Lexicon Garden

ai.newnal.illi.account.requestPDNCreationGrant

Issue a 60-second creation grant (a service-auth JWT for the PDN's ai.newnal.pdn.server.createAttestedAccount) to an attested ILLI client. In the PoC a device needs no attestation; in production the manufacturing-key or platform attestation is mandatory.

Repository @illi-service.newnal.id did:plc:uztm7bi2ce42dez3uu3qafro namespace authority
Details · procedure
Kindprocedure
Authorityaccount.illi.newnal.ai
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

attestation

string

Client attestation bound to a nonce from account.getAttestationNonce: device = Android key attestation rooted at Newnal's RKP CA; familyApp = Play Integrity / App Attest; PoC = mock:<client>:<secret>.

client

requiredstring
  • knownValues: device | familyApp

deviceId

string
  • maxLength: 64

Output

application/json

expiresAt

requiredstring · datetime

grant

requiredstring

pdnDid

requiredstring · did

pdnUrl

requiredstring · uri

Errors

InvalidAttestation

No description in schema.

DeviceRevoked

No description in schema.

RateLimitExceeded

No description in schema.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • ai.newnal.illi.account.getAttestationNonce

    procedure

    Issue a server nonce (5 minutes) that a client binds into its attestation before calling account.requestPDNCreationGrant, account.parent.signIn, account.family.signIn or device.requestOnboardingCode. The nonce is an attestation session: the attestation bound to it may be presented again for the same client kind and subject until it expires; a failed verification ends the session. Devices put it in the Android key-attestation challenge of a key provisioned through Newnal's RKP; family apps pass i

  • ai.newnal.pdn.server.createAttestedAccount

    procedure not from the namespace authority

    Create an account on behalf of a client attested by a trusted issuer. Authenticated with a service-auth JWT (iss = trusted issuer DID, aud = this PDN, lxm = this method, exp - iat <= 60 s, unique jti). No invite code, no captcha. Without handle the server generates a memorable one; without email the server stores the placeholder <label>@newnal.id. Returns a full session, like createAccount; clients that need a scoped session create a scoped app password with it.

  • ai.newnal.illi.account.parent.signIn

    procedure

    Sign a parent account in to ILLI from the device without the PDN's OAuth sign-in and consent screen: the device presents the parent's scoped deviceApp app password (which it keeps) and its attestation; the Service Agent Node opens the delegated session, joins the account to the service sphere on first use and returns the device-app session. Used at first connection and at every re-login.