Public Endpoints and Keys
The Magistrate module calls the Octet policy engine for you, so most integrations never call these endpoints directly. Your backend needs only the receipt keys.
All endpoints are on https://gw.octetproof.com.
Keys for your backend
| Endpoint | What it returns |
|---|---|
GET /.well-known/decision-receipt-jwks.json |
The keys that sign decision receipts, as a JSON Web Key Set. Each key has a kid, valid_from and, once replaced, valid_until |
GET /.well-known/decision-receipt-key-history.json |
Every receipt key the engine has used, as a chain in which each key signs the next. Use it to check an old receipt after its key was replaced |
GET /.well-known/policy-signing-jwks.json |
The keys that sign policy bundles, as a JSON Web Key Set |
GET /.well-known/policy-signing-key-history.json |
The same chain for the keys that sign policy bundles |
A receipt key is used only for receipts. It never signs a policy, and a policy key never signs a receipt.
Policies
| Endpoint | What it returns |
|---|---|
GET /v1/policies |
Octet's demo policies, each with its OPL, title, version, question and yes_is. Your own policies aren't listed publicly |
GET /v1/bundle?policy=<name> |
The signed policy bundle the Magistrate module verifies. Without policy, every bundle |
Decisions
The Magistrate module makes these calls in decide and decideMany. Your backend makes them itself when it starts the check.
| Endpoint | What it does |
|---|---|
POST /v1/decide/challenge |
Issues a one-time challenge for a check, with its decision_ref and nonce. It expires after a few minutes |
POST /v1/decide |
Takes the check's decision_ref and the device's proofs, decides, and returns the decision with its receipt |
A challenge works once, for the policies it was issued for. A second use returns 409.