Trusteddit-Registrierungs-API (Enrollment API)

// Content-Type: application/json
{
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\n..."
  // PEM-encoded PKCS#10 CSR
  // Subject CN must be in format: ph_<hex16>@thephenom.app
  // Key algorithm: EC / P-256 (ECDSA)
  // Signature algorithm: ES256 (ECDSA with SHA-256)
}

{
  "certificate": "-----BEGIN CERTIFICATE-----\n...",
  // PEM-encoded device certificate
  // CN: ph_<hex16>@thephenom.app
  // Issuer: Trusteddit-Journalist-Issuer-CA
  // Algorithm: ES256 (ECDSA P-256)
  // Validity: 90 days from issuance

  "chain": [
    "-----BEGIN CERTIFICATE-----\n...",  // Trusteddit-Journalist-Issuer-CA
    "-----BEGIN CERTIFICATE-----\n..."   // Trusteddit Intermediate CA
  ],
  // Full CA chain, ordered from issuing CA to intermediate.
  // Append to certificate when constructing the C2PA manifest.

  "expiresAt": "2026-07-01T00:00:00Z",
  // ISO 8601 UTC expiry of the device certificate.
  // Schedule re-enrollment before this date.

  "signerId": "ph_a3f92c1d8b4e7f06@thephenom.app",
  // Echo of the signer ID extracted from the CSR CN.
  // Confirm this matches what you submitted.

  "serialNumber": "3a:9f:c2:1d:..."
  // Hex-encoded certificate serial number.
  // Store this to correlate with revocation records if needed.
}

{
  "code": "INVALID_CSR_FORMAT",
  // Machine-readable error code – see Error Codes table below
  "message": "CSR signature verification failed",
  // Human-readable explanation
  "requestId": "req_01hvmk..."
  // Opaque request ID – include in support emails
}

// 200 OK – all systems operational
{
  "status": "ok",
  "ca": "reachable",
  "version": "1.0.3",
  "timestamp": "2026-04-03T12:00:00Z"
}

// 503 Service Unavailable – CA unreachable or degraded
{
  "status": "degraded",
  "ca": "unreachable",
  "message": "CA signing endpoint is not responding",
  "timestamp": "2026-04-03T12:00:00Z"
}