> For the complete documentation index, see [llms.txt](https://vectis.liesware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vectis.liesware.com/commitments.md).

# Commitments

## Create a keyed cryptographic commitment

> Creates a keyed commitment using a commitment profile loaded from signed config. The profile binds name, KID, and structured context. Create generates a random opening and requires an active key.<br>

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"tags":[{"name":"Commitments"}],"servers":[{"url":"http://127.0.0.1:3000","description":"Local default server over HTTP"},{"url":"https://127.0.0.1:3000","description":"Local HTTPS server when VECTIS_MODE=prod"}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-API-Key"}},"parameters":{"Kid":{"name":"kid","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Kid"}}},"schemas":{"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"CommitCreateInput":{"type":"object","additionalProperties":false,"required":["ref","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"CommitCreateOutput":{"type":"object","required":["ref","kid","profile","algorithm","commitment","opening"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"algorithm":{"type":"string","description":"HMAC(<ops-key-hash>) or KMAC-224/256/384/512 for SHA-3 keys."},"commitment":{"$ref":"#/components/schemas/HexString"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"},"ErrorResponse":{"type":"object","required":["error"],"properties":{"error":{"$ref":"#/components/schemas/TextField"}}}},"responses":{"RequestBodyTooLarge":{"description":"Request body exceeds the internal 2 MiB limit","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Error":{"description":"Public error response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/commit/{kid}":{"post":{"tags":["Commitments"],"summary":"Create a keyed cryptographic commitment","description":"Creates a keyed commitment using a commitment profile loaded from signed config. The profile binds name, KID, and structured context. Create generates a random opening and requires an active key.\n","parameters":[{"$ref":"#/components/parameters/Kid"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommitCreateInput"}}}},"responses":{"200":{"description":"Cryptographic commitment and opening","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommitCreateOutput"}}}},"413":{"$ref":"#/components/responses/RequestBodyTooLarge"},"default":{"$ref":"#/components/responses/Error"}}}}}}
```

## Create cryptographic commitments as an all-or-nothing batch

> Creates keyed commitments for a batch using one signed commitment profile. Each item must include a unique client ref. Create requires an active key. Any validation or execution error fails the whole batch.<br>

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"tags":[{"name":"Commitments"}],"servers":[{"url":"http://127.0.0.1:3000","description":"Local default server over HTTP"},{"url":"https://127.0.0.1:3000","description":"Local HTTPS server when VECTIS_MODE=prod"}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-API-Key"}},"parameters":{"Kid":{"name":"kid","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Kid"}}},"schemas":{"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"CommitCreateBatchInput":{"type":"object","additionalProperties":false,"required":["profile","items"],"properties":{"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/CommitCreateBatchItemInput"}}}},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"CommitCreateBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"CommitCreateBatchOutput":{"type":"object","required":["kid","profile","algorithm","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"algorithm":{"type":"string","description":"HMAC(<ops-key-hash>) or KMAC-224/256/384/512 for SHA-3 keys."},"items":{"type":"array","items":{"$ref":"#/components/schemas/CommitCreateBatchOutputItem"}}}},"CommitCreateBatchOutputItem":{"type":"object","required":["ref","commitment","opening"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"commitment":{"$ref":"#/components/schemas/HexString"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"},"ErrorResponse":{"type":"object","required":["error"],"properties":{"error":{"$ref":"#/components/schemas/TextField"}}}},"responses":{"RequestBodyTooLarge":{"description":"Request body exceeds the internal 2 MiB limit","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Error":{"description":"Public error response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/commit/batch/{kid}":{"post":{"tags":["Commitments"],"summary":"Create cryptographic commitments as an all-or-nothing batch","description":"Creates keyed commitments for a batch using one signed commitment profile. Each item must include a unique client ref. Create requires an active key. Any validation or execution error fails the whole batch.\n","parameters":[{"$ref":"#/components/parameters/Kid"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommitCreateBatchInput"}}}},"responses":{"200":{"description":"Cryptographic commitments and openings","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommitCreateBatchOutput"}}}},"413":{"$ref":"#/components/responses/RequestBodyTooLarge"},"default":{"$ref":"#/components/responses/Error"}}}}}}
```

## Verify a keyed cryptographic commitment

> Verifies a commitment using plaintext, opening, commitment, and the selected signed commitment profile. Verify permits active and retired keys.<br>

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"tags":[{"name":"Commitments"}],"servers":[{"url":"http://127.0.0.1:3000","description":"Local default server over HTTP"},{"url":"https://127.0.0.1:3000","description":"Local HTTPS server when VECTIS_MODE=prod"}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-API-Key"}},"schemas":{"CommitVerifyInput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","plaintext","opening","commitment"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"},"commitment":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"CommitVerifyOutput":{"type":"object","required":["ref","kid","profile","valid"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"valid":{"type":"boolean"}}},"ErrorResponse":{"type":"object","required":["error"],"properties":{"error":{"$ref":"#/components/schemas/TextField"}}}},"responses":{"RequestBodyTooLarge":{"description":"Request body exceeds the internal 2 MiB limit","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Error":{"description":"Public error response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/commit/verify":{"post":{"tags":["Commitments"],"summary":"Verify a keyed cryptographic commitment","description":"Verifies a commitment using plaintext, opening, commitment, and the selected signed commitment profile. Verify permits active and retired keys.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommitVerifyInput"}}}},"responses":{"200":{"description":"Commitment verification result","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommitVerifyOutput"}}}},"413":{"$ref":"#/components/responses/RequestBodyTooLarge"},"default":{"$ref":"#/components/responses/Error"}}}}}}
```

## Verify cryptographic commitments as an all-or-nothing batch

> Verifies commitments for a batch using one signed commitment profile. Request validation and execution errors fail the whole batch; well formed mismatches return valid=false for their items.<br>

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"tags":[{"name":"Commitments"}],"servers":[{"url":"http://127.0.0.1:3000","description":"Local default server over HTTP"},{"url":"https://127.0.0.1:3000","description":"Local HTTPS server when VECTIS_MODE=prod"}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-API-Key"}},"schemas":{"CommitVerifyBatchInput":{"type":"object","additionalProperties":false,"required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/CommitVerifyBatchItemInput"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"CommitVerifyBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext","opening","commitment"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"},"commitment":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"CommitVerifyBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","items":{"$ref":"#/components/schemas/CommitVerifyBatchOutputItem"}}}},"CommitVerifyBatchOutputItem":{"type":"object","required":["ref","valid"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"valid":{"type":"boolean"}}},"ErrorResponse":{"type":"object","required":["error"],"properties":{"error":{"$ref":"#/components/schemas/TextField"}}}},"responses":{"RequestBodyTooLarge":{"description":"Request body exceeds the internal 2 MiB limit","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Error":{"description":"Public error response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/commit/verify/batch":{"post":{"tags":["Commitments"],"summary":"Verify cryptographic commitments as an all-or-nothing batch","description":"Verifies commitments for a batch using one signed commitment profile. Request validation and execution errors fail the whole batch; well formed mismatches return valid=false for their items.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommitVerifyBatchInput"}}}},"responses":{"200":{"description":"Commitment verification results","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommitVerifyBatchOutput"}}}},"413":{"$ref":"#/components/responses/RequestBodyTooLarge"},"default":{"$ref":"#/components/responses/Error"}}}}}}
```