{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://odexa.io/schemas/1.2.0-draft.3/delegation.schema.json",
  "title": "Odexa draft-3 delegated operational authority",
  "$comment": "Unpublished candidate-work identifier. Structural superset only. Exact unsigned integer tokens, calendar/URL/key validation, authority observations, intersections, deadlines and current trust require semantic evaluation. No network request or signature verification is performed by this schema.",
  "$ref": "#/$defs/authority",
  "$defs": {
    "authority": {
      "type": "object",
      "properties": {
        "protocol_version": {
          "const": "1.2.0-draft.3"
        },
        "policy_protocol_version": {
          "const": "1.2.0-draft.1"
        },
        "origin": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "policy_id": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "revision": {
          "type": "integer",
          "minimum": 1,
          "maximum": 9007199254740991
        },
        "issued_at": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "expires_at": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "services": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/service"
          },
          "minItems": 1,
          "maxItems": 16,
          "uniqueItems": true
        },
        "delegations": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/delegation"
          },
          "minItems": 0,
          "maxItems": 64,
          "uniqueItems": true
        }
      },
      "required": [
        "protocol_version",
        "policy_protocol_version",
        "origin",
        "policy_id",
        "revision",
        "issued_at",
        "expires_at",
        "services",
        "delegations"
      ],
      "additionalProperties": false
    },
    "service": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "base_url": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "issuer": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "capabilities": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "introspect",
              "issue_agreements",
              "issue_tokens",
              "publish_assets",
              "receive_events",
              "verify_payments",
              "export_evidence"
            ]
          },
          "minItems": 1,
          "maxItems": 6,
          "uniqueItems": true
        },
        "signing_keys": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/key"
          },
          "minItems": 1,
          "maxItems": 16,
          "uniqueItems": true
        },
        "limits": {
          "anyOf": [
            {
              "$ref": "#/$defs/limits"
            },
            {
              "type": "null"
            }
          ]
        },
        "scope": {
          "$ref": "#/$defs/scope"
        }
      },
      "required": [
        "id",
        "base_url",
        "issuer",
        "capabilities",
        "signing_keys",
        "limits",
        "scope"
      ],
      "additionalProperties": false
    },
    "delegation": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "origin": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "delegate_service_id": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "capabilities": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "introspect",
              "issue_agreements",
              "issue_tokens",
              "publish_assets",
              "receive_events",
              "verify_payments",
              "export_evidence"
            ]
          },
          "minItems": 1,
          "maxItems": 6,
          "uniqueItems": true
        },
        "resource_ids": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 128
          },
          "minItems": 1,
          "maxItems": 256,
          "uniqueItems": true
        },
        "actions": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "redistribute",
              "retrieve",
              "store",
              "transform"
            ]
          },
          "minItems": 1,
          "maxItems": 4,
          "uniqueItems": true
        },
        "purposes": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "internal_knowledge",
              "model_fine_tuning",
              "model_training",
              "public_retrieval",
              "redistribution",
              "search_indexing"
            ]
          },
          "minItems": 1,
          "maxItems": 6,
          "uniqueItems": true
        },
        "asset_id_prefixes": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uri",
            "pattern": "^https://",
            "maxLength": 4096
          },
          "minItems": 0,
          "maxItems": 64,
          "uniqueItems": true
        },
        "version_id_prefixes": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uri",
            "pattern": "^https://",
            "maxLength": 4096
          },
          "minItems": 0,
          "maxItems": 64,
          "uniqueItems": true
        },
        "issued_at": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "expires_at": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "max_access_seconds": {
          "type": "integer",
          "minimum": 0,
          "maximum": 31536000
        },
        "max_use_seconds": {
          "type": "integer",
          "minimum": 0,
          "maximum": 31536000
        },
        "payment_mode": {
          "type": "string",
          "enum": [
            "external",
            "none"
          ]
        },
        "allow_subdelegation": {
          "const": false
        }
      },
      "required": [
        "id",
        "origin",
        "delegate_service_id",
        "capabilities",
        "resource_ids",
        "actions",
        "purposes",
        "asset_id_prefixes",
        "version_id_prefixes",
        "issued_at",
        "expires_at",
        "max_access_seconds",
        "max_use_seconds",
        "payment_mode",
        "allow_subdelegation"
      ],
      "additionalProperties": false
    },
    "scope": {
      "type": "object",
      "properties": {
        "resource_ids": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 128
          },
          "minItems": 1,
          "maxItems": 256,
          "uniqueItems": true
        },
        "actions": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "redistribute",
              "retrieve",
              "store",
              "transform"
            ]
          },
          "minItems": 1,
          "maxItems": 4,
