PSDP documentation

$ curl -s https://YOUR_PSDP_SERVER/api/health | python3 -m json.tool
# Inspect the reported status, backends and standards fields.

# No key -> 401
$ curl -s -o /dev/null -w "%{http_code}" -X POST \
  https://YOUR_PSDP_SERVER/api/v1/verify
# Expected: 401

# Wrong key -> 403
$ curl -s -o /dev/null -w "%{http_code}" -X POST \
  -H "X-API-Key: wrong-key" \
  https://YOUR_PSDP_SERVER/api/v1/verify
# Expected: 403

$ curl -X POST https://YOUR_PSDP_SERVER/api/v1/verify \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_KEY" \
  -d '{
  "proof_request": {
    "protocol_version": "psdp/v0.1",
    "request_id": "test-001",
    "verifier_id": "my-verifier",
    "audience": "my-verifier",
    "nonce": "test-nonce-12345",
    "expires_at": "2030-01-01T00:00:00Z",
    "policy": {
      "policy_id": "test-policy",
      "policy_version": "1.0.0",
      "policy_hash": "sha256:test",
      "allowed_schema_ids": ["schema.test"],
      "required_disclosures": [{"path": "/name"}],
      "predicates": [
        {"predicate_id": "age-check", "path": "/age",
         "operator": "gte", "value_type": "number",
         "comparison_value": 18}
      ],
      "status_requirements": {
        "require_active_status": false,
        "freshness_max_age_seconds": 3600
      }
    }
  },
  "proof_package": {
    "protocol_version": "psdp/v0.1",
    "package_id": "pkg-001",
    "request_id": "test-001",
    "credential": {
      "schema_id": "schema.test",
      "issuer_id": "issuer.test",
      "issuer_key_id": "key.issuer.001",
      "expires_at": "2030-01-01T00:00:00Z",
      "credential_root": "root:test",
      "issuer_signature": "mock-signature:issuer.test:key.issuer.001:eddsa-ed25519"
    },
    "request_binding": {
      "verifier_id": "my-verifier",
      "audience": "my-verifier",
      "nonce": "test-nonce-12345",
      "policy_id": "test-policy",
      "policy_version": "1.0.0",
      "policy_hash": "sha256:test",
      "request_binding_digest": "sha256:binding"
    },
    "disclosed_claims": [
      {"path": "/name", "value": "Jane Doe", "value_type": "string"}
    ],
    "predicate_assertions": [
      {"predicate_id": "age-check", "path": "/age",
       "operator": "gte", "satisfied": true}
    ],
    "proof_material": {"proof": "mock-proof:valid", "encoding": "base64"},
    "backend_profile": {
      "backend": "arkworks", "proof_system": "groth16",
      "circuit_id": "test-v1", "circuit_version": "1.0",
      "verification_key_id": "vk-test"
    },
    "status_binding": {
      "status_authority_id": "status.test",
      "status_root": "root:active",
      "status_issued_at": "2026-04-13T00:00:00Z",
      "status_fresh_until": "2026-04-14T00:00:00Z",
      "status_binding_signature": "mock-signature:status.test:key.status.001:eddsa-ed25519"
    }
  },
  "allow_mock_crypto": true
}'
# Expected: "decision_status": "accepted" — all checks true.

# Tampered proof -> rejected
# (same request as step 3, but change the proof value to "tampered")
# Expected: "decision_status": "rejected"

# Wrong schema -> SCHEMA_NOT_ALLOWED   (change schema_id to "schema.fake")
# Expired request -> REQUEST_EXPIRED   (set expires_at to "2020-01-01T00:00:00Z")
# Wrong nonce -> POLICY_HASH_MISMATCH  (change nonce in request_binding)

# Download the theory files published with the evidence package
$ curl -O https://YOUR_PSDP_SERVER/evidence/psdp_protocol.spthy
$ curl -O https://YOUR_PSDP_SERVER/evidence/psdp_private.spthy
$ curl -O https://YOUR_PSDP_SERVER/evidence/psdp_post_compromise.spthy
$ curl -O https://YOUR_PSDP_SERVER/evidence/psdp_issuer_hiding.spthy
$ curl -O https://YOUR_PSDP_SERVER/evidence/psdp_forward_secrecy.spthy
$ curl -O https://YOUR_PSDP_SERVER/evidence/psdp_selective_disclosure_privacy.spthy
$ curl -O https://YOUR_PSDP_SERVER/evidence/psdp_verifier_unlinkability.spthy

# Verify with Docker (no local install needed)
$ docker run --rm -v $(pwd):/work -w /work \
  tamarin-prover/tamarin-prover:latest \
  --prove --derivcheck-timeout=0 psdp_protocol.spthy

# Equivalence theories run in diff-mode:
$ docker run --rm -v $(pwd):/work -w /work \
  tamarin-prover/tamarin-prover:latest \
  --diff --prove --derivcheck-timeout=0 psdp_issuer_hiding.spthy

$ curl -O https://YOUR_PSDP_SERVER/evidence/EVIDENCE_PACKAGE.json
# Inspect the conformance block; signed test-log .zip exports
# are archived alongside it.

