Filtered to Repository sdk-python

A definition in the contract artefact MUST NOT take a name an SDK's generator writes itself, and SDK generation MUST refuse such an artefact, naming the definition and the kind that carries it, rather than emit one name describing two shapes.

POST /api/device-keys MUST take name, public_key (a P-256 SubjectPublicKeyInfo in base64url), attestation (an object tagged by platform: {"platform": "android", "chain": […]}, the key attestation chain as each certificate's DER in base64url, the key's own certificate first, or {"platform": "ios", "object": …}, the App Attest attestation object's CBOR in base64url, attested with the SHA-256 of exactly the bytes public_key decodes to as its client data hash, hashed once) and password from an operator session, and MUST answer the device-key envelope with the name, the public half's fingerprint, its backing (strongbox, enclave or tee) and the registration time; a missing attestation, one that does not verify, one placing the key in software and one naming an app the core does not trust MUST each be refused with a code of its own listed among the artefact's refusals (C10-R23).

GET /api/device-keys MUST answer device-keys, listing each device key by name, fingerprint, backing, registration time and last use, and DELETE /api/device-keys/{name} MUST revoke one; both MUST be refused to a member session and to a key (C10-R26).

POST /api/device-keys/{name}/challenge MUST answer device-challenge with a fresh challenge and when it expires, from an operator session for a registered device key (C10-R24).

The keys envelope MUST carry proved_by on each key minted with a device key's signature, naming that device key, and MUST leave it out of a key minted any other way (C10-R33).

A definition in the contract artefact MUST NOT take a name an SDK's generator writes itself, and SDK generation MUST refuse such an artefact, naming the definition and the kind that carries it, rather than emit one name describing two shapes.

POST /api/device-keys MUST take name, public_key (a P-256 SubjectPublicKeyInfo in base64url), attestation (an object tagged by platform: {"platform": "android", "chain": […]}, the key attestation chain as each certificate's DER in base64url, the key's own certificate first, or {"platform": "ios", "object": …}, the App Attest attestation object's CBOR in base64url, attested with the SHA-256 of exactly the bytes public_key decodes to as its client data hash, hashed once) and password from an operator session, and MUST answer the device-key envelope with the name, the public half's fingerprint, its backing (strongbox, enclave or tee) and the registration time; a missing attestation, one that does not verify, one placing the key in software and one naming an app the core does not trust MUST each be refused with a code of its own listed among the artefact's refusals (C10-R23).

GET /api/device-keys MUST answer device-keys, listing each device key by name, fingerprint, backing, registration time and last use, and DELETE /api/device-keys/{name} MUST revoke one; both MUST be refused to a member session and to a key (C10-R26).

POST /api/device-keys/{name}/challenge MUST answer device-challenge with a fresh challenge and when it expires, from an operator session for a registered device key (C10-R24).

The keys envelope MUST carry proved_by on each key minted with a device key's signature, naming that device key, and MUST leave it out of a key minted any other way (C10-R33).

A definition in the contract artefact MUST NOT take a name an SDK's generator writes itself, and SDK generation MUST refuse such an artefact, naming the definition and the kind that carries it, rather than emit one name describing two shapes.

POST /api/device-keys MUST take name, public_key (a P-256 SubjectPublicKeyInfo in base64url), attestation (an object tagged by platform: {"platform": "android", "chain": […]}, the key attestation chain as each certificate's DER in base64url, the key's own certificate first, or {"platform": "ios", "object": …}, the App Attest attestation object's CBOR in base64url, attested with the SHA-256 of exactly the bytes public_key decodes to as its client data hash, hashed once) and password from an operator session, and MUST answer the device-key envelope with the name, the public half's fingerprint, its backing (strongbox, enclave or tee) and the registration time; a missing attestation, one that does not verify, one placing the key in software and one naming an app the core does not trust MUST each be refused with a code of its own listed among the artefact's refusals (C10-R23).

GET /api/device-keys MUST answer device-keys, listing each device key by name, fingerprint, backing, registration time and last use, and DELETE /api/device-keys/{name} MUST revoke one; both MUST be refused to a member session and to a key (C10-R26).

POST /api/device-keys/{name}/challenge MUST answer device-challenge with a fresh challenge and when it expires, from an operator session for a registered device key (C10-R24).

The keys envelope MUST carry proved_by on each key minted with a device key's signature, naming that device key, and MUST leave it out of a key minted any other way (C10-R33).