{
  "obelisk": "obelisk-agent-interface-v1",
  "issuer": "https://obeliskgate.com",
  "posture": {
    "rating": null,
    "band": null,
    "confidence": null,
    "pointsConsidered": null,
    "neverLockout": {
      "safe": false,
      "redundant": false
    },
    "integrityState": "unmeasured",
    "integrityOk": null,
    "encrypted": false,
    "oidcLive": true,
    "chainOk": null,
    "edgeDefense": null
  },
  "surfaces": [
    {
      "name": "agent-manifest",
      "method": "GET",
      "path": "/founder/agent",
      "auth": "console-token",
      "returns": "AgentManifest",
      "desc": "This document."
    },
    {
      "name": "rating",
      "method": "GET",
      "path": "/founder/rating?format=json",
      "auth": "console-token",
      "returns": "ObeliskRating",
      "desc": "The 0-100 security score, dimensions, confidence, levers."
    },
    {
      "name": "hub",
      "method": "GET",
      "path": "/founder?format=json",
      "auth": "console-token",
      "returns": "FounderHubModel",
      "desc": "Command-center tiles."
    },
    {
      "name": "database",
      "method": "GET",
      "path": "/founder/db?format=json",
      "auth": "console-token",
      "returns": "FounderDbModel",
      "desc": "Identity ledger, integrity, access audit (secret-free)."
    },
    {
      "name": "edge-defense",
      "method": "GET",
      "path": "/founder/edge?format=json",
      "auth": "console-token",
      "returns": "EdgePosture",
      "desc": "Public-edge security posture: abuse signals, honeytoken canary trips, scan-defense mode (advisory/enforce), RP liveness, cross-signal incidents (abuse+auth correlated by actor, with low-and-slow/accelerating detection), and the time-series trajectory (improving/stable/degrading/under-attack + attack-vs-defense gate attribution) — composed, source-derived, never fabricated."
    },
    {
      "name": "oidc-discovery",
      "method": "GET",
      "path": "https://obeliskgate.com/.well-known/openid-configuration",
      "auth": "public",
      "returns": "OIDCDiscovery",
      "desc": "Standard OpenID Connect discovery (RFC 8414)."
    },
    {
      "name": "jwks",
      "method": "GET",
      "path": "https://obeliskgate.com/.well-known/jwks.json",
      "auth": "public",
      "returns": "JWKS",
      "desc": "Public signing keys (ES256); verify tokens locally by kid."
    },
    {
      "name": "agent-proof-link",
      "method": "GET",
      "path": "https://obeliskgate.com/agent/<proof_id>.json",
      "auth": "public",
      "returns": "AgentProofResult",
      "desc": "Independent, freshness-scoped agent claims plus VC and A2A projections. A proof URL is a view, never a bearer credential."
    },
    {
      "name": "studio-ecosystem",
      "method": "GET",
      "path": "https://obeliskgate.com/studio/ecosystem/manifest.json",
      "auth": "public",
      "returns": "StudioEcosystemManifest",
      "desc": "Canonical Studio Obelisk rollout truth: required versions, migration cargo digest, and latest recipient acknowledgements."
    }
  ],
  "actions": [
    {
      "name": "oidc-login",
      "method": "GET",
      "path": "https://obeliskgate.com/auth/authorize",
      "auth": "public",
      "query": {
        "response_type": "code",
        "client_id": "<rp>",
        "redirect_uri": "<registered>",
        "scope": "openid profile offline_access",
        "code_challenge": "<S256>",
        "code_challenge_method": "S256",
        "state": "<rnd>",
        "nonce": "<rnd>"
      },
      "desc": "Start the OIDC authorization-code (PKCE) login. Use @vaultspark/obelisk-auth."
    },
    {
      "name": "oidc-token",
      "method": "POST",
      "path": "https://obeliskgate.com/auth/token",
      "auth": "pkce",
      "body": {
        "grant_type": "authorization_code|refresh_token",
        "code": "<code>",
        "code_verifier": "<verifier>",
        "redirect_uri": "<registered>",
        "client_id": "<rp>"
      },
      "returns": {
        "id_token": "JWT(ES256, +obelisk claim)",
        "access_token": "JWT",
        "refresh_token": "rotating",
        "expires_in": 3600
      },
      "desc": "Exchange code → tokens; or rotate a refresh token (reuse → family revoked)."
    },
    {
      "name": "userinfo",
      "method": "GET",
      "path": "https://obeliskgate.com/auth/userinfo",
      "auth": "bearer",
      "returns": {
        "sub": "string",
        "email": "string?",
        "tier": "string?"
