openapi: 3.1.0
info:
  title: Mobile-ID Trusted SIC Reference API
  version: 1.1.0-design
  description: HTML-first controlled-pilot reference. Availability, schemas and limits
    require an approved release record.
  contact:
    name: Mobile-ID QuantumSafe API team
    url: https://quantumsafe.mobile-id.vn/developers/api/
servers:
- url: https://sandbox.quantumsafe.mobile-id.vn
  description: Illustrative sandbox URL; availability must be confirmed
tags:
- name: Signing requests
- name: Approval
- name: Activation
- name: Profiles
- name: Providers
- name: Signatures
- name: ASiC
- name: Verification
- name: Evidence
- name: Webhooks
paths:
  /v1/signing-requests:
    post:
      tags:
      - Signing requests
      summary: Create a policy-bound signing request
      operationId: createSigningRequest
      security:
      - oauth2:
        - signing.request
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '202':
          description: Accepted
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SigningRequest'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SigningRequestCreate'
            examples:
              default:
                value: {}
  /v1/signing-requests/{signingRequestId}:
    get:
      tags:
      - Signing requests
      summary: Read a signing request
      operationId: getSigningRequest
      security:
      - oauth2:
        - signing.request
      - mutualTLS: []
      parameters:
      - name: signingRequestId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SigningRequest'
    delete:
      tags:
      - Signing requests
      summary: Cancel a non-terminal signing request
      operationId: cancelSigningRequest
      security:
      - oauth2:
        - signing.request
      - mutualTLS: []
      parameters:
      - name: signingRequestId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SigningRequest'
  /v1/signing-requests/{signingRequestId}/approval-options:
    post:
      tags:
      - Approval
      summary: Create WebAuthn approval options
      operationId: createApprovalOptions
      security:
      - oauth2:
        - signing.approve
      - mutualTLS: []
      parameters:
      - name: signingRequestId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApprovalOptions'
  /v1/signing-requests/{signingRequestId}/webauthn/verify:
    post:
      tags:
      - Approval
      summary: Verify a WebAuthn assertion
      operationId: verifyWebAuthnApproval
      security:
      - oauth2:
        - signing.approve
      - mutualTLS: []
      parameters:
      - name: signingRequestId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebAuthnVerificationResult'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnAssertion'
            examples:
              default:
                value: {}
  /v1/signing-requests/{signingRequestId}/activation:
    post:
      tags:
      - Activation
      summary: Issue signature activation data
      operationId: activateSigningRequest
      security:
      - oauth2:
        - signing.activate
      - mutualTLS: []
      parameters:
      - name: signingRequestId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignatureActivationData'
  /v1/signing-profiles:
    get:
      tags:
      - Profiles
      summary: List approved signing profiles
      operationId: listSigningProfiles
      security:
      - oauth2:
        - signing.request
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SigningProfile'
  /v1/ca-providers:
    get:
      tags:
      - Providers
      summary: List approved CA/provider routes
      operationId: listCAProviders
      security:
      - oauth2:
        - signing.request
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CAProvider'
  /v1/signatures:
    post:
      tags:
      - Signatures
      summary: Execute an approved signature operation
      operationId: createSignature
      security:
      - oauth2:
        - signing.execute
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '202':
          description: Accepted
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignatureOperation'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignatureOperationCreate'
            examples:
              default:
                value: {}
  /v1/signatures/{signatureId}:
    get:
      tags:
      - Signatures
      summary: Read signature operation
      operationId: getSignature
      security:
      - oauth2:
        - signing.execute
      - mutualTLS: []
      parameters:
      - name: signatureId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignatureOperation'
  /v1/asic-packages:
    post:
      tags:
      - ASiC
      summary: Create an ASiC evidence package
      operationId: createASiCPackage
      security:
      - oauth2:
        - signing.execute
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '202':
          description: Accepted
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ASiCPackage'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ASiCPackageCreate'
            examples:
              default:
                value: {}
  /v1/asic-packages/{packageId}:
    get:
      tags:
      - ASiC
      summary: Read ASiC package status
      operationId: getASiCPackage
      security:
      - oauth2:
        - signing.execute
      - mutualTLS: []
      parameters:
      - name: packageId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ASiCPackage'
  /v1/verifications:
    post:
      tags:
      - Verification
      summary: Create a verification job
      operationId: createVerification
      security:
      - oauth2:
        - evidence.read
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '202':
          description: Accepted
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerificationResult'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerificationRequest'
            examples:
