Lexicon Garden

ai.newnal.illi.account.getAttestationNonce

Issue a server nonce (5 minutes) that a client binds into its attestation before calling account.requestPDNCreationGrant, account.parent.signIn, account.family.signIn or device.requestOnboardingCode. The nonce is an attestation session: the attestation bound to it may be presented again for the same client kind and subject until it expires; a failed verification ends the session. Devices put it in the Android key-attestation challenge of a key provisioned through Newnal's RKP; family apps pass it to Play Integrity or App Attest. No session required.

Repository @illi-service.newnal.id did:plc:uztm7bi2ce42dez3uu3qafro namespace authority
Details · procedure
Kindprocedure
Authorityaccount.illi.newnal.ai
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

client

requiredstring
  • knownValues: device | familyApp

deviceId

string
  • maxLength: 64

Output

application/json

expiresAt

requiredstring · datetime

nonce

requiredstring

base64url, 32 random bytes

Errors

RateLimitExceeded

No description in schema.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • ai.newnal.illi.account.requestPDNCreationGrant

    procedure

    Issue a 60-second creation grant (a service-auth JWT for the PDN's ai.newnal.pdn.server.createAttestedAccount) to an attested ILLI client. In the PoC a device needs no attestation; in production the manufacturing-key or platform attestation is mandatory.

  • ai.newnal.illi.account.parent.signIn

    procedure

    Sign a parent account in to ILLI from the device without the PDN's OAuth sign-in and consent screen: the device presents the parent's scoped deviceApp app password (which it keeps) and its attestation; the Service Agent Node opens the delegated session, joins the account to the service sphere on first use and returns the device-app session. Used at first connection and at every re-login.

  • ai.newnal.illi.account.exchangeCode

    procedure

    Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events. The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (PKCE-style S256), which stops a code obtained for another account from being injected into the app.

  • ai.newnal.illi.device.requestOnboardingCode

    procedure

    Register the device (device id, model) under parent 1's device-app session and issue a one-time onboarding code shown on the device.