          "uniqueItems": true
        },
        "purposes": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "internal_knowledge",
              "model_fine_tuning",
              "model_training",
              "public_retrieval",
              "redistribution",
              "search_indexing"
            ]
          },
          "minItems": 1,
          "maxItems": 6,
          "uniqueItems": true
        },
        "asset_id_prefixes": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uri",
            "pattern": "^https://",
            "maxLength": 4096
          },
          "minItems": 0,
          "maxItems": 64,
          "uniqueItems": true
        },
        "version_id_prefixes": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uri",
            "pattern": "^https://",
            "maxLength": 4096
          },
          "minItems": 0,
          "maxItems": 64,
          "uniqueItems": true
        }
      },
      "required": [
        "resource_ids",
        "actions",
        "purposes",
        "asset_id_prefixes",
        "version_id_prefixes"
      ],
      "additionalProperties": false
    },
    "key": {
      "type": "object",
      "properties": {
        "kid": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "public_jwk": {
          "type": "object",
          "properties": {
            "kty": {
              "const": "EC"
            },
            "crv": {
              "const": "P-256"
            },
            "x": {
              "type": "string",
              "pattern": "^[A-Za-z0-9_-]{43}$"
            },
            "y": {
              "type": "string",
              "pattern": "^[A-Za-z0-9_-]{43}$"
            }
          },
          "required": [
            "kty",
            "crv",
            "x",
            "y"
          ],
          "additionalProperties": false
        },
        "uses": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "odexa-asset-manifest+jws",
              "odexa-event+jws",
              "odexa-event-record+jws",
              "odexa-payment-status+jws",
              "odexa-receipt+jws",
              "odexa-status+jws",
              "odexa-evidence-export+jws"
            ]
          },
          "minItems": 1,
          "maxItems": 6,
          "uniqueItems": true
        },
        "not_before": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "not_after": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "state": {
          "type": "string",
          "enum": [
            "active",
            "retired",
            "revoked"
          ]
        },
        "retired_at": {
          "anyOf": [
            {
              "type": "string",
              "format": "date-time",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
            },
            {
              "type": "null"
            }
          ]
        },
        "revoked_at": {
          "anyOf": [
            {
              "type": "string",
              "format": "date-time",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "required": [
        "kid",
        "public_jwk",
        "uses",
        "not_before",
        "not_after",
        "state",
        "retired_at",
        "revoked_at"
      ],
      "additionalProperties": false
    },
    "limits": {
      "type": "object",
      "properties": {
        "max_offer_seconds": {
          "type": "integer",
          "minimum": 1,
          "maximum": 600
        },
        "max_access_seconds": {
          "type": "integer",
          "minimum": 1,
          "maximum": 31536000
        },
        "max_use_seconds": {
          "type": "integer",
          "minimum": 1,
          "maximum": 31536000
        },
        "payment_mode": {
          "type": "string",
          "enum": [
            "external",
            "none"
          ]
        }
      },
      "required": [
        "max_offer_seconds",
        "max_access_seconds",
        "max_use_seconds",
        "payment_mode"
      ],
      "additionalProperties": false
    },
    "request": {
      "type": "object",
      "properties": {
        "url": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "actions": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "redistribute",
              "retrieve",
              "store",
              "transform"
            ]
          },
          "minItems": 1,
          "maxItems": 4,
          "uniqueItems": true
        },
        "purposes": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "internal_knowledge",
              "model_fine_tuning",
              "model_training",
              "public_retrieval",
              "redistribution",
              "search_indexing"
            ]
          },
          "minItems": 1,
          "maxItems": 6,
          "uniqueItems": true
        },
        "supported_obligations": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "attribution",
              "report_usage",
              "retention"
            ]
          },
          "minItems": 0,
          "maxItems": 3,
          "uniqueItems": true
        }
      },
      "required": [
        "url",
        "actions",
        "purposes",
        "supported_obligations"
      ],
      "additionalProperties": false
    },
    "operation": {
      "type": "object",
      "properties": {
        "kind": {
          "type": "string",
          "enum": [
            "accept",
            "introspect",
            "offer",
            "publish_manifest",
            "report",
            "token",
            "verify_payment",
            "status",
            "revoke",
            "export_evidence",
            "payment_mandate",
            "payment_check"
          ]
        },
        "origin": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "service_id": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "issuer": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "endpoint": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "delegation_id": {
          "anyOf": [
            {
              "type": "string",
              "format": "uri",
              "pattern": "^https://",
              "maxLength": 4096
            },
            {
              "type": "null"
            }
          ]
        },
        "key_id": {
          "anyOf": [
            {
              "type": "string",
              "format": "uri",
              "pattern": "^https://",
              "maxLength": 4096
            },
            {
              "type": "null"
            }
          ]
