License API: schemas

The request and response bodies of the operations in this API.

LicenseSignatureAlgorithm

Type: one of "EdDSA"

LicenseVerificationKeyDto

Property	Type	Required	Description
`alg`	LicenseSignatureAlgorithm	yes
`crv`	string	yes
`kid`	string	yes	`base64url(sha256(SPKI DER))` — derived from the key, never assigned.
`kty`	string	yes
`publicKeyPem`	string	yes	SPKI PEM of the same key. Published alongside the JWK because the offline verifier builds its trust store from PEM, and an air-gapped installer must be able to embed it without a JWK-to-PEM conversion step.
`use`	string	yes
`x`	string	yes	base64url of the raw Ed25519 public key.

LicenseVerificationKeySetDto

Property	Type	Required	Description
`keys`	array of LicenseVerificationKeyDto	yes

LicenseVerificationKeySetDtoDataEnvelope

Property	Type	Required	Description
`data`	LicenseVerificationKeySetDto	yes

ProblemActionableBy

Who can act on this refusal: user (correct the input, sign in), org-admin (an administrator of the organisation), platform (the operators of this installation), none (nobody — it cannot succeed). ABSENT when not known; never guessed.

Type: one of "user", "org-admin", "platform", "none"

ProblemDetailsDto

RFC 9457 problem document. The declared members are the reserved core; extension members are TOP-LEVEL and OPEN, owned by the refusing plane.

Property	Type	Required	Description
`actionableBy`	ProblemActionableBy	no	Who can act on this refusal: `user` (correct the input, sign in), `org-admin` (an administrator of the organisation), `platform` (the operators of this installation), `none` (nobody — it cannot succeed). ABSENT when not known; never guessed.
`code`	string	yes	SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.
`detail`	string	no	Human-readable and specific to THIS occurrence.
`errors`	array of ProblemFieldIssueDto	no	Field-level issues, when the refusal is about the request body.
`instance`	string	no	URI reference identifying the occurrence — a request path, a run, a row.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for the message keyed by `code` — typed and allowlisted per code by its declaration. Never server-authored copy, never internal diagnostics.
`retry`	ProblemRetry	no	What a retry can achieve: `transient` (later, unchanged), `after-change` (only after someone changes something), `never` (a defect until a fixed version ships). ABSENT when not known.
`status`	number	yes	The HTTP status code, repeated in the body so a logged document is self-contained.
`title`	string	yes	Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`.
`traceId`	string	no	W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not.
`type`	string	yes	Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`.

ProblemFieldIssueDto

Property	Type	Required	Description
`code`	string	no	SCREAMING_SNAKE_CASE code of THIS issue, for a frontend i18n key. Present when the issue was minted by a declared problem.
`detail`	string	yes	Prose for logs and developers. A frontend localises from `code` + `params` instead.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for this issue's `code`.
`pointer`	string	yes	RFC 6901 JSON Pointer into the request body. Root is "/".

ProblemRetry

What a retry can achieve: transient (later, unchanged), after-change (only after someone changes something), never (a defect until a fixed version ships). ABSENT when not known.

Type: one of "transient", "after-change", "never"

RegistryJwkDto

Property	Type	Required	Description
`alg`	string	yes
`e`	string	yes	base64url exponent.
`kid`	string	yes	`base64url(sha256(SPKI DER))` — derived, never assigned.
`kty`	string	yes
`n`	string	yes	base64url modulus.
`use`	string	yes

RegistryJwksDto

Property	Type	Required	Description
`keys`	array of RegistryJwkDto	yes

RegistryTokenResponseDto

Property	Type	Required	Description
`access_token`	string	yes	The SAME JWT. Read by `podman` and `containerd`. Both keys are required — omitting either breaks a real client.
`expires_in`	number	yes	Seconds. Fixed at 300 — the TTL is the revocation SLA.
`issued_at`	string (date-time)	yes
`token`	string	yes	The RS256 JWT. Read by `docker`.