37 lines
1.1 KiB
JSON
37 lines
1.1 KiB
JSON
{
|
|
"contract_pack_version": "0.1.0",
|
|
"service_authentication": {
|
|
"caller_binding": "registered caller, operation scope, and tenant allowlist",
|
|
"header": "Authorization",
|
|
"identity_source": "deployment-managed opaque service token",
|
|
"replay": "Service-token replay protection is owned by the deployment boundary.",
|
|
"rotation": "Provision a replacement token, verify it, then revoke the old token.",
|
|
"scheme": "Bearer"
|
|
},
|
|
"tenant_credential": {
|
|
"forbidden_surfaces": [
|
|
"database",
|
|
"queue",
|
|
"cache",
|
|
"checkpoint",
|
|
"logs",
|
|
"traces",
|
|
"events",
|
|
"browser"
|
|
],
|
|
"header": "X-Tenant-VKey",
|
|
"owner": "caller and AIHub",
|
|
"persistence": "in-memory execution attempt only"
|
|
},
|
|
"webhook_authentication": {
|
|
"algorithm": "HMAC-SHA256",
|
|
"headers": [
|
|
"X-DotB-Webhook-Id",
|
|
"X-DotB-Webhook-Key-Id",
|
|
"X-DotB-Webhook-Timestamp",
|
|
"X-DotB-Webhook-Signature"
|
|
],
|
|
"rotation": "Receiver may accept active and immediately previous key during a bounded window."
|
|
}
|
|
}
|