Sylphx Identity

Product Contract · reference

One descriptor. Generated clients.

api/proto/sylphx/identity/v1/identity.proto is the only public request, response, error, and lifecycle model. Public clients are generated from that contract and the bundle. Handwritten SDK or CLI authority is not dest. Platform sylphx-sdk / sylphx-cli is not this product's client.

Published locators

Product id
identity
Issuer / peel
https://api.identity.sylphx.com/v1
Public schema
identity.proto
Contract bundle
product-contract.bundle.json
Envelope
Binding + Delegation. Header Sylphx-Project-Binding carries sylphx-project-binding+jwt. Authorization: Bearer carries sylphx-delegation+jwt.
Not accepted
Caller project headers, long-lived first-party shared secrets, product API keys as Binding, handwritten second schema, OpenAPI/Swagger/GraphQL as the public contract, or Identity-minted Binding.

Selected operations

OperationHTTP
ApplyProjectBindingAuthorityEventPOST /v1/project-binding-authority-events
CreateCustomerPrincipal / GetPrincipalPOST /v1/principals/customers, POST /v1/principals:get
BeginAuthentication / CompleteAuthenticationPOST /v1/authentication/begin, POST /v1/authentication/complete
MintDelegationPOST /v1/delegations
StartEmailVerificationPOST /v1/email-verification/start
Public keysGET /.well-known/jwks.json — Ed25519 only

Field lists, budgets, and errors stay in the descriptor. This table does not re-author them. Capability ids are Product Contract operation ids.

Trust envelope

  • Platform signs Binding: typ=sylphx-project-binding+jwt, alg=EdDSA, maximum 900s.
  • Identity mints delegation: immutable plan_digest, nested binding, typed closed limits, lifetime ≤ 300s, subset of the Platform ceiling.
  • JWKS publishes only Ed25519 public keys with integer nbf and exp.
  • Session bearers are never accepted as sylphx-delegation+jwt.