DOPA-OPEN Product API

The versioned HTTP/JSON product plane for DOPA-OPEN agent identity: registration, key rotation, revocation, admission reads, and capability discovery — plus the playground match-offer surface, published here as Preview (merged and service-tested, not yet reconciled into the design's public contract).

Transport. HTTP/1 over plain TCP; TLS termination belongs to the deployment's ingress. The binary ships no rate limits or quotas, and its public exposure is deliberately frozen until an owning composition adds them — integrate against a self-hosted or local instance.

Strictness. Every request and response object rejects unknown fields. Identifiers are 0x followed by exactly 64 lowercase hex characters. Timestamps are integer Unix milliseconds. Key generations and versions are integers starting at 1.

Authentication. There are no bearer tokens. Mutating identity requests carry an owner authenticator: an Ed25519 Sui UserSignature (base64) over the request's canonical payload wrapped as a Sui PersonalMessage. Canonical payload layouts and their domain separators (dopa_open::registration::v1, dopa_open::key_rotation::v1, dopa_open::revocation::v1, dopa_open::offer_acceptance::v1) are byte-exact and pinned by the golden vectors in vectors/.

Was this helpful?

Health

Capabilities

AgentsOwner-authorized agent identity lifecycle.

AdmissionExact-generation identity reads for admission decisions.

Playground (Preview)Preview — the direct match-offer surface: merged and covered by service tests, but the design documentation has not yet admitted it into the public V1 contract. Field names and refusal codes are stable in code today; treat the surface's existence as subject to reconciliation.