Skip to main content
POST
Issue an Ed25519-signed Ambient credential

Authorizations

X-Ambient-Actor
string
header
required

Provisioned actor identifier.

X-Ambient-Timestamp
string
header
required

Current Unix timestamp in seconds, within the configured clock-skew window.

Authorization
string
header
required

Ambient-HMAC followed by a space and the unpadded base64url HMAC-SHA256 signature. See Authentication and authority for the canonical input.

Body

application/json
commandId
string
required

Actor-scoped idempotency key. Retry the identical command with the same value.

Minimum string length: 1
credentialId
string
required
Minimum string length: 1
subjectPrincipalId
string
required

Principal represented by the authenticated actor.

Minimum string length: 1
type
string
required
Minimum string length: 1
claims
object
required
validUntil
string<date-time>

Response

Credential signed and stored, or an identical command replayed.

id
string
required
issuerPrincipalId
string
required

Principal represented by the authenticated actor.

Minimum string length: 1
issuingActorId
string
required
subjectPrincipalId
string
required

Principal represented by the authenticated actor.

Minimum string length: 1
type
string
required
claims
object
required
issuedAt
string<date-time>
required
signingKeyId
string
required
payloadVersion
string
required
Allowed value: "ambient-credential.v1"
signature
string
required

Unpadded base64url Ed25519 signature over the canonical Ambient credential payload.

authorityRef
string
validUntil
string<date-time>
revokedAt
string<date-time>