{ "item": [ { "name": "Auth", "description": "The eID authentication ceremony (`/v1/auth/*`).", "item": [ { "id": "de4521f3-7755-52bf-9532-44441e83416a", "name": "Create request - physical ATK (primary)", "request": { "name": "Create request - physical ATK (primary)", "description": { "content": "Called by the provider's backend with HTTP Basic (`keyId:keySecret`). `audience` must be an\nexact origin on the provider's allow-list. Physical requests return a short-lived `clientToken`;\nNFC requests return a pairing hint; Smart-ID/Mobile-ID requests remain entirely server-side.\n", "type": "text/plain" }, "url": { "path": [ "auth", "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"audience\": \"{{audience}}\",\n \"method\": \"physical\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "ab2f81f8-e257-53a6-bf43-77f225afbb92", "name": "Create request - Smart-ID (secondary)", "request": { "name": "Create request - Smart-ID (secondary)", "description": { "content": "Called by the provider's backend with HTTP Basic (`keyId:keySecret`). `audience` must be an\nexact origin on the provider's allow-list. Physical requests return a short-lived `clientToken`;\nNFC requests return a pairing hint; Smart-ID/Mobile-ID requests remain entirely server-side.\n", "type": "text/plain" }, "url": { "path": [ "auth", "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"audience\": \"{{audience}}\",\n \"method\": \"smart_id\",\n \"personalCode\": \"{{personalCode}}\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "92ff1067-c38d-55fd-8cdf-3f8ab6d6aaf9", "name": "Create request - Mobile-ID (secondary)", "request": { "name": "Create request - Mobile-ID (secondary)", "description": { "content": "Called by the provider's backend with HTTP Basic (`keyId:keySecret`). `audience` must be an\nexact origin on the provider's allow-list. Physical requests return a short-lived `clientToken`;\nNFC requests return a pairing hint; Smart-ID/Mobile-ID requests remain entirely server-side.\n", "type": "text/plain" }, "url": { "path": [ "auth", "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"audience\": \"{{audience}}\",\n \"method\": \"mobile_id\",\n \"personalCode\": \"{{personalCode}}\",\n \"phoneNumber\": \"{{phoneNumber}}\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "88fa762b-8f78-472a-b0e1-f9bb490f16cf", "name": "Submit the card's authentication certificate; receive the DTBS + challenge", "request": { "name": "Submit the card's authentication certificate; receive the DTBS + challenge", "description": { "content": "Called by the client with `Authorization: Bearer `. The API validates the\ncertificate (chain, revocation, purpose = authentication, key usage), builds the canonical\nchallenge, and returns the exact `dtbs` the card must sign plus a single-use `operationToken`.\nPhysical/NFC only; server-side methods do not call this endpoint.\n", "type": "text/plain" }, "url": { "path": [ "auth", ":requestId", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{requestId}}", "key": "requestId", "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"certificate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{bearerToken}}" } ] } }, "response": [ { "id": "1bbc9548-7a11-4d22-9446-358027152339", "name": "DTBS + challenge + operation token.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"certificate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"requestId\": \"\",\n \"dtbs\": \"\",\n \"dtbsHashAlgOid\": \"2.16.840.1.101.3.4.2.1\",\n \"operationToken\": \"\",\n \"challenge\": {\n \"profile\": \"\",\n \"audience\": \"\",\n \"nonce\": \"\"\n },\n \"cert\": {\n \"subject\": {\n \"serialNumber\": \"\",\n \"givenName\": \"\",\n \"sn\": \"\",\n \"cn\": \"\",\n \"c\": \"\"\n }\n },\n \"verificationCode\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "2c44eb2a-5848-479f-89ff-b88504972b6e", "name": "Missing/invalid credentials or client token.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"certificate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "49daed55-8666-46ed-9a56-a9c8bfb26cbb", "name": "Authorized but not permitted (origin/format/tenant).", "originalRequest": { "url": { "path": [ "auth", ":requestId", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"certificate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "c04b58ac-05ab-4513-9568-de1380b6e440", "name": "Unknown request.