Attestation

Mint a short-lived artifacts.mnemom vault bearer for the caller's active org, or for another org the caller is an accepted member of.

Authenticates the caller's platform session, reads the caller's orgs and roles from get_user_context, and returns a 300-second Ed25519 JWS (claims org_id, org_role, typed sub: user:<id>, and a UUIDv4 jti) signed with a DEDICATED vault key (not the AAP attestation key) whose public half is published in /v1/.well-known/jwks.json. The org defaults to the caller's active org and its role. An optional JSON body {org_id} names a different org instead: it must be one of the caller's ACCEPTED memberships (a pending invite is not membership), and the signed org_role is that membership's role — the body selects among the caller's own orgs and never grants an org or a role. The optional X-Artifact-Producer / X-Artifact-Producer-Key headers let a first-party cell service calling on its user's behalf attest which producer it is; a valid attestation adds a producer claim and grants nothing. 400 invalid_body when a non-empty body is not a JSON object or its org_id is not a non-empty string; 403 when there is no active org, the requested org is not an accepted membership (not_a_member), the role is below member, or the producer attestation fails (producer_not_attested); 503 (fail-closed) when the vault signing key is not configured. A scope-clamped MCP OAuth token cannot mint.

post/artifacts/vault-token

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/artifacts/vault-token
  • Auth: HTTP bearer

Headers

X-Artifact-Producerstring

Optional cell-producer attestation: the name of the first-party producer service calling on its user's behalf. Sent together with X-Artifact-Producer-Key; sending only one of the two is refused with 403 producer_not_attested. A valid attestation adds a producer claim to the token; it never changes the org or role.

X-Artifact-Producer-Keystring

Optional cell-producer attestation: the producer's own key, checked against a server-held digest (the API stores digests only, never a producer key). Sent together with X-Artifact-Producer; an unknown producer or a key that does not match is refused with 403 producer_not_attested and nothing is signed.

Request body

org_idstring

Org to mint for. Omit (or send no body) for the caller's active org. When present it must be one of the caller's ACCEPTED memberships, else 403 not_a_member; the signed org_role is that membership's role.

Response

Vault bearer.

tokenstring required

Compact EdDSA JWS.

token_type'Bearer' required
expires_ininteger required

Seconds; always 300.

expires_atinteger required

Unix seconds.

org_idstring required
org_role'owner' | 'admin' | 'member' required

Changes

No recorded changes to this operation across all 1 revision of this API.