{"registry":"0x6167656e7470726f76656e616e6365","name":"agentprovenance","role":"provenance graph","description":"Records agent entries, lineage edges, attestations and reputation evidence. / and /parameters are open; everything that shows agent records or activity is a permissioned read (a signed read, answered by what the reader may read); writes are signed by recognized venues.","endpoints":{"open":["/","/parameters"],"permissioned":["/lookup?id=","/lineage?id=","/reputation?id=","/peek","/feed.md"],"signed":["/signed/<event_id>","/reputation/subjects?after=&limit="],"tier1":["POST /entries","POST /attestations","POST /reputation"],"push":"POST /push"},"permissioned_reads":{"enforced":false,"readers":{"observer":"an approved observer (observer_identity, on the push's full_read list) reads everything","venue":"a venue (venue_identity) reads its own writes; with the agent's handshake card, /lookup of that agent and /signed of its current entry version","agent":"an agent (did:key) reads records about itself; did:keri is not supported yet"},"headers":["X-Provenance-Key-Id","X-Provenance-Key-Binding","X-Provenance-Signature","X-Provenance-Emitted-At"],"card_header":"X-Provenance-Handshake","self_read_header":"X-Provenance-Agent (in place of X-Provenance-Key-Binding and X-Provenance-Key-Id)","signed_region":"canonicalize({method, path, graph, emitted_at}): path is the pathname plus the query, graph this host","refusal":"HTTP 401 `read_refused`, the same for every refused read and never 404"},"write_envelope":{"signature_algorithm":"Ed25519","headers":["X-Provenance-Key-Id","X-Provenance-Signature","X-Provenance-Key-Binding"],"note":"X-Provenance-Key-Id is a correlation handle only; the operational public key is taken from the key binding."},"write_response":{"note":"All outcomes are HTTP 200. Structured errors (4xx) carry an `error` code instead.","entries":{"statuses":{"applied":"a new entry version was appended","duplicate":"this event_id was already recorded for identical content; idempotent no-op, no new version (not an error)"},"fields":{"current":"boolean, returned alongside `status`: whether the version this write names is the entry's current version, its chain tip, which GET /lookup serves. `applied` means stored; `current` says whether it was the current version when the registry answered (read after the insert, so a successor landing in between gives `applied` with `current: false`). On `duplicate`, false once a later version has superseded it."}},"attestations":{"statuses":{"applied":"the attestation (and any lineage edge) was written","duplicate":"this event_id was already recorded for identical content; idempotent no-op (not an error)"}},"reputation":{"statuses":{"applied":"the reputation event was recorded","duplicate":"this event_id was already recorded for identical content; idempotent no-op (not an error)"}},"event_id_collision":"HTTP 422 `invalid_body` naming field `event_id` — that id is already recorded for different content.","created_at_immutable":"HTTP 422 `invalid_body` naming field `entry.created_at` — `created_at` must match this identifier's first version byte-for-byte; `/lookup` serves that value, so replay it verbatim. On FIRST registration `/lookup` reports not-found and you stamp it yourself; persist what you sent, because it is fixed from then on."},"parameter_set_version":"ps-v1"}