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"certificate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "454c3c37-1be8-44d1-bfd3-2b071fadf8de", "name": "State/idempotency conflict (spent operation token, identity swap, terminal request).", "originalRequest": { "url": { "path": [ "auth", ":requestId", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"certificate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a75eaaaa-733c-4c88-a3be-7ded2a52f482", "name": "Semantic reject (cert purpose/chain/revocation, dtbs mismatch, bad signature).", "originalRequest": { "url": { "path": [ "auth", ":requestId", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"certificate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unprocessable Entity (WebDAV) (RFC 4918)", "code": 422, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "f6ba8a29-7da0-4ab3-8edc-98440123f185", "name": "Submit the raw card signature; receive the verified identity", "request": { "name": "Submit the raw card signature; receive the verified identity", "description": { "content": "Called by the client with `Authorization: Bearer ` and the single-use\n`operationToken` in the body. The API verifies the signature against the stored `dtbs` and the\ncertificate's public key, enforces the identity-swap guard, and returns the verified identity\n(and the optional `assertion` JWT). Retry-safe: a repeat with the same tuple returns the same\nresult; a different signature/cert after the token is claimed is rejected.\nPhysical/NFC only; server-side methods complete asynchronously.\n", "type": "text/plain" }, "url": { "path": [ "auth", ":requestId", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{requestId}}", "key": "requestId", "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"signature\": \"\",\n \"signatureAlgorithm\": \"ES256\",\n \"operationToken\": \"\",\n \"signatureEncoding\": \"P1363\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{bearerToken}}" } ] } }, "response": [ { "id": "f49734a4-ad14-4419-9fc7-6b9219a5e50d", "name": "Authenticated - verified identity.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"signature\": \"\",\n \"signatureAlgorithm\": \"ES256\",\n \"operationToken\": \"\",\n \"signatureEncoding\": \"P1363\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"status\": \"\",\n \"method\": \"smart_id\",\n \"sig\": \"\",\n \"cert\": {\n \"subject\": {\n \"serialNumber\": \"\",\n \"givenName\": \"\",\n \"sn\": \"\",\n \"cn\": \"\",\n \"c\": \"\"\n },\n \"der\": \"\"\n },\n \"assertion\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "1dc60e89-2e04-4a65-be6c-f75ec0bf4106", "name": "Missing/invalid credentials or client token.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"signature\": \"\",\n \"signatureAlgorithm\": \"ES256\",\n \"operationToken\": \"\",\n \"signatureEncoding\": \"P1363\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "bc636bf9-aea1-402b-bdac-ee5b27c86c97", "name": "Authorized but not permitted (origin/format/tenant).", "originalRequest": { "url": { "path": [ "auth", ":requestId", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"signature\": \"\",\n \"signatureAlgorithm\": \"ES256\",\n \"operationToken\": \"\",\n \"signatureEncoding\": \"P1363\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "4fb4eb9d-1d63-4cfd-8f5b-5177038ca4cd", "name": "Unknown request.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"signature\": \"\",\n \"signatureAlgorithm\": \"ES256\",\n \"operationToken\": \"\",\n \"signatureEncoding\": \"P1363\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "e442d691-88a3-4266-93a0-0cee7aaa5ae1", "name": "State/idempotency conflict (spent operation token, identity swap, terminal request).", "originalRequest": { "url": { "path": [ "auth", ":requestId", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"signature\": \"\",\n \"signatureAlgorithm\": \"ES256\",\n \"operationToken\": \"\",\n \"signatureEncoding\": \"P1363\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a11a9c81-ca34-4bbb-ab0b-4675f0333132", "name": "Semantic reject (cert purpose/chain/revocation, dtbs mismatch, bad signature).", "originalRequest": { "url": { "path": [ "auth", ":requestId", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"signature\": \"\",\n \"signatureAlgorithm\": \"ES256\",\n \"operationToken\": \"\",\n \"signatureEncoding\": \"P1363\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unprocessable Entity (WebDAV) (RFC 4918)", "code": 422, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "eeb7dbb1-5c0b-4a35-a613-66d85444b657", "name": "Poll request status / fetch the result", "request": { "name": "Poll request status / fetch the result", "description": { "content": "Readable with the provider's Basic credentials for every method, or with the request's\n`clientToken` for physical/NFC requests. Smart-ID/Mobile-ID providers poll this endpoint or\nconsume the terminal webhook.