openapi: 3.2.0
info:
  title: AUX Evidence and Certification Certifications API
  version: aux-preflight-0.2.0
  description: Production contract. Synthetic experiments and compatibility routes are excluded.
servers:
- url: https://api.aux.prdictionedge.ai
tags:
- name: Certifications
paths:
  /v1/certifications:
    post:
      operationId: certifyTransaction
      summary: Attempt bounded AUX independent certification for the selected live profile…
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificationRequest'
      responses:
        '200':
          description: Signed CERTIFIED result
        '409':
          description: NOT_CERTIFIABLE due to adverse independently verified evidence
        '422':
          description: REQUIREMENTS_OUTSTANDING due to caller/actionable evidence gaps
        '503':
          description: SOURCE_TEMPORARILY_UNAVAILABLE; no certification decision made
      tags:
      - Certifications
  /v1/certifications/verify:
    post:
      operationId: verifyAuxCertification
      summary: Verify an AUX certification signature and evidence/requirements commitments
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - certification
      responses:
        '200':
          description: Certification verification result
        '400':
          description: Invalid request
      tags:
      - Certifications
  /v1/certifications/policy-check:
    get:
      operationId: getAuxCertificationPolicyContract
      summary: Get the downstream acceptance-policy contract for portable AUX certifications
      responses:
        '200':
          description: Receipt policy-check contract
      tags:
      - Certifications
    post:
      operationId: checkAuxCertificationPolicy
      summary: Verify a signed AUX certification and evaluate it against a downstream consumer…
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - certification
              - policy
              properties:
                certification:
                  type: object
                policy:
                  type: object
                  required:
                  - policy_id
                  - allowed_profiles
                  - max_age_seconds
                  properties:
                    policy_id:
                      type: string
                    allowed_profiles:
                      type: array
                      minItems: 1
                      items:
                        type: object
                        required:
                        - profile_id
                        - versions
                        properties:
                          profile_id:
                            type: string
                          versions:
                            type: array
                            minItems: 1
                            items:
                              type: string
                    max_age_seconds:
                      type: integer
                      minimum: 1
                      maximum: 604800
                    required_requirement_ids:
                      type: array
                      items:
                        type: string
                    expected_certification_id:
                      type: string
                    expected_proposal_hash:
                      type: string
                      pattern: ^[a-fA-F0-9]{64}$
                    expected_evidence_set_hash:
                      type: string
                      pattern: ^[a-fA-F0-9]{64}$
      responses:
        '200':
          description: ACCEPT, REJECT, or INVALID_RECEIPT policy result
        '400':
          description: Invalid request or policy
      tags:
      - Certifications
  /v1/certifications/domain-policy-check:
    get:
      operationId: getAuxDomainCertificationPolicyContract
      summary: Get the domain-resolved consumer-policy interoperability contract
      responses:
        '200':
          description: Domain policy-check contract
      tags:
      - Certifications
    post:
      operationId: checkAuxCertificationAgainstDomainPolicy
      summary: Resolve a consumer's published AUX acceptance policy from its HTTPS domain and…
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - certification
              - consumer_domain
              properties:
                certification:
                  type: object
                consumer_domain:
                  type: string
      responses:
        '200':
          description: ACCEPT, REJECT, or INVALID_RECEIPT under the resolved domain policy
        '400':
          description: Invalid request or consumer domain
        '422':
          description: Consumer policy not configured or invalid
        '503':
          description: Consumer policy source temporarily unavailable
      tags:
      - Certifications
components:
  schemas:
    CertificationRequest:
      type: object
      required:
      - proposal
      properties:
        profile_id:
          type: string
          enum:
          - vendor_payment_pre_action
          - counterparty_registry_pre_action
          - counterparty_identity_pre_action
          default: vendor_payment_pre_action
        proposal:
          type: object
        transaction_history:
          type: array
          items:
            type: object
          maxItems: 1000
        source_attestations:
          type: array
          items:
            type: object
            required:
            - source_domain
            - jws
          maxItems: 20
        evidence_bundles:
          type: array
          items:
            type: object
          maxItems: 30
      description: Select a live profile with profile_id. OpenAPI advertises live profiles only; shadow profiles are intentionally excluded from discovery. Omit profile_id for backwards-compatible vendor_payment_pre_action behavior.