JWKS Pinned-Directory Check

Confirms a caller-supplied JWKS directory document matches a caller-pinned SHA-256 digest -- sha256(canonicalize(directory_jwks)) === pinned_digest -- before art-130 trusts the document's internal shape. Canonicalization is this codebase's one JCS/RFC-8785 canon (recursive key-sort, array order preserved), hashed as lowercase hex, so two honest callers hashing the same logical document land on the same digest. Zero network, zero key hosting: both the directory document and the pinned digest are supplied by the caller, never fetched, cached, or served by this tool. Chains before art-130 in the visa-tap-agent-verification chain, so a substituted directory fails before its shape is even checked.

Tool URL: https://ainumbers.co/chaingraph/art-609-jwks-pinned-directory-check.html AP2/Policy Mandate export: yes

post/v1/tools/check_jwks_pinned_directory

Request

Base URL: https://ainumbers.co
URL: https://ainumbers.co/v1/tools/check_jwks_pinned_directory
Auth: none declared

Request body

directory_jwksobject required

pinned_digeststring required

Response

Successful tool execution result

computed_digeststring

sha256(canonicalize(directory_jwks)), lowercase hex.

pinned_digeststring nullable

pinned_digest_well_formedboolean

True only if pinned_digest is present and matches 64 lowercase-or-mixed-case hex characters.

digest_matchboolean

key_countnumber

Changes

No recorded changes to this operation across all 1 revision of this API.