\n", "type": "text/plain" }, "url": { "path": [ "auth", ":requestId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{requestId}}", "key": "requestId", "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [ { "id": "65756342-6d2d-4c15-811c-565a09f483b8", "name": "Current state.", "originalRequest": { "url": { "path": [ "auth", ":requestId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"requestId\": \"\",\n \"method\": \"smart_id\",\n \"status\": \"pinBlocked\",\n \"verificationCode\": \"\",\n \"nonce\": \"\",\n \"cert\": {\n \"subject\": {\n \"serialNumber\": \"\",\n \"givenName\": \"\",\n \"sn\": \"\",\n \"cn\": \"\",\n \"c\": \"\"\n },\n \"der\": \"\"\n },\n \"sig\": \"\",\n \"assertion\": \"\",\n \"error\": {\n \"code\": \"operation_token_expired\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": true\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "4589ba37-0d27-4d90-96b2-61ca7cb2246a", "name": "Missing/invalid credentials or client token.", "originalRequest": { "url": { "path": [ "auth", ":requestId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "ddc16e95-cf46-4ab2-8ae5-edc5e6ae8111", "name": "Unknown request.", "originalRequest": { "url": { "path": [ "auth", ":requestId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "523d851d-fbec-477f-8cd1-a55037798a5b", "name": "Cancel a non-terminal request", "request": { "name": "Cancel a non-terminal request", "description": {}, "url": { "path": [ "auth", ":requestId", "cancel" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{requestId}}", "key": "requestId", "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [ { "id": "87e9dd6d-3e89-4c21-b169-445cefc42543", "name": "Cancelled.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "cancel" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"requestId\": \"\",\n \"method\": \"smart_id\",\n \"status\": \"pinBlocked\",\n \"verificationCode\": \"\",\n \"nonce\": \"\",\n \"cert\": {\n \"subject\": {\n \"serialNumber\": \"\",\n \"givenName\": \"\",\n \"sn\": \"\",\n \"cn\": \"\",\n \"c\": \"\"\n },\n \"der\": \"\"\n },\n \"sig\": \"\",\n \"assertion\": \"\",\n \"error\": {\n \"code\": \"operation_token_expired\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": true\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "7cb43597-623f-4091-8f96-c4888ad254af", "name": "Unknown request.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "cancel" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "7db8b788-7451-47f9-837d-9bbe15cee219", "name": "State/idempotency conflict (spent operation token, identity swap, terminal request).", "originalRequest": { "url": { "path": [ "auth", ":requestId", "cancel" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": {} }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Pairing", "description": "NFC remote pairing - complete a request by tapping a card on a different device.", "item": [ { "id": "fdb333cb-8c16-4724-b103-c34cbbdefcc7", "name": "Get a pairing token/QR to complete this request on a phone", "request": { "name": "Get a pairing token/QR to complete this request on a phone", "description": { "content": "Only for `method:\"nfc\"`. Basic only - the integrator's server rotates the one-time token.\nReturns a high-entropy, short-lived, one-claim pairing token and a deep link / QR the phone\nscans. The phone then calls `/pairing/claim`, receives the request's `clientToken`, and\ndrives the same `/certificate` + `/complete` endpoints.\n", "type": "text/plain" }, "url": { "path": [ "auth", ":requestId", "pairing" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{requestId}}", "key": "requestId", "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [ { "id": "9e22c8cb-44d5-4149-884c-9a05d75a4bbc", "name": "Pairing payload.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "pairing" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"pairingToken\": \"\",\n \"expiresAt\": \"\",\n \"pairingUrl\": \"\",\n \"deepLink\": \"\",\n \"qrPayload\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "4bedf65d-db33-4309-9348-11248718cfc6", "name": "Unknown request.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "pairing" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "41d548d2-11c1-4e0a-965e-c5fecda7955a", "name": "State/idempotency conflict (spent operation token, identity swap, terminal request).", "originalRequest": { "url": { "path": [ "auth", ":requestId", "pairing" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "6ed150f9-099f-424d-8bbb-3f947e81b0e5", "name": "Claim a pairing token from the tapping phone", "request": { "name": "Claim a pairing token from the tapping phone", "description": { "content": "No Basic auth - authorized solely by the high-entropy `pairingToken`. One-claim, rate-limited,\nstored hashed. Returns the request's `clientToken` and a minimal `summary` (purpose + label\nonly, never document contents).