api.insumermodel.com

{
  "properties": {
    "data": {
      "properties": {
        "attestation": {
          "$ref": "#/components/schemas/Attestation"
        },
        "jwt": {
          "description": "Wallet Auth by InsumerAPI token — ES256 JWT (only present when format: \"jwt\" is requested). Verifiable with any standard JWT library using the JWKS endpoint.",
          "type": "string"
        },
        "kid": {
          "description": "Which key + scheme signed this response. insumer-attest-v1 (v1 attest) or insumer-attest-v2 (v2 attest). Resolve the public key from GET /v1/jwks or https://insumermodel.com/.well-known/jwks.json (all EC kids share one key; post-quantum AKP entries are appended after them).",
          "type": "string"
        },
        "pqJwt": {
          "description": "OPTIONAL sibling of `jwt` when format is `jwt`: a compact JWS with alg ML-DSA-65 (RFC 9964), signed under the post-quantum key insumer-attest-pq1. Additive; `jwt` is unchanged. Verifier contract: after verifying the JWS over its own header.payload bytes, confirm that its payload and the ES256 `jwt` payload carry the identical claim set: the same member names, and for every member a deeply equal JSON value (objects compared without regard to member order, arrays in order, numbers by value). Any difference, whether a changed value, a missing member or an extra member on either side, makes the companion `refuted`. Compare PARSED JSON, never bytes: byte-identical payload segments satisfy this trivially, but a verifier MUST NOT require byte identity, since two serializers may order members differently. Checking only `jti`, `exp` and `pass` is not sufficient: it leaves `results` and `conditionHash` unbound. See the state attestation spec, Section 12 Check 6, and test vectors 24 and 25 (the refused cases).\n",
          "type": "string"
        },
        "pqKid": {
          "description": "OPTIONAL post-quantum key identifier (insumer-attest-pq1 or insumer-trust-pq1), resolved in the JWKS as an RFC 9964 AKP / ML-DSA-65 key.",
          "example": "insumer-attest-pq1",
          "type": "string"
        },
        "pqSig": {
          "description": "OPTIONAL post-quantum companion signature: base64 ML-DSA-65 (FIPS 204) over the post-quantum domain tag plus the exact classical preimage this response's kid selects. A kid a verifier does not recognise selects no preimage, so the companion is then unverifiable, never refuted, and no other era's preimage may be substituted for it. Additive; sig and kid are unchanged. See the state attestation spec, Section 12 Check 6.",
          "type": "string"
        },
        "sig": {
          "description": "ECDSA P-256 signature (base64, P1363). Branch on `kid` to reconstruct the signed bytes: `insumer-attest-v1` → ES256 over JSON.stringify({id, pass, results, attestedAt}); `insumer-attest-v2` → ES256 over the domain-separated, canonical preimage \"insumer.attestation.v2\\n\" + recursive sorted-key canonical JSON of {v:2, id, pass, results, attestedAt} (keys sorted at every level, no whitespace: this is the RFC 8785 / JCS canonical form, so any RFC 8785 serializer reproduces the bytes; all quantities are decimal strings and the only JSON numbers are bounded small integers, so the bytes never depend on a language's floating-point formatting), where the v2 `results[].evaluatedCondition.threshold` is a canonical decimal string and carries no `decimals` field. v1 stays byte-frozen. Verify with `npm install insumer-verify` or `pip install insumer-verify`.\n",
          "type": "string"
        }
      },
      "type": "object"
    },
    "meta": {
      "properties": {
        "creditsCharged": {
          "description": "1 for standard, 2 for proof: merkle. 0 on x402-paid calls.",
          "type": "integer"
        },
        "creditsRemaining": {
          "description": "Credits left on the key after this call. null on x402-paid calls (creditsCharged is 0 there; the call was paid at the transport layer, not from stored credits).",
          "type": [
            "integer",
            "null"
          ]
        },
        "timestamp": {
          "format": "date-time",
          "type": "string"
        },
        "version": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "ok": {
      "const": true,
      "type": "boolean"
    }
  },
  "type": "object"
}