        },
        "key_use": {
          "anyOf": [
            {
              "type": "string",
              "enum": [
                "odexa-asset-manifest+jws",
                "odexa-event+jws",
                "odexa-event-record+jws",
                "odexa-payment-status+jws",
                "odexa-receipt+jws",
                "odexa-status+jws",
                "odexa-evidence-export+jws"
              ]
            },
            {
              "type": "null"
            }
          ]
        },
        "request": {
          "$ref": "#/$defs/request"
        },
        "offer_seconds": {
          "type": "integer",
          "minimum": 0,
          "maximum": 600
        },
        "access_seconds": {
          "type": "integer",
          "minimum": 0,
          "maximum": 31536000
        },
        "use_seconds": {
          "type": "integer",
          "minimum": 0,
          "maximum": 31536000
        },
        "payment_mode": {
          "type": "string",
          "enum": [
            "external",
            "none"
          ]
        },
        "asset_id": {
          "anyOf": [
            {
              "type": "string",
              "format": "uri",
              "pattern": "^https://",
              "maxLength": 4096
            },
            {
              "type": "null"
            }
          ]
        },
        "version_id": {
          "anyOf": [
            {
              "type": "string",
              "format": "uri",
              "pattern": "^https://",
              "maxLength": 4096
            },
            {
              "type": "null"
            }
          ]
        },
        "operation_id": {
          "type": "string",
          "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
        },
        "payment_request_digest": {
          "anyOf": [
            {
              "type": "string",
              "pattern": "^sha256:[0-9a-f]{64}$"
            },
            {
              "type": "null"
            }
          ]
        },
        "agreement_id": {
          "type": "string",
          "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
        }
      },
      "required": [
        "kind",
        "origin",
        "service_id",
        "issuer",
        "endpoint",
        "delegation_id",
        "key_id",
        "key_use",
        "request",
        "offer_seconds",
        "access_seconds",
        "use_seconds",
        "payment_mode",
        "asset_id",
        "version_id",
        "operation_id",
        "payment_request_digest"
      ],
      "additionalProperties": false,
      "allOf": [
        {
          "if": {
            "properties": {
              "kind": {
                "enum": [
                  "status",
                  "revoke",
                  "export_evidence",
                  "payment_mandate",
                  "payment_check"
                ]
              }
            },
            "required": [
              "kind"
            ]
          },
          "then": {
            "required": [
              "agreement_id"
            ],
            "properties": {
              "offer_seconds": {
                "const": 0
              },
              "access_seconds": {
                "const": 0
              },
              "use_seconds": {
                "const": 0
              },
              "agreement_id": {
                "type": "string",
                "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
              }
            }
          },
          "else": {
            "not": {
              "required": [
                "agreement_id"
              ],
              "properties": {
                "agreement_id": {}
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "kind": {
                "enum": [
                  "status",
                  "revoke"
                ]
              }
            },
            "required": [
              "kind"
            ]
          },
          "then": {
            "properties": {
              "payment_mode": {
                "const": "none"
              },
              "key_use": {
                "const": "odexa-status+jws"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "kind": {
                "enum": [
                  "export_evidence"
                ]
              }
            },
            "required": [
              "kind"
            ]
          },
          "then": {
            "properties": {
              "payment_mode": {
                "const": "none"
              },
              "key_use": {
                "const": "odexa-evidence-export+jws"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "kind": {
                "enum": [
                  "payment_mandate",
                  "payment_check"
                ]
              }
            },
            "required": [
              "kind"
            ]
          },
          "then": {
            "properties": {
              "payment_mode": {
                "const": "external"
              },
              "key_use": {
                "const": null
              }
            }
          }
        }
      ]
    },
    "observation": {
      "type": "object",
      "properties": {
        "source": {
          "type": "string",
          "enum": [
            "colocated",
            "https"
          ]
        },
        "origin": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "authority_url": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "policy_url": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://",
          "maxLength": 4096
        },
        "authority_digest": {
          "type": "string",
          "pattern": "^sha256:[0-9a-f]{64}$"
        },
        "policy_digest": {
          "type": "string",
          "pattern": "^sha256:[0-9a-f]{64}$"
        },
        "checked_at": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "available": {
          "type": "boolean"
        },
        "tls_verified": {
          "type": "boolean"
        },
        "redirected": {
          "type": "boolean"
        },
        "revalidated": {
          "type": "boolean"
        }
      },
      "required": [
        "source",
        "origin",
        "authority_url",
        "policy_url",
        "authority_digest",
        "policy_digest",
        "checked_at",
        "available",
        "tls_verified",
        "redirected",
        "revalidated"
      ],
      "additionalProperties": false
    }
  }
}