Auth

Submit the card's authentication certificate; receive the DTBS + challenge

Called by the client with Authorization: Bearer <clientToken>. The API validates the certificate (chain, revocation, purpose = authentication, key usage), builds the canonical challenge, and returns the exact dtbs the card must sign plus a single-use operationToken.

post/auth/{requestId}/certificate

Request

  • Base URL: https://atk.tvarka.pro/v1
  • URL: https://atk.tvarka.pro/v1/auth/{requestId}/certificate
  • Auth: HTTP bearer

Path parameters

requestIdstring uuid required

The requestId returned by POST /auth/requests.

Request body

certificatestring byte required

Base64 DER of the card's authentication certificate.

Response

DTBS + challenge + operation token.

requestIdstring uuid required
dtbsstring byte required

Base64 of the exact digest the card must sign (ECDSA prehashed). Built as the atk-auth-v1 construction - see Challenge.

dtbsHashAlgOid'2.16.840.1.101.3.4.2.1' | '2.16.840.1.101.3.4.2.2' required

Digest algorithm OID, curve-matched. SHA-256 = 2.16.840.1.101.3.4.2.1; SHA-384 = 2.16.840.1.101.3.4.2.2.

operationTokenstring required

Single-use JWT bound to {tenant, requestId, purpose, certFp, dtbsHash}; the nonce is bound indirectly via dtbs. Returned at /complete.

verificationCodestring

Example response

{
  "cert": {
    "subject": {
      "serialNumber": "PNOLT-39001010000",
      "c": "LT"
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.