{
  "obelisk": "obelisk-agent-interface-v1",
  "issuer": "https://obeliskgate.com",
  "posture": {
    "rating": null,
    "band": null,
    "confidence": null,
    "pointsConsidered": null,
    "neverLockout": null,
    "integrityState": "unmeasured",
    "integrityOk": null,
    "encrypted": false,
    "oidcLive": true,
    "chainOk": null,
    "edgeDefense": null
  },
  "surfaces": [
    {
      "name": "agent-manifest",
      "method": "GET",
      "path": "/founder/agent",
      "auth": "console-token",
      "returns": "AgentManifest",
      "desc": "This document."
    },
    {
      "name": "rating",
      "method": "GET",
      "path": "/founder/rating?format=json",
      "auth": "console-token",
      "returns": "ObeliskRating",
      "desc": "The 0-100 security score, dimensions, confidence, levers."
    },
    {
      "name": "hub",
      "method": "GET",
      "path": "/founder?format=json",
      "auth": "console-token",
      "returns": "FounderHubModel",
      "desc": "Command-center tiles."
    },
    {
      "name": "database",
      "method": "GET",
      "path": "/founder/db?format=json",
      "auth": "console-token",
      "returns": "FounderDbModel",
      "desc": "Identity ledger, integrity, access audit (secret-free)."
    },
    {
      "name": "edge-defense",
      "method": "GET",
      "path": "/founder/edge?format=json",
      "auth": "console-token",
      "returns": "EdgePosture",
      "desc": "Public-edge security posture: abuse signals, honeytoken canary trips, scan-defense mode (advisory/enforce), RP liveness, cross-signal incidents (abuse+auth correlated by actor, with low-and-slow/accelerating detection), and the time-series trajectory (improving/stable/degrading/under-attack + attack-vs-defense gate attribution) — composed, source-derived, never fabricated."
    },
    {
      "name": "oidc-discovery",
      "method": "GET",
      "path": "https://obeliskgate.com/.well-known/openid-configuration",
      "auth": "public",
      "returns": "OIDCDiscovery",
      "desc": "Standard OpenID Connect discovery (RFC 8414)."
    },
    {
      "name": "jwks",
      "method": "GET",
      "path": "https://obeliskgate.com/.well-known/jwks.json",
      "auth": "public",
      "returns": "JWKS",
      "desc": "Public signing keys (ES256 by default); verify tokens locally by kid."
    },
    {
      "name": "agent-proof-link",
      "method": "GET",
      "path": "https://obeliskgate.com/agent/<proof_id>.json",
      "auth": "public",
      "returns": "AgentProofResult",
      "desc": "Independent, freshness-scoped agent claims plus VC and A2A projections. A proof URL is a view, never a bearer credential."
    },
    {
      "name": "studio-ecosystem",
      "method": "GET",
      "path": "https://obeliskgate.com/studio/ecosystem/manifest.json",
      "auth": "public",
      "returns": "StudioEcosystemManifest",
      "desc": "Canonical Studio Obelisk rollout truth: required versions, migration cargo digest, and latest recipient acknowledgements."
    }
  ],
  "actions": [
    {
      "name": "oidc-login",
      "method": "GET",
      "path": "https://obeliskgate.com/auth/authorize",
      "auth": "public",
      "query": {
        "response_type": "code",
        "client_id": "<rp>",
        "redirect_uri": "<registered>",
        "scope": "openid profile offline_access",
        "code_challenge": "<S256>",
        "code_challenge_method": "S256",
        "state": "<rnd>",
        "nonce": "<rnd>"
      },
      "desc": "Start the OIDC authorization-code (PKCE) login. Use @obeliskgate/obelisk-auth."
    },
    {
      "name": "oidc-token",
      "method": "POST",
      "path": "https://obeliskgate.com/auth/token",
      "auth": "pkce",
      "body": {
        "grant_type": "authorization_code|refresh_token",
        "code": "<code>",
        "code_verifier": "<verifier>",
        "redirect_uri": "<registered>",
        "client_id": "<rp>"
      },
      "returns": {
        "id_token": "JWT(ES256 by default; RS256 for a client registered with id_token_signed_response_alg=RS256 on a deployment that enables it; +obelisk claim)",
        "access_token": "JWT",
        "refresh_token": "rotating",
        "expires_in": 3600
      },
      "desc": "Exchange code → tokens; or rotate a refresh token (reuse → family revoked)."
    },
    {
      "name": "userinfo",
      "method": "GET",
      "path": "https://obeliskgate.com/auth/userinfo",
      "auth": "bearer",
      "returns": {
        "sub": "string",
        "email": "string?",
        "tier": "string?"
      },
      "desc": "Profile claims for a Bearer access token."
    },
    {
      "name": "verify-session",
      "method": "POST",
      "path": "https://obeliskgate.com/auth/verify-session",
      "auth": "public",
      "body": {
        "token": "<macaroon>",
        "scope": "<scope?>"
      },
      "returns": {
        "ok": "bool",
        "identityId": "string"
      },
      "desc": "Server-to-server macaroon session verification (legacy keystone; RPs hold no secret)."