      },
      "desc": "Profile claims for a Bearer access token."
    },
    {
      "name": "verify-session",
      "method": "POST",
      "path": "https://obeliskgate.com/auth/verify-session",
      "auth": "public",
      "body": {
        "token": "<macaroon>",
        "scope": "<scope?>"
      },
      "returns": {
        "ok": "bool",
        "identityId": "string"
      },
      "desc": "Server-to-server macaroon session verification (legacy keystone; RPs hold no secret)."
    },
    {
      "name": "begin-agent-enrollment",
      "method": "POST",
      "path": "https://obeliskgate.com/auth/agents/proof/enroll/begin",
      "auth": "public",
      "body": {
        "name": "<display name>",
        "subjectKind": "ai_agent|service_bot|automation|...",
        "publicJwk": "<agent-generated public JWK>"
      },
      "returns": {
        "enrollment": "owner code + verification URI + expiry"
      },
      "desc": "Start non-custodial device-style enrollment. Keep signing material inside your runtime; an accountable human approves, then the runtime answers a nonce-bound DPoP challenge."
    },
    {
      "name": "verify-agent-live",
      "method": "POST",
      "path": "https://obeliskgate.com/api/agent-proof/challenge → /api/agent-proof/verify",
      "auth": "public+DPoP",
      "body": {
        "proof_id": "<opaque proof id>",
        "challenge_id": "<returned id>"
      },
      "returns": {
        "proof": "independent claim vector",
        "proof_token": "short-lived signed JWT?"
      },
      "desc": "Establish current control of the agent's registered key. Does not establish AI participation, absence of human influence, safety, or lack of compromise."
    },
    {
      "name": "mint-api-key",
      "method": "POST",
      "path": "https://obeliskgate.com/grants/mint",
      "auth": "bearer|console-token",
      "body": {
        "cap": "<capability>",
        "scope": "<scope>",
        "ttlMs": 3600000
      },
      "returns": {
        "api_key": "<macaroon>",
        "key_id": "string",
        "expires_at": "ISO"
      },
      "desc": "Mint a short-lived, scoped, revocable API key (Obelisk Grant). No long-lived broad keys.",
      "note": "loopback-only until ingress is opened."
    },
    {
      "name": "verify-api-key",
      "method": "POST",
      "path": "https://obeliskgate.com/grants/verify",
      "auth": "public",
      "body": {
        "api_key": "<key>",
        "scope": "<scope>"
      },
      "returns": {
        "ok": "bool",
        "cap": "string",
        "scope": "string"
      },
      "desc": "Verify a presented API key."
    },
    {
      "name": "revoke-api-key",
      "method": "POST",
      "path": "https://obeliskgate.com/grants/revoke",
      "auth": "bearer|console-token",
      "body": {
        "key_id": "string"
      },
      "returns": {
        "revoked": "bool"
      },
      "desc": "Revoke an API key by id."
    }
  ],
  "capabilities": [
    "oidc-provider",
    "jwks",
    "passkeys",
    "totp",
    "magic-link",
    "recovery-codes",
    "dpop-sender-bound-tokens(rfc9449)",
    "saml-2.0-idp",
    "macaroon-sessions",
    "refresh-rotation+reuse-detection",
    "api-key-grants",
    "workload-identity(mesh)",
    "login-risk(sentinel)",
    "receipt-backed-audit",
    "obelisk-rating",
    "proof-carrying-tokens",
    "agent-proof-vector",
    "non-custodial-agent-enrollment",
    "action-scoped-run-proofs",
    "never-lockout",
    "edge-defense",
    "cross-signal-incident-correlation",
    "edge-trajectory(time-series)",
    "capability-honeypot-tripwire",
    "autonomous-correlation-response(detection→broker-lockdown)",
    "forensic-timeline(cross-ledger,two-plane)",
    "defense-replay(end-to-end-proof)"
  ],
  "sdk": {
    "package": "@vaultspark/obelisk-auth",
    "next": "@vaultspark/obelisk-auth/next",
    "readme": "packages/auth-sdk/README.md"
  },
  "see_also": {
    "api_manifest": "/api?format=json",
    "agents_guide": "/agents"
  },
  "levers": [],
  "docs": {
    "spec": "docs/OBELISK_GATE_SPEC.md",
    "migration": "docs/GOTRUE_TO_OBELISK_MIGRATION.md",
    "hub": "docs/FOUNDER_HUB.md"
  }
}