{"version": "c6b1-v1", "issuer": "https://beachdayapi.com", "autonomous_enrollment": {"available": true, "endpoint": "https://beachdayapi.com/oauth/autonomous/enroll/", "method": "POST", "accepted_terms_version": "c3b-v1", "request": {"content_type": "application/x-www-form-urlencoded", "required": {"client_id": "https URL of the CIMD document", "terms_version": {"required": true, "accepted_value": "c3b-v1", "must_echo_exactly": true}}}, "response": {"account_type": "autonomous_service", "enrollment": ["created", "existing"]}, "policy": {"controlled_admission": true, "denial_possible": true, "denial_does_not_disclose_policy_details": true}, "starting_credit_balance": 0}, "identity": {"model": "cimd", "client_id_is_metadata_document_url": true, "client_metadata_document": {"url_requirements": ["absolute HTTPS URL", "document client_id exactly matches its URL"], "required_fields": ["client_id", "client_name", "redirect_uris", "grant_types", "response_types", "token_endpoint_auth_method"], "redirect_uri_requirements": ["non-empty array of absolute HTTPS redirect URIs"], "note": "CIMD observation and autonomous admission are separate; enrollment may be denied by policy."}}, "identity_observation": {"during_enrollment": true, "separate_client_operation_required": false, "effect": "A successfully validated CIMD is durably observed before admission policy is evaluated."}, "service_account": {"account_type": "autonomous_service", "api_keys_required": false, "api_keys_issued": false, "human_trial_grants_issued": false, "starting_credit_balance": 0}, "workload_credential": {"registration": {"endpoint": "https://beachdayapi.com/oauth/autonomous/credentials/", "method": "POST", "content_type": "application/x-www-form-urlencoded", "required": {"client_id": "same CIMD client_id used for enrollment", "public_jwk": "JSON-encoded public JWK"}, "response": {"credential_id": "opaque credential identifier", "challenge": "one-use proof challenge", "expires_in": 300}}, "public_jwk": {"kty": "EC", "crv": "P-256", "alg": "ES256", "required_members": ["kty", "crv", "x", "y"], "private_key_must_remain_client_side": true}, "proof": {"endpoint": "https://beachdayapi.com/oauth/autonomous/credentials/prove/", "method": "POST", "content_type": "application/x-www-form-urlencoded", "required": {"proof": "compact signed JWT"}, "challenge_lifetime_seconds": 300, "jwt": {"typ": "beachday-key-proof+jwt", "alg": "ES256", "kid": "credential_id", "claims": {"iss": "credential_id", "sub": "credential_id", "aud": "https://beachdayapi.com", "challenge": "registration challenge", "iat": "numeric date", "exp": "numeric date"}}}}, "workload_token": {"endpoint": "https://beachdayapi.com/oauth/workload-token/", "method": "POST", "content_type": "application/x-www-form-urlencoded", "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", "required": {"grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", "assertion": "compact signed JWT", "resource": "one supported resource", "scope": "space-separated requested scopes"}, "jwt": {"typ": "authorization-grant+jwt", "alg": "ES256", "kid": "active credential_id", "claims": {"iss": "credential_id", "sub": "credential_id", "aud": "https://beachdayapi.com/oauth/workload-token/", "client_id": "CIMD document URL", "resource": "requested resource", "scope": "requested scopes", "iat": "numeric date", "exp": "numeric date", "jti": "unique assertion identifier"}, "maximum_lifetime_seconds": 120, "replay_protection": true}, "resources": {"https://beachdayapi.com/mcp": ["account:read", "beach:read", "purchase:create"], "https://beachdayapi.com/v1/agent/payments/": ["purchase:create"]}}, "lifecycle": {"credential_inventory": {"endpoint": "https://beachdayapi.com/oauth/autonomous/credentials/inventory/", "method": "GET", "required_scope": "account:read"}, "credential_replacement": {"endpoint": "https://beachdayapi.com/oauth/autonomous/credentials/replace/", "method": "POST", "content_type": "application/json", "required_scope": "account:read", "request": {"public_jwk": "EC P-256 ES256 public JWK"}}, "purchase_reconciliation": {"endpoint_template": "https://beachdayapi.com/oauth/autonomous/credit-purchases/{purchase_id}/", "method": "GET", "required_scope": "account:read", "semantics": {"purchase_status": "durable persisted CreditPurchase.status", "status": "legacy alias of purchase_status", "payment_state": "derived client-facing payment lifecycle state", "new_purchase": "pending purchase_status with payment_state payment_required means no payment attempt has started and payment may be initiated", "payment_action": {"when": "present only when may_initiate_payment is true", "method": "POST", "url": "server-generated purchase-specific payment URL", "authorization": {"type": "oauth2", "resource": "https://beachdayapi.com/v1/agent/payments/", "scope": "purchase:create"}, "payment_protocol": "mpp", "initial_request_has_payment_credential": false, "expected_initial_response": 402, "challenge_authority": "The HTTP 402 response defines the payment challenge and requested credential header.", "challenge_response": {"terms": "The 402 body exposes authoritative amount, currency, and credits from the purchase.", "payment_challenge": "Read the WWW-Authenticate Payment challenge and pass it to an MPP-capable payment client or wallet.", "credential_header": "Use the header named by the challenge, currently Payment-Authorization.", "application_authorization_header": "Keep the Beach Day OAuth bearer in Authorization."}}}}}, "mcp": {"endpoint": "https://beachdayapi.com/mcp", "authorization": "Bearer resource-bound workload token"}, "api_keys_required_for_autonomous_accounts": false, "errors": {"autonomous_enrollment_not_permitted": {"description": "The observed identity is not admitted to autonomous enrollment.", "next_action": "Verify CIMD metadata and controlled admission eligibility; do not retry with a different identity."}, "credential_registration_required": {"description": "An admitted autonomous service account must register a public workload credential before requesting a workload token.", "next_action": "Register an EC P-256 ES256 public JWK, then prove possession."}, "proof_required": {"description": "The pending credential must complete possession proof before use.", "next_action": "Sign the challenge using the registered private key before the challenge expires."}, "workload_token_required": {"description": "The target operation requires a resource-bound workload token.", "next_action": "Request a workload token for the listed resource and scope."}, "resource_not_permitted": {"description": "The requested resource or scope is not permitted for this workload token.", "next_action": "Use a resource and exact scopes listed in this document."}}}