriptionHuman-language explanation preserved by the inventory.
/api/* described as protected by key JWT, device header, and use-key constraints; conflicts with signed-request model.
ModalitymodalityStrength or status of the source statement.
conflict
SourcessourcesHistorical evidence supporting this inventory entry.
  1. docs/seed/Composition_Dependencies.txtlines 43 · open exact evidence
  2. docs/seed/Description.txtlines 24-34 · open exact evidence
RoutesroutesRecorded inventory field; its exact name and structure are preserved.
  1. /api/*

Route family

Console route surface

Open editable raw record →

/console/api/* described as owner-JWT protected; conflicts with opaque hashed Owner session source.

What this represents

This entry is recorded as Route family in the Items section.

Statement status: Conflict

The evidence contains competing descriptions; this page does not choose a winner.

IdidStable catalogue identity. Ordinary edits should preserve it.
route.console
NamenameRecorded inventory field; its exact name and structure are preserved.
Console route surface
KindkindStructural role of this entry within the catalogue.
route_family
DescriptiondescriptionHuman-language explanation preserved by the inventory.
/console/api/* described as owner-JWT protected; conflicts with opaque hashed Owner session source.
ModalitymodalityStrength or status of the source statement.
conflict
SourcessourcesHistorical evidence supporting this inventory entry.
  1. docs/seed/Composition_Dependencies.txtlines 44 · open exact evidence
  2. docs/seed/Sessions.txtlines 1-3 · open exact evidence
RoutesroutesRecorded inventory field; its exact name and structure are preserved.
  1. /console/api/*

Protocol matrix

Signature requirements by operation

Open editable raw record →

Operation-specific Authentication, Delegation, Authorship, Box-encryption, Owner, and step-up combinations.

What this represents

This entry is recorded as Protocol matrix in the Items section.

Statement status: Source description

This records how the historical source describes the system.

IdidStable catalogue identity. Ordinary edits should preserve it.
api.signature_matrix
NamenameRecorded inventory field; its exact name and structure are preserved.
Signature requirements by operation
KindkindStructural role of this entry within the catalogue.
protocol_matrix
DescriptiondescriptionHuman-language explanation preserved by the inventory.
Operation-specific Authentication, Delegation, Authorship, Box-encryption, Owner, and step-up combinations.
ModalitymodalityStrength or status of the source statement.
source_description
SourcessourcesHistorical evidence supporting this inventory entry.
  1. docs/seed/Signature_Requirements_By_Operation.txtlines 1-16 · open exact evidence
OperationsoperationsRecorded inventory field; its exact name and structure are preserved.
  1. Operationoperation
    Read an authorized resource
    Required components or authorityrequired_components_or_authority
    Authentication
    Source linesource_line
    3
  2. Operationoperation
    Create an ordinary resource
    Required components or authorityrequired_components_or_authority
    Authentication
    Source linesource_line
    4
  3. Operationoperation
    Publish authored material
    Required components or authorityrequired_components_or_authority
    Authentication + Authorship
    Source linesource_line
    5
  4. Operationoperation
    Issue a signed credential
    Required components or authorityrequired_components_or_authority
    Authentication + Authorship
    Source linesource_line
    6
  5. Operationoperation
    Send an encrypted message
    Required components or authorityrequired_components_or_authority
    Authentication; encryption occurs using recipient Box public key
    Source linesource_line
    7
  6. Operationoperation
    Mint a child Key
    Required components or authorityrequired_components_or_authority
    Authentication + Delegation
    Source linesource_line
    8
  7. Operationoperation
    Assign child permissions
    Required components or authorityrequired_components_or_authority
    Authentication + Delegation
    Source linesource_line
    9
  8. Operationoperation
    Expand child permissions
    Required components or authorityrequired_components_or_authority
    Authentication + Delegation, possibly Owner approval
    Source linesource_line
    10
  9. Operationoperation
    Rotate the authentication component
    Required components or authorityrequired_components_or_authority
    Delegation or Owner
    Source linesource_line
    11
  10. Operationoperation
    Rotate the authorship component
    Required components or authorityrequired_components_or_authority
    Authentication + Delegation, or Owner
    Source linesource_line
    12
  11. Operationoperation
    Rotate the delegation component
    Required components or authorityrequired_components_or_authority
    Owner approval recommended
    Source linesource_line
    13
  12. Operationoperation
    Revoke a child
    Required components or authorityrequired_components_or_authority
    Authentication + Delegation
    Source linesource_line
    14
  13. Operationoperation
    Revoke a subtree
    Required components or authorityrequired_components_or_authority
    Authentication + Delegation plus elevated policy or Owner
    Source linesource_line
    15
  14. Operationoperation
    Owner action
    Required components or authorityrequired_components_or_authority
    Owner session plus step-up when required
    Source linesource_line
    16