Trust registry schema

The field contract of the trust registry object, read from trust_registry.schema.json. The schema file is the normative artifact; this page is a reading of it. Raw schema file at the release tag.

Property of the schema	Value
Schema identity ($id)	https://schemas.loquitur.dev/v1/trust_registry.schema.json
JSON Schema dialect	https://json-schema.org/draft/2020-12/schema
Root type	object
Additional properties at the root	refused
Required at the root	object_type, schema_version, trust_registry_id, registry_operator_id, registry_version, issued_at, effective_at, expires_at, entries, signature

Fields

Field paths are dotted; [] marks the members of an array item. “Required” is stated against the object that holds the field.

Field	Type	Required	Constraints	Description
effective_at	string	yes	pattern ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)Z$
entries	array of object	yes	uniqueItems; items: no additional properties
entries[].allowed_asset_types	array of string	yes	uniqueItems; items: pattern ^[a-z0-9][a-z0-9_]{0,63}$
entries[].allowed_workflows	array of string	yes	uniqueItems; items: pattern ^[a-z0-9][a-z0-9_]{0,63}$
entries[].effective_from	string	yes	pattern ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)Z$
entries[].expires_at	string	yes	pattern ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)Z$
entries[].issuer_display_name	string	yes	minLength 1
entries[].issuer_id	string	yes	pattern ^issuer_[A-Za-z0-9_-]{3,128}$
entries[].issuer_key_id	string	yes	minLength 1
entries[].key_type	string	yes	pattern ^[a-z0-9][a-z0-9_]{0,63}$	Key type identifier. Any well-formed identifier is admitted; the verifier’s allowlist decides at the signature step whether the pair of algorithm and key type is supported.
entries[].notes	string or null	no	minLength 1
entries[].public_key_hex	string	yes	pattern ^([a-f0-9]{2}){1,512}$	Public key as lowercase hexadecimal, 1 to 512 bytes. Its form for the key type is judged at the signature step: for secp256k1, an uncompressed SEC1 point 04 || X || Y with X and Y below p, on the curve.
entries[].revocation_reason	string or null	no	minLength 1
entries[].revoked_at	string or null	no	pattern ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)Z$
entries[].status	string	yes	enum: active, suspended, revoked
expires_at	string	yes	pattern ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)Z$
issued_at	string	yes	pattern ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)Z$
object_type	string	yes	const "trust_registry"
registry_operator_id	string	yes	pattern ^operator_[A-Za-z0-9_-]{3,128}$
registry_version	string	yes	pattern ^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9_.-]+)?$
schema_version	string	yes	enum: v1
signature	object	yes	no additional properties
signature.algorithm	string	yes	pattern ^[a-z0-9][a-z0-9_]{0,63}$	Root signature algorithm identifier. Any well-formed identifier is admitted; root authentication decides whether it is supported.
signature.key_id	string	yes	minLength 1
signature.signature	string	yes	minLength 1
trust_registry_id	string	yes	pattern ^tr_[A-Za-z0-9_-]{8,128}$

Example

The schema carries one example instance under its root keyword example, an annotation that decides nothing about any instance. Read it in the raw schema file.