              default:
                value: {}
  /v1/verifications/{verificationId}:
    get:
      tags:
      - Verification
      summary: Read verification result
      operationId: getVerification
      security:
      - oauth2:
        - evidence.read
      - mutualTLS: []
      parameters:
      - name: verificationId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerificationResult'
  /v1/evidence-receipts/{receiptId}:
    get:
      tags:
      - Evidence
      summary: Read evidence receipt
      operationId: getEvidenceReceipt
      security:
      - oauth2:
        - evidence.read
      - mutualTLS: []
      parameters:
      - name: receiptId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EvidenceReceipt'
  /v1/evidence-packages/{packageId}/renewals:
    post:
      tags:
      - Evidence
      summary: Request evidence renewal
      operationId: createEvidenceRenewal
      security:
      - oauth2:
        - evidence.renew
      - mutualTLS: []
      parameters:
      - name: packageId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '202':
          description: Accepted
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EvidenceReceipt'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RenewalRequest'
            examples:
              default:
                value: {}
  /v1/webhook-subscriptions:
    post:
      tags:
      - Webhooks
      summary: Create a webhook subscription
      operationId: createWebhookSubscription
      security:
      - oauth2:
        - admin.providers
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookSubscription'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookSubscription'
            examples:
              default:
                value: {}
    get:
      tags:
      - Webhooks
      summary: List webhook subscriptions
      operationId: listWebhookSubscriptions
      security:
      - oauth2:
        - admin.providers
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookSubscription'
  /v1/webhook-subscriptions/{subscriptionId}:
    delete:
      tags:
      - Webhooks
      summary: Delete a webhook subscription
      operationId: deleteWebhookSubscription
      security:
      - oauth2:
        - admin.providers
      - mutualTLS: []
      parameters:
      - name: subscriptionId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
  /v1/provider-health:
    get:
      tags:
      - Providers
      summary: Read provider health summary
      operationId: getProviderHealth
      security:
      - oauth2:
        - admin.providers
      - mutualTLS: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      responses:
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'
        '503':
          $ref: '#/components/responses/Problem'
        '200':
          description: Successful response
          headers:
            Location:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CAProvider'
components:
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://sso.mobile-id.vn/oauth2/token
          scopes:
            signing.request: Create and read signing requests
            signing.approve: Verify signer approval
            signing.activate: Issue/consume signature activation
            signing.execute: Execute approved signatures and packaging
            evidence.read: Read verification and evidence
            evidence.renew: Renew evidence
            admin.providers: Administer provider routes/webhooks
    mutualTLS:
      type: mutualTLS
  parameters:
    CorrelationId:
      name: X-Correlation-Id
      in: header
      required: true
      schema:
        type: string
        format: uuid
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: true
      schema:
        type: string
        maxLength: 128
  schemas:
    Hash:
      type: object
      required:
      - algorithm
      - value
      properties:
        algorithm:
          type: string
          enum:
          - SHA-256
          - SHA-384
          - SHA-512
        value:
          type: string
          contentEncoding: base64
    DocumentDigest:
      type: object
      required:
      - documentId
      - digest
      properties:
        documentId:
          type: string
        name:
          type: string
        mimeType:
          type: string
        digest:
          $ref: '#/components/schemas/Hash'
    TransactionContext:
      type: object
      properties:
        purpose:
          type: string
        amount:
          type: number
        currency:
          type: string
        reference:
          type: string
        displayText:
          type: string
    SignerContext:
      type: object
      required:
      - subject
      properties:
        subject:
          type: string
        tenantId:
          type: string
        relyingPartyId:
          type: string
        assuranceLevel:
          type: string
    SigningRequestCreate:
      type: object
      required:
      - signer
      - documents
      - profileId
      properties:
        signer:
          $ref: '#/components/schemas/SignerContext'
        documents:
          type: array
          items:
            $ref: '#/components/schemas/DocumentDigest'
        transaction:
          $ref: '#/components/schemas/TransactionContext'
        profileId:
          type: string
        preferredProviderId:
          type: string
        format:
          type: string
          enum:
          - PAdES
          - CAdES
          - XAdES
          - ASiC
        evidencePolicyId:
          type: string
    SigningRequest:
      allOf:
      - $ref: '#/components/schemas/SigningRequestCreate'
      - type: object
        required:
        - id
        - state
        - createdAt
        properties:
          id:
            type: string
          state:
            $ref: '#/components/schemas/SigningRequestState'
