Lexicon Garden

ai.newnal.illi.account.parent.signIn

Sign a parent account in to ILLI from the device without the PDN's OAuth sign-in and consent screen: the device presents the parent's scoped deviceApp app password (which it keeps) and its attestation; the Service Agent Node opens the delegated session, joins the account to the service sphere on first use and returns the device-app session. Used at first connection and at every re-login.

Repository @illi-service.newnal.id did:plc:uztm7bi2ce42dez3uu3qafro namespace authority
Details · procedure
Kindprocedure
Authorityparent.account.illi.newnal.ai
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

appPassword

requiredstring

attestation

requiredstring

Device attestation: production = an Android key-attestation statement whose certificate chain roots at Newnal's RKP CA and whose challenge is the nonce from account.getAttestationNonce, as a compact JWS with the x5c certificate chain; PoC = mock:device:<secret>.

deviceId

requiredstring
  • maxLength: 64

did

requiredstring · did

slot

integer
  • minimum: 1
  • maximum: 2

Output

application/json

deviceStatus

string
  • knownValues: registered | awaitingLink | active | unlinked | retired

did

requiredstring · did

expiresAt

string · datetime

handle

requiredstring · handle

token

string

The device-app session token for native clients; web clients receive it as the illi_session cookie.

Errors

InvalidAppPassword

No description in schema.

WrongScope

No description in schema.

InvalidAttestation

No description in schema.

DeviceRevoked

No description in schema.

ParentLimitReached

No description in schema.

ParentAlreadyLinked

No description in schema.

RateLimitExceeded

No description in schema.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • ai.newnal.illi.account.family.signIn

    procedure

    Sign a family member in to ILLI from the native family app without the PDN's OAuth sign-in and consent screen: the app presents the member's scoped familyApp app password (which it keeps) and its platform attestation; the Service Agent Node opens the session, joins the account to the service sphere on first use and returns the family session. Used at first connection and at every re-login. Web clients use the OAuth BFF (/oauth/login) instead.

  • ai.newnal.illi.account.parent.startOAuth

    procedure

    Start a parent's OAuth sign-in on the device through the PDN's own page (BFF), for an existing Newnal ID whose credentials are typed on the PDN page. Device-created accounts, and existing ones whose credentials the device app takes itself, sign in with account.parent.signIn instead. client=native ends with a one-time code on the device app's App Link for account.exchangeCode instead of a cookie.

  • ai.newnal.illi.account.getAttestationNonce

    procedure

    Issue a server nonce (5 minutes) that a client binds into its attestation before calling account.requestPDNCreationGrant, account.parent.signIn, account.family.signIn or device.requestOnboardingCode. The nonce is an attestation session: the attestation bound to it may be presented again for the same client kind and subject until it expires; a failed verification ends the session. Devices put it in the Android key-attestation challenge of a key provisioned through Newnal's RKP; family apps pass i

  • ai.newnal.illi.account.requestPDNCreationGrant

    procedure

    Issue a 60-second creation grant (a service-auth JWT for the PDN's ai.newnal.pdn.server.createAttestedAccount) to an attested ILLI client. In the PoC a device needs no attestation; in production the manufacturing-key or platform attestation is mandatory.