# app.certified.signature.defs

> Published by [certified.app](https://lexicon.garden/identity/did:plc:apun3uo5jqm34pxzqq6on754)

✓ This is the authoritative definition for this NSID.

## Description

Common type definitions for cryptographic signatures attached to records, per the ATProtocol Attestation Specification.

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:apun3uo5jqm34pxzqq6on754/app.certified.signature.defs)
- [Documentation](https://lexicon.garden/lexicon/did:plc:apun3uo5jqm34pxzqq6on754/app.certified.signature.defs/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:apun3uo5jqm34pxzqq6on754/app.certified.signature.defs/examples)

## Definitions

### `app.certified.signature.defs#list`

**Type**: `array`

Reusable array of cryptographic signatures attesting to a record's content. Open union of inline signatures and strong references to remote attestation proof records.

**Items**:

Type: `union`

### `app.certified.signature.defs#inline`

**Type**: `object`

Inline attestation signature embedded directly in a record. Conforms to the ATProtocol Attestation Specification: the signed input is the 36-byte CIDv1 (dag-cbor + SHA-256) of the record with the `signatures` field removed and a temporary `$sig` metadata object (containing `$type` and the housing repository DID) inserted before canonical DAG-CBOR encoding. ECDSA with the low-S variant per BIP-0062 is required; the curve (P-256 or K-256) is determined by the multicodec prefix of the verification method's `publicKeyMultibase`.

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `key` | `string` | Yes | Full DID verification method reference (format: did:{method}:{identifier}#{fragment}). Identifies the signer and the specific key used; the key's multicodec prefix determines the signing curve. |
| `signature` | `bytes` | Yes | ECDSA signature bytes (raw r,s) over the 36-byte CID of the record. Low-S variant per BIP-0062 is mandatory. |

## Raw Schema

```json
{
  "id": "app.certified.signature.defs",
  "defs": {
    "list": {
      "type": "array",
      "items": {
        "refs": [
          "app.certified.signature.defs#inline",
          "com.atproto.repo.strongRef"
        ],
        "type": "union"
      },
      "description": "Reusable array of cryptographic signatures attesting to a record's content. Open union of inline signatures and strong references to remote attestation proof records."
    },
    "inline": {
      "type": "object",
      "required": [
        "signature",
        "key"
      ],
      "properties": {
        "key": {
          "type": "string",
          "maxLength": 512,
          "description": "Full DID verification method reference (format: did:{method}:{identifier}#{fragment}). Identifies the signer and the specific key used; the key's multicodec prefix determines the signing curve."
        },
        "signature": {
          "type": "bytes",
          "description": "ECDSA signature bytes (raw r,s) over the 36-byte CID of the record. Low-S variant per BIP-0062 is mandatory."
        }
      },
      "description": "Inline attestation signature embedded directly in a record. Conforms to the ATProtocol Attestation Specification: the signed input is the 36-byte CIDv1 (dag-cbor + SHA-256) of the record with the `signatures` field removed and a temporary `$sig` metadata object (containing `$type` and the housing repository DID) inserted before canonical DAG-CBOR encoding. ECDSA with the low-S variant per BIP-0062 is required; the curve (P-256 or K-256) is determined by the multicodec prefix of the verification method's `publicKeyMultibase`."
    }
  },
  "$type": "com.atproto.lexicon.schema",
  "lexicon": 1,
  "description": "Common type definitions for cryptographic signatures attached to records, per the ATProtocol Attestation Specification."
}
```