    },
    {
      "name": "begin-agent-enrollment",
      "method": "POST",
      "path": "https://obeliskgate.com/auth/agents/proof/enroll/begin",
      "auth": "public",
      "body": {
        "name": "<display name>",
        "subjectKind": "ai_agent|service_bot|automation|...",
        "publicJwk": "<agent-generated public JWK>"
      },
      "returns": {
        "enrollment": "owner code + verification URI + expiry"
      },
      "desc": "Start non-custodial device-style enrollment. Keep signing material inside your runtime; an accountable human approves, then the runtime answers a nonce-bound DPoP challenge."
    },
    {
      "name": "verify-agent-live",
      "method": "POST",
      "path": "https://obeliskgate.com/api/agent-proof/challenge → /api/agent-proof/verify",
      "auth": "public+DPoP",
      "body": {
        "proof_id": "<opaque proof id>",
        "challenge_id": "<returned id>"
      },
      "returns": {
        "proof": "independent claim vector",
        "proof_token": "short-lived signed JWT?",
        "receipt": "{ hash, kind, proof_url } — the agent-action chain receipt this verification appended"
      },
      "desc": "Establish current control of the agent's registered key; the verification is appended to the hash chain as a receipt whose actor is the agent. Does not establish AI participation, absence of human influence, safety, or lack of compromise."
    },
    {
      "name": "mint-api-key",
      "method": "POST",
      "path": "https://obeliskgate.com/grants/mint",
      "auth": "bearer|console-token",
      "body": {
        "cap": "<capability>",
        "scope": "<scope>",
        "ttlMs": 3600000
      },
      "returns": {
        "api_key": "<macaroon>",
        "key_id": "string",
        "expires_at": "ISO"
      },
      "desc": "Mint a short-lived, scoped, revocable API key (Obelisk Grant). No long-lived broad keys.",
      "note": "loopback-only until ingress is opened."
    },
    {
      "name": "verify-api-key",
      "method": "POST",
      "path": "https://obeliskgate.com/grants/verify",
      "auth": "public",
      "body": {
        "api_key": "<key>",
        "scope": "<scope>",
        "dpop": "<DPoP proof the caller presented with the key; required for a holder-of-key key>",
        "htm": "<method of the request that carried it>",
        "htu": "<URL of the request that carried it>"
      },
      "returns": {
        "ok": "bool",
        "cap": "string",
        "scope": "string",
        "binding": "bearer|holder-of-key",
        "cnf": "{ jkt }? — the key a holder-of-key key is bound to",
        "principal": "{ type, id, owner?, name?, lifecycle? }"
      },
      "desc": "Verify a presented API key. A holder-of-key key verifies only with a DPoP proof signed by the key in its cnf.jkt whose ath is the hash of this API key (forwarded in the body, or sent as a DPoP header made for this endpoint), and only while that key is still the agent's current key. An agent key of either binding is refused while the agent is suspended, compromised or revoked. By default /auth/keys/mint issues holder-of-key keys for an agent that has enrolled a key. /auth/keys/mint refuses an unscoped (*) key unless the request sets allow_unscoped: true, and a key it binds to an agent lives 15 minutes to 30 days (1 hour unless ttlMs asks otherwise)."
    },
    {
      "name": "revoke-api-key",
      "method": "POST",
      "path": "https://obeliskgate.com/grants/revoke",
      "auth": "bearer|console-token",
      "body": {
        "key_id": "string"
      },
      "returns": {
        "revoked": "bool"
      },
      "desc": "Revoke an API key by id."
    }
  ],
  "capabilities": [
    "oidc-provider",
    "jwks",
    "passkeys",
    "totp",
    "magic-link",
    "dpop-sender-bound-tokens(rfc9449)",
    "saml-2.0-idp-metadata(no-service-provider-connectable)",
    "macaroon-sessions",
    "refresh-rotation+reuse-detection",
    "api-key-grants",
    "workload-identity(mesh)",
    "passkey-assurance-for-sensitive-mutations",
    "receipt-backed-audit",
    "obelisk-rating",
    "proof-carrying-tokens",
    "agent-proof-vector",
    "non-custodial-agent-enrollment",
    "action-scoped-run-proofs",
    "edge-defense",
    "cross-signal-incident-correlation",
    "edge-trajectory(time-series)",
    "capability-honeypot-tripwire",
    "autonomous-correlation-response(detection→broker-lockdown)",
    "forensic-timeline(cross-ledger,two-plane)",
    "defense-replay(end-to-end-proof)"
  ],
  "sdk": {
    "package": "@obeliskgate/obelisk-auth",
    "next": "@obeliskgate/obelisk-auth/next",
    "readme": "packages/auth-sdk/README.md"
  },
  "see_also": {
    "api_manifest": "/api?format=json",
    "agents_guide": "/agents"
  },
  "levers": [],
  "docs": {
    "spec": "docs/OBELISK_GATE_SPEC.md",
    "migration": "docs/GOTRUE_TO_OBELISK_MIGRATION.md",
    "hub": "docs/FOUNDER_HUB.md"
  }
}