          createdAt:
            type: string
            format: date-time
          expiresAt:
            type: string
            format: date-time
          version:
            type: integer
    SigningRequestState:
      type: string
      enum:
      - created
      - awaiting_approval
      - approved
      - activated
      - signing
      - completed
      - rejected
      - expired
      - cancelled
      - provider_unavailable
      - failed
    ApprovalOptions:
      type: object
      properties:
        challenge:
          type: string
        rpId:
          type: string
        timeout:
          type: integer
        allowedCredentialIds:
          type: array
          items:
            type: string
        transactionDisplay:
          type: string
    WebAuthnAssertion:
      type: object
      required:
      - credentialId
      - clientDataJSON
      - authenticatorData
      - signature
      properties:
        credentialId:
          type: string
        clientDataJSON:
          type: string
        authenticatorData:
          type: string
        signature:
          type: string
        userHandle:
          type: string
    WebAuthnVerificationResult:
      type: object
      properties:
        verified:
          type: boolean
        authenticationContext:
          type: string
        credentialIdMasked:
          type: string
        counterStatus:
          type: string
    SignatureActivationData:
      type: object
      properties:
        activationId:
          type: string
        expiresAt:
          type: string
          format: date-time
        purpose:
          type: string
        boundDocumentDigests:
          type: array
          items:
            $ref: '#/components/schemas/Hash'
        providerRouteId:
          type: string
    SigningProfile:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        maturity:
          type: string
        format:
          type: string
        classicalAlgorithm:
          type: string
        pqcAlgorithm:
          type: string
        packaging:
          type: string
        verifierProfile:
          type: string
    CAProvider:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        connectorType:
          type: string
        health:
          type: string
        profiles:
          type: array
          items:
            type: string
    SignatureOperationCreate:
      type: object
      required:
      - signingRequestId
      - activationId
      properties:
        signingRequestId:
          type: string
        activationId:
          type: string
        providerId:
          type: string
    SignatureOperation:
      type: object
      properties:
        id:
          type: string
        state:
          type: string
        signatureValue:
          type: string
        algorithm:
          type: string
        providerId:
          type: string
        completedAt:
          type: string
          format: date-time
    ASiCPackageCreate:
      type: object
      required:
      - signingRequestId
      properties:
        signingRequestId:
          type: string
        profile:
          type: string
          enum:
          - ASiC-S
          - ASiC-E
        includeValidationReport:
          type: boolean
        includeRevocationData:
          type: boolean
        timestampPolicyId:
          type: string
    ASiCPackage:
      type: object
      properties:
        id:
          type: string
        state:
          type: string
        profile:
          type: string
        downloadUrl:
          type: string
          format: uri
        manifestDigest:
          $ref: '#/components/schemas/Hash'
        evidenceReceiptId:
          type: string
    VerificationRequest:
      type: object
      properties:
        artifactUrl:
          type: string
          format: uri
        artifactDigest:
          $ref: '#/components/schemas/Hash'
        policyId:
          type: string
    VerificationResult:
      type: object
      properties:
        id:
          type: string
        overallStatus:
          type: string
        classicalStatus:
          type: string
        pqcStatus:
          type: string
        timestampStatus:
          type: string
        certificatePathStatus:
          type: string
        evidenceReceiptId:
          type: string
    EvidenceReceipt:
      type: object
      properties:
        id:
          type: string
        correlationId:
          type: string
        createdAt:
          type: string
          format: date-time
        artifactDigest:
          $ref: '#/components/schemas/Hash'
        events:
          type: array
          items:
            type: object
    RenewalRequest:
      type: object
      properties:
        evidencePackageId:
          type: string
        policyId:
          type: string
        reason:
          type: string
    WebhookSubscription:
      type: object
      properties:
        id:
          type: string
        url:
          type: string
          format: uri
        eventTypes:
          type: array
          items:
            type: string
        signingKeyId:
          type: string
        status:
          type: string
    ProblemDetail:
      type: object
      required:
      - type
      - title
      - status
      properties:
        type:
          type: string
          format: uri
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        instance:
          type: string
        correlationId:
          type: string
        retryable:
          type: boolean
        errors:
          type: array
          items:
            type: object
  responses:
    Problem:
      description: RFC 9457-style problem detail
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
security:
- oauth2: []
