vault

Create a rotation_attempt_descriptor (writer)

Writer (gitvault.writer, protocol rev 42 D195/D199). The FIRST write of any epoch rotation attempt, required BEFORE any key_envelope upload session for that attempt. The descriptor carries no reason, so the reason's authority is enforced when the rotate_epoch head is admitted: reason:"member_removed" needs gitvault.writer only, every other reason needs gitvault.rotate (owner + step-up). Body is the complete writer-signed rotation_attempt_descriptor object; the gateway verifies the writer signature against the vault's registered creator key and performs a create-only compare-and-swap on the deterministic rotation_id — a byte-identical resubmission is an idempotent replay (200), a byte-distinct descriptor claiming the SAME rotation_id is refused 409 ATTEMPT_DESCRIPTOR_CONFLICT.

post/vaults/v1/{vault_id}/rotation-attempts

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/vaults/v1/{vault_id}/rotation-attempts
  • Auth: one of:
    • API key in header SIGN-IN-WITH-X
    • HTTP bearer

Path parameters

vault_idstring required

The vault id (src_<32 hex>); the wire field is repo_id (protocol D185).

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

object required

The complete, writer-signed rotation_attempt_descriptor object (protocol schemas/rotation_attempt_descriptor.json).

Response

Idempotent replay of an identical, already-stored descriptor

rotation_idstring
descriptorobject
deduplicatedboolean

Changes

No recorded changes to this operation across all 1 revision of this API.