$ curl -sI https://YOUR_PSDP_SERVER/api/health | grep -iE \
  "x-content-type|x-frame|strict-transport|content-security|permissions|x-request-id|cache-control"
# Read the security headers the deployment returns.

# Check verifier metadata
$ curl https://YOUR_PSDP_SERVER/.well-known/openid-credential-verifier \
  | python3 -m json.tool

# Start an OID4VP verifier flow
$ curl -X POST https://YOUR_PSDP_SERVER/api/v1/oid4vp/initiate \
  -H "X-API-Key: YOUR_KEY" | python3 -m json.tool
# Expected: authorization_url, request_uri, state, nonce

# Fetch the signed request object
$ curl https://YOUR_PSDP_SERVER/api/v1/oid4vp/request/REQUEST_ID
# Expected: a signed JWT (ES256 + x5c certificate)

$ curl -O https://YOUR_PSDP_SERVER/evidence/SHA256SUMS.txt
$ sha256sum -c SHA256SUMS.txt
# Expected: all files "OK"

$ curl "https://YOUR_PSDP_SERVER/api/v1/oid4vp/wallet/authorize?client_id=test&nonce=test&request_uri=https://example.com/bad-jwt"
# Expected: an error response — the wallet role rejects
# request objects whose signature does not verify.

$ curl -X POST https://YOUR_PSDP_SERVER/api/v1/verify \
  -H "Content-Type: application/json" \
  -H "X-API-Key: your-api-key" \
  -d '{
  "proof_request": {
    "protocol_version": "psdp/v0.1",
    "request_id": "req-001",
    "verifier_id": "your-company.example",
    "audience": "your-company.example",
    "nonce": "unique-nonce-12345",
    "expires_at": "2030-01-01T00:00:00Z",
    "policy": {
      "policy_id": "kyc-check",
      "policy_version": "1.0.0",
      "policy_hash": "sha256:abc123",
      "allowed_schema_ids": ["schema.banking.kyc"],
      "required_disclosures": [
        {"path": "/jurisdiction"}
      ],
      "predicates": [
        {"predicate_id": "kyc-level",
         "path": "/kyc_level",
         "operator": "gte",
         "value_type": "number",
         "comparison_value": 2}
      ],
      "status_requirements": {
        "require_active_status": true,
        "freshness_max_age_seconds": 3600
      }
    }
  },
  "proof_package": { ... }
}'

{
  "decision_status": "accepted",
  "reason_codes": [],
  "checks": {
    "issuer_signature_valid": true,
    "proof_valid": true,
    "policy_bound": true,
    "replay_safe": true,
    "credential_not_expired": true,
    "status_valid": true,
    "disclosures_valid": true
  },
  "verification_time_ms": ...
}

"predicates": [
  {
    "predicate_id": "over-18",
    "path": "/age",
    "operator": "gte",
    "value_type": "number",
    "comparison_value": 18
  }
]

"predicate_assertions": [
  {"predicate_id": "over-18", "satisfied": true}
]

POST /api/v1/request
{
  "verifier_id": "bank-b.india.example",
  "audience": "bank-b.india.example",
  "policy": {
    "policy_id": "cross-border-kyc",
    "allowed_schema_ids": ["schema.banking.kyc"],
    "required_disclosures": [
      {"path": "/jurisdiction"}
    ],
    "predicates": [
      {"predicate_id": "kyc-level",
       "path": "/kyc_level",
       "operator": "gte",
       "value_type": "number",
       "comparison_value": 2}
    ]
  }
}

{
  "policy_id": "age-check",
  "allowed_schema_ids": ["schema.pid.eu"],
  "required_disclosures": [],
  "predicates": [
    {"predicate_id": "over-18",
     "path": "/age",
     "operator": "gte",
     "comparison_value": 18}
  ]
}

{
  "policy_id": "dora-ict-check",
  "required_disclosures": [
    {"path": "/jurisdiction"},
    {"path": "/certification_body"}
  ],
  "predicates": [
    {"predicate_id": "pentest-recent",
     "path": "/days_since_pentest",
     "operator": "lte",
     "comparison_value": 365},
    {"predicate_id": "low-incidents",
     "path": "/critical_incidents_12m",
     "operator": "lte",
     "comparison_value": 2}
  ]
}

# Install the tools
$ git clone https://github.com/Veridise/Picus.git
$ cargo install circomspect

# Picus — formal R1CS verification
$ racket Picus/picus.rkt --solver z3 psdp_selective_disclosure.r1cs
# Expected: "The circuit is properly constrained"

# Circomspect — static analysis
$ circomspect psdp_selective_disclosure.circom
# Expected: "No issues found"

# Negative-witness tests
$ npm install circomlib circomlibjs snarkjs
$ node negative_tests.js
# Expected: "14/14 passed, 0 failed"