Auth

Submit the raw card signature; receive the verified identity

Called by the client with Authorization: Bearer <clientToken> and the single-use operationToken in the body. The API verifies the signature against the stored dtbs and the certificate's public key, enforces the identity-swap guard, and returns the verified identity (and the optional assertion JWT). Retry-safe: a repeat with the same tuple returns the same result; a different signature/cert after the token is claimed is rejected.

post/auth/{requestId}/complete

Request

  • Base URL: https://atk.tvarka.pro/v1
  • URL: https://atk.tvarka.pro/v1/auth/{requestId}/complete
  • Auth: HTTP bearer

Path parameters

requestIdstring uuid required

The requestId returned by POST /auth/requests.

Request body

signaturestring byte required

Base64 raw card signature over dtbs (auth key).

signatureAlgorithm'ES256' | 'ES384' required

Card-reported JWS-style algorithm.

signatureEncoding'P1363' | 'DER'

Raw ECDSA signature encoding. P1363 = fixed-width r||s; DER = SEQUENCE(r, s). Informational - the server auto-detects and accepts either encoding regardless of this field.

operationTokenstring required

Response

Authenticated - verified identity.

status'done' required
method'physical' | 'nfc' required

physical = desktop reader; nfc = phone tap.

sigstring byte required

The raw card signature over the audience-bound challenge, returned so the relying party can verify identity independently of assertion. Audience-binding prevents cross-RP relay.

assertionstring

Optional short-lived Tvarka-signed JWT (ES256), verifiable against the JWKS endpoint. Claims: iss=atk.tvarka.pro, sub=<personal code>, aud=<audience>, iat, exp, jti, request_id (binds the assertion to this ceremony), given_name, family_name, cert_fp, authentication_method, amr. NOT OIDC. Optional by contract - integrators may ignore it and verify the raw sig themselves.

Example response

{
  "method": "physical",
  "cert": {
    "subject": {
      "serialNumber": "PNOLT-39001010000",
      "c": "LT"
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.