\n", "type": "text/plain" }, "url": { "path": [ "pairing", "claim" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"pairingToken\": \"\",\n \"claimNonce\": \"\",\n \"device\": {\n \"platform\": \"\",\n \"appVersion\": \"\",\n \"deviceName\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": null }, "response": [ { "id": "3db2fa87-8114-4326-937c-561c699d69bc", "name": "Claimed.", "originalRequest": { "url": { "path": [ "pairing", "claim" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"pairingToken\": \"\",\n \"claimNonce\": \"\",\n \"device\": {\n \"platform\": \"\",\n \"appVersion\": \"\",\n \"deviceName\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"requestId\": \"\",\n \"purpose\": \"auth\",\n \"clientToken\": \"\",\n \"status\": \"deviceError\",\n \"summary\": {\n \"key_0\": 8501.656199569155,\n \"key_1\": 547.3114616712782\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "afaa297b-46fe-4061-8bdd-851772f93dff", "name": "Unknown request.", "originalRequest": { "url": { "path": [ "pairing", "claim" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"pairingToken\": \"\",\n \"claimNonce\": \"\",\n \"device\": {\n \"platform\": \"\",\n \"appVersion\": \"\",\n \"deviceName\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "aa1e6a4a-9f20-4982-9115-c5dc5226e36c", "name": "State/idempotency conflict (spent operation token, identity swap, terminal request).", "originalRequest": { "url": { "path": [ "pairing", "claim" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"pairingToken\": \"\",\n \"claimNonce\": \"\",\n \"device\": {\n \"platform\": \"\",\n \"appVersion\": \"\",\n \"deviceName\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "58831802-9a9d-4e5e-9b55-10a1b1e81b17", "name": "Too many requests.", "originalRequest": { "url": { "path": [ "pairing", "claim" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"pairingToken\": \"\",\n \"claimNonce\": \"\",\n \"device\": {\n \"platform\": \"\",\n \"appVersion\": \"\",\n \"deviceName\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "Seconds.", "type": "text/plain" }, "key": "Retry-After", "value": "60" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Well-known", "description": "Keys for verifying the optional `assertion` JWT.", "item": [ { "id": "1b937401-8505-49c2-8625-7162ead798e3", "name": "JWKS for verifying the optional `assertion` JWT", "request": { "name": "JWKS for verifying the optional `assertion` JWT", "description": { "content": "Public keys (by `kid`) for the ES256 signer. Rotation keeps current + previous keys published so\nin-flight assertions verify.\n", "type": "text/plain" }, "url": { "path": [ ".well-known", "atk-jwks.json" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "631e7d77-6ae5-4a5b-bf92-c6bd04b0e4b2", "name": "Key set.", "originalRequest": { "url": { "path": [ ".well-known", "atk-jwks.json" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "73f58e61-88db-4809-b428-3f26e64489ca", "name": "Unknown request.", "originalRequest": { "url": { "path": [ ".well-known", "atk-jwks.json" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Erasure", "description": "", "item": [ { "id": "6b785a04-4d47-4f44-93b5-805b406b6941", "name": "Erase one request on demand (GDPR)", "request": { "name": "Erase one request on demand (GDPR)", "description": { "content": "Basic only, scoped to the caller's own provider. A non-terminal request is cancelled first,\nthen its document/result bytes + derived personal data are purged (exactly what the retention\njob strips); a de-identified audit row remains. Idempotent.\n", "type": "text/plain" }, "url": { "path": [ "auth", ":requestId", "delete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{requestId}}", "key": "requestId", "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [ { "id": "cbb2e475-c3d9-434f-b1b1-cf0dada54a61", "name": "Erased.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "delete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"requestId\": \"\",\n \"deleted\": false\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "3826de81-bd61-4178-9cb4-eb9d2e1b4078", "name": "Unknown request.", "originalRequest": { "url": { "path": [ "auth", ":requestId", "delete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The `requestId` returned by `POST /auth/requests`.", "type": "text/plain" }, "type": "any", "value": "{{requestId}}", "key": "requestId" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "84e06683-cbd4-443f-aa03-d0f8e7e690b9", "name": "Bulk-erase the provider's terminal requests (GDPR)", "request": { "name": "Bulk-erase the provider's terminal requests (GDPR)", "description": { "content": "Basic only. Purges document/result bytes + derived personal data of every TERMINAL,\nnot-yet-purged request of the calling provider (auth and sign alike); optional `before`\n(ISO-8601) restricts to requests last updated before that moment. In-flight requests are\nleft untouched - erase them individually if intended.