{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/coincover/main/json-schema/coincover-assign-key-request-schema.json",
  "title": "AssignKeyRequest",
  "x-generated": "2026-10-09",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_original/coincover-institutional-openapi-openapi.json#/components/schemas/AssignKeyRequest",
  "type": "object",
  "required": [
    "user_identifier",
    "key_type"
  ],
  "properties": {
    "user_identifier": {
      "type": "string",
      "description": "Unique identifier of the user"
    },
    "key_type": {
      "type": "string",
      "enum": [
        "rsa4096",
        "secp256k1",
        "ed25519"
      ],
      "description": "Type of cryptographic key to generate. rsa4096 for encrypting recovery material; secp256k1 or ed25519 for a blockchain backup signer."
    },
    "key_environment": {
      "type": "string",
      "enum": [
        "HOT",
        "COLD"
      ],
      "default": "HOT",
      "description": "Key environment specification - HOT (online generation) or COLD (offline generation)"
    },
    "organisation": {
      "type": "object",
      "description": "Optional organisation metadata",
      "properties": {
        "customer_id": {
          "type": "string",
          "description": "Unique identifier for the organisation"
        },
        "customer_name": {
          "type": "string",
          "description": "Name of the organisation customer"
        }
      }
    },
    "package": {
      "type": "object",
      "description": "Optional package metadata",
      "properties": {
        "package_id": {
          "type": "string",
          "description": "External package ID assigned to the key"
        },
        "package_name": {
          "type": "string",
          "description": "Name of the package"
        }
      }
    },
    "sign_with": {
      "type": "array",
      "description": "Optional list of context fields to bind into the enclave signature. When present, the enclave signs a JCS-canonical (RFC 8785) JSON payload built from these fields plus the public_key (always included), returned as signed_payload, so a verified signature attests to the business context the key was issued for — not just the key bytes. Do not list public_key here; it is included implicitly.",
      "items": {
        "type": "string",
        "enum": [
          "external_customer_id",
          "external_package_id",
          "pulled_by_id",
          "pulled_by_type",
          "user_id",
          "key_id",
          "key_fingerprint"
        ]
      }
    }
  }
}