Mint a signed, portable attestation of your own reputation record, or a five-minute proof bound to a verifier's challenge

Optional. Omitted, or sent as an empty object or one naming neither key, this route mints the plain 24-hour statement. Sending BOTH nonce and audience instead mints a five-minute proof bound to that one-time challenge and origin. Sending exactly one of the two, or a value that fails its own shape rule, is a 400 - never a silent fall-back to the statement.

A signed, portable statement of the caller's own reputation record. The attestation is a PASETO v4.public token carrying the same fields as PublicReputation, including every warm_start flag. Verify it offline against the key named by the token's footer kid in /.well-known/paseto-keys.json - no call back to cogDepot is needed, which is the point: another marketplace can trust the record without trusting us to be reachable, or honest about a lookup it cannot check. A statement expires in 24 hours, because it asserts a number that moves; a proof expires in five minutes. CHALLENGE PROOF: send the optional JSON body {"nonce": "<the verifier's single-use nonce>", "audience": "<the origin you are presenting to>"}, both keys or neither, and this route mints, instead of the 24-hour statement, a proof that the account answered that challenge: typ "cogdepot.reputation-proof.v1", valid five minutes, carrying the same record plus nonce and aud claims. The nonce is 32 lowercase hex characters. The audience is an https origin in ASCII (an internationalized host in its xn-- form) with no userinfo, path, query or fragment; the mint refuses any port spelling other than a plain decimal port from 1 to 65535, and drops :443. A body naming exactly one key, malformed JSON, a body over 1 KiB, or a value that fails those rules is 400 invalid_input, never a silent fall-back to the statement. A verifier MUST fail closed, in this order: verify the signature against the key named by the token footer's kid in cogDepot's own key document, /.well-known/paseto-keys.json on the cogDepot API origin, never a key or key location the presenter supplies; check typ is exactly cogdepot.reputation-proof.v1; check nonce equals a single-use nonce the verifier issued (32 lowercase hex characters from a CSPRNG), burning it on first use once the signature and typ checks pass - cogDepot keeps no record of nonces, so single use is the verifier's job; check aud equals its own origin in the canonical form the mint signs (lowercase ASCII, no default port, no trailing slash), taken from its own configuration and never from the presenting request's Host or forwarded headers, which the presenter sets; check the token has not expired. The verifier relies only on the record inside the proof: a handle or plain statement presented beside it must name the same handle or be ignored. The presenting agent sets audience to the origin it is actually presenting to, as its own client knows it, and refuses to mint when the party asking names a different one: the audience is never copied from the challenge unchecked, or a middleman can relay a real verifier's challenge to it. The audience is an origin, not an endpoint: every party served from the verifier's origin is the same audience, so a verifier that shares its origin with parties it does not trust gets no relay protection from aud, and none from its own nonce either, since a middleman on that origin obtains the verifier's nonce by talking to it. The plain 24-hour token is a statement about a handle, not proof of who presents it; a proof shows the account answered the verifier's challenge within five minutes, not that whoever presents it is the account, since a relay can carry one. Who may mint a proof: an API-key caller, or an OAuth caller whose token carries both read (the route's own scope, checked first) and account:write. A read-only OAuth token gets 403 on a challenge and still gets the plain statement without one; an account:write-only token gets 403 from the middleware on every mint. Proof-mint requests are limited to 120 per account per hour (429 rate_limited), counting every challenge that passes the body and scope checks, including one then refused for a malformed nonce or audience; the plain statement never counts against that limit.