\n", "type": "text/plain" }, "url": { "path": [ "erasure" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"before\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [ { "id": "51961158-6d4a-40b7-8b26-a77ea9435cf3", "name": "Erasure summary.", "originalRequest": { "url": { "path": [ "erasure" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"before\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"purged\": 2128,\n \"failed\": 4461\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "0f66870d-99e6-4275-a78c-22798349512d", "name": "Malformed input.", "originalRequest": { "url": { "path": [ "erasure" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"before\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "496622e4-eb79-4c0a-8322-c9c7319188dd", "name": "Missing/invalid credentials or client token.", "originalRequest": { "url": { "path": [ "erasure" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"before\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a39e0a41-6f4c-4db7-85c9-364516b4fdd3", "name": "A required remote or erasure service is temporarily unavailable.", "originalRequest": { "url": { "path": [ "erasure" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"before\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Service Unavailable", "code": 503, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"document_size_mismatch\",\n \"message\": \"\",\n \"requestId\": \"\",\n \"retryable\": false\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] } ], "auth": { "type": "basic", "basic": [ { "type": "any", "value": "{{basicAuthUsername}}", "key": "username" }, { "type": "any", "value": "{{basicAuthPassword}}", "key": "password" } ] }, "event": [], "variable": [ { "key": "baseUrl", "value": "https://atk.tvarka.pro/v1" }, { "key": "requestId", "value": "" }, { "key": "audience", "value": "" }, { "key": "personalCode", "value": "" }, { "key": "phoneNumber", "value": "" } ], "info": { "_postman_id": "6988b7c2-9a35-422e-9f41-e08fffd8a5c6", "name": "Tvarka ATK - eID Authentication API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "description": { "content": "Card-native LT eID (ATK) **authentication** (login). A relying party sends its user through a\nchallenge-response: the user's ATK card signs a server-issued, audience-bound challenge with its\n**authentication key** (after PIN), and this API returns a verified identity `{authentication\ncertificate, raw signature, optional assertion}`. It is a proof of possession + PIN, not a\nqualified signature.\n\nThis is scope v15 of `tvarka_atk_qes_api_spec.md`, the `/v1/auth/*` slice. It is **one API, two\ntiers**:\n * **Free tier (Surface A):** auth only, zero-rated. National services (ePaslaugos, Sodra) are\n registered *providers* on this tier. This document + a reference client is what ePaslaugos\n audits.\n * **Paid tier (Surface B):** the same auth endpoints **plus** `/v1/sign/*` (QES) + metering,\n documented separately.\n\nBoth tiers use the **same provider credential management** below; only capability scope and pricing\ndiffer per provider.\n\n## ATK card flow (two-phase, per request)\n 1. `POST /v1/auth/requests` (server-to-server, HTTP Basic) - the provider backend creates a request\n and receives a scoped `clientToken`.\n 2. `POST /v1/auth/{requestId}/certificate` (Bearer clientToken) - the client reads the card's\n **authentication** certificate and submits it; the API returns the exact `dtbs` (data-to-be-\n signed) + the challenge.\n 3. The client drives the card to sign `dtbs` with the auth key (after PIN).\n 4. `POST /v1/auth/{requestId}/complete` (Bearer clientToken) - the client submits the raw signature\n + the single-use `operationToken`; the API verifies it and returns the verified identity.\n\n## Smart-ID and Mobile-ID flow (server-side)\n 1. `POST /v1/auth/requests` uses `method:\"smart_id\"` or `method:\"mobile_id\"`, with\n `personalCode` and, for Mobile-ID, `phoneNumber`.\n 2. The response contains the user verification code and no `clientToken`. Display the code and\n poll `GET /v1/auth/{requestId}` with Basic credentials (or consume the terminal webhook).\n 3. ATK verifies the returned certificate, Lithuanian identity, audience-bound signature, trust,\n key usage, and revocation before publishing `status:\"done\"`.\n\n## Card facts\n * Access is fixed CAN + PIN over PACE; one user PIN. **CAN and PIN never reach this API** - they are\n consumed by the card stack on the client device.\n * The card signs **ECDSA P-256 or P-384** (LT card is dual-curve). `signatureAlgorithm` is reported\n by the card; the `dtbs` digest matches the key curve (P-256 -> SHA-256, P-384 -> SHA-384).\n * ECDSA signatures are accepted as raw P1363 (r||s) or DER (`signatureEncoding`).\n\n## Get access\n Request a zero-rated sandbox key at (issued after a short\n review; test material only). Production credentials are set up with you directly. Full docs,\n rendered reference, and Postman collections at .\n\n\nContact Support:\n Name: Tvarka\n Email: info@tvarka.pro", "type": "text/plain" } } }