Governance

Mint a signed attestation for an output

Signs an Ed25519 attestation for a persisted analysis output on the API surface (nlk_ key). Auth: Bearer nlk_ key with scope mcp (or analyze); the internal loopback requires mcp → 403 MCP_SCOPE_REQUIRED otherwise. Owner-only over analysis_outputs (ownership resolved by api_key_id/org/user — an integrator never mints another tenant's attestation → 404). 0 credits (non-generative). The returned attestation is offline-verifiable via POST /api/v1/attestations/verify and the public JWKS.

Zero-Retention: the envelope carries only hashes + citation counts — never analysis text or canonical citation strings.

post/api/v1/outputs/{id}/attestation

Request

  • Base URL: https://legal.nexusquantum.legal
  • URL: https://legal.nexusquantum.legal/api/v1/outputs/{id}/attestation
  • Auth: HTTP bearer

Path parameters

idstring uuid required

Output id (analysis_outputs.id).

Response

The signed attestation envelope (all Attestation fields) plus requestId.

attestation_versionstring required
issued_atstring date-time required
signer_key_idstring required

kid of the signing key (matches a key in the JWKS).

output_idstring uuid
job_idstring uuid nullable
request_idstring nullable
jurisdictionstring required
integrity_hashstring required

analysis_outputs.integrity_hash = SHA256(analysis_text + job_id + created_at).

content_hashstring required

SHA256(normalize(analysis_text)); normalize = NFC + trim. Binds the content the verifier re-submits.

model_chainstring[]
verify_engine_versionstring required
citation_summaryobject

Counts only (ZR): { counts, anyBroken, total }.

signaturestring required

base64url EdDSA signature over the canonical JSON of the attestation with signature excluded.

requestIdstring

Example response

{
  "attestation_version": "1",
  "signer_key_id": "att_20260712_a",
  "jurisdiction": "ES",
  "verify_engine_version": "2026-06-08.1"
}

Changes

No recorded changes to this operation across all 1 revision of this API.