> For the complete documentation index, see [llms.txt](https://vectis.liesware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vectis.liesware.com/models.md).

# Models

## The Kid object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}}}
```

## The HexString object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The TextField object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The ClientRef object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The Base64UrlNoPad object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"}}}}
```

## The AadSafeText object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."}}}}
```

## The Timestamp object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Timestamp":{"type":"string","pattern":"^[0-9]+$"}}}}
```

## The ErrorResponse object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ErrorResponse":{"type":"object","required":["error"],"properties":{"error":{"$ref":"#/components/schemas/TextField"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TimeAttestationOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TimeAttestationOutput":{"type":"object","required":["version","provider","sources","server_clock"],"additionalProperties":false,"properties":{"version":{"type":"string","const":"vectis-time-attestation-v1"},"provider":{"type":"string","minLength":1,"maxLength":128,"description":"Provider identifier. V1 supports cloudflare."},"sources":{"type":"object","required":["system","nts","roughtime"],"properties":{"system":{"type":"object","required":["unix_us"],"properties":{"unix_us":{"type":"string","pattern":"^[0-9]+$"}}},"nts":{"type":"object","required":["authenticated","server","offset_us","round_trip_us"],"properties":{"authenticated":{"type":"boolean","const":true},"server":{"type":"string"},"offset_us":{"type":"string","pattern":"^-?[0-9]+$"},"round_trip_us":{"type":"string","pattern":"^[0-9]+$"}}},"roughtime":{"type":"object","required":["verified","server","midpoint_us","radius_us","earliest_us","latest_us","nonce_b64","response_b64"],"properties":{"verified":{"type":"boolean","const":true},"server":{"type":"string"},"midpoint_us":{"type":"string","pattern":"^[0-9]+$"},"radius_us":{"type":"string","pattern":"^[0-9]+$"},"earliest_us":{"type":"string","pattern":"^[0-9]+$"},"latest_us":{"type":"string","pattern":"^[0-9]+$"},"nonce_b64":{"type":"string"},"response_b64":{"type":"string"}}}}},"server_clock":{"type":"object","required":["acceptable","max_allowed_skew_ms","local_vs_nts_skew_ms","local_within_roughtime_interval","nts_within_roughtime_interval"],"properties":{"acceptable":{"type":"boolean"},"max_allowed_skew_ms":{"type":"integer","minimum":1},"local_vs_nts_skew_ms":{"type":"number"},"local_within_roughtime_interval":{"type":"boolean"},"nts_within_roughtime_interval":{"type":"boolean"}}}}}}}}
```

## The StartupHealthOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"StartupHealthOutput":{"type":"object","required":["status","timestamp"],"properties":{"status":{"const":"started"},"timestamp":{"$ref":"#/components/schemas/Timestamp"}}},"Timestamp":{"type":"string","pattern":"^[0-9]+$"}}}}
```

## The LiveHealthOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"LiveHealthOutput":{"type":"object","required":["status"],"properties":{"status":{"const":"ok"}}}}}}
```

## The ReadyHealthOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ReadyHealthOutput":{"type":"object","required":["status","unsealed","storage","keys_loaded","routes_loaded"],"properties":{"status":{"const":"ready"},"unsealed":{"type":"boolean"},"storage":{"const":"ok"},"keys_loaded":{"type":"integer","minimum":0},"routes_loaded":{"type":"integer","minimum":0}}}}}}
```

## The CreateKeysInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CreateKeysInput":{"type":"object","additionalProperties":false,"properties":{"tag":{"$ref":"#/components/schemas/AadSafeText"},"profile":{"$ref":"#/components/schemas/CryptoProfile"},"hash_algorithm":{"$ref":"#/components/schemas/HashAlgorithm"},"symmetric_algorithm":{"$ref":"#/components/schemas/SymmetricAlgorithm"},"eddsa_algorithm":{"$ref":"#/components/schemas/EdDsaAlgorithm"},"xecdh_algorithm":{"$ref":"#/components/schemas/XecdhAlgorithm"},"ml_dsa_variant":{"$ref":"#/components/schemas/MlDsaVariant"},"ml_kem_variant":{"$ref":"#/components/schemas/MlKemVariant"}},"description":"When VECTIS_CRYPTO_POLICY=profile-only, only tag and profile are accepted. Individual algorithm fields are accepted only when VECTIS_CRYPTO_POLICY=allow-overrides. Optional fields may be omitted, but explicit null values are rejected.\n"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"CryptoProfile":{"enum":["hybrid-performance-v1","hybrid-standard-v1","hybrid-high-assurance-v1","hybrid-long-term-v1"]},"HashAlgorithm":{"enum":["BLAKE2b(160)","BLAKE2b(224)","BLAKE2b(256)","BLAKE2b(384)","BLAKE2b(512)","SHA-224","SHA-256","SHA-384","SHA-512","SHA-512-256","SHA-3(224)","SHA-3(256)","SHA-3(384)","SHA-3(512)","Whirlpool"]},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]},"EdDsaAlgorithm":{"enum":["Ed25519","Ed448"]},"XecdhAlgorithm":{"enum":["X25519","X448"]},"MlDsaVariant":{"enum":["ML-DSA-44","ML-DSA-65","ML-DSA-87"]},"MlKemVariant":{"enum":["ML-KEM-512","ML-KEM-768","ML-KEM-1024"]}}}}
```

## The CreateKeysResponse object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CreateKeysResponse":{"type":"object","required":["kid"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}}}
```

## The ListKeysOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ListKeysOutput":{"type":"object","required":["keys"],"properties":{"keys":{"type":"array","items":{"type":"object","required":["kid","info"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"info":{"$ref":"#/components/schemas/TextField"}}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The ListKeysPropertiesOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ListKeysPropertiesOutput":{"type":"object","required":["keys"],"properties":{"keys":{"type":"array","items":{"type":"object","required":["kid","info","properties_info","properties"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"info":{"$ref":"#/components/schemas/TextField"},"properties_info":{"$ref":"#/components/schemas/TextField"},"properties":{"$ref":"#/components/schemas/OpsKeyProperties"}}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"OpsKeyProperties":{"type":"object","required":["version","profile","tag","created_at","lifecycle"],"properties":{"version":{"const":1},"profile":{"enum":["hybrid-performance-v1","hybrid-standard-v1","hybrid-high-assurance-v1","hybrid-long-term-v1","custom"]},"tag":{"$ref":"#/components/schemas/TextField"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"lifecycle":{"$ref":"#/components/schemas/OpsKeyLifecycle"}}},"Timestamp":{"type":"string","pattern":"^[0-9]+$"},"OpsKeyLifecycle":{"type":"object","required":["status","reason","changed_at"],"properties":{"status":{"$ref":"#/components/schemas/LifecycleStatus"},"reason":{"$ref":"#/components/schemas/TextField","maxLength":128},"changed_at":{"type":"string"}}},"LifecycleStatus":{"type":"string","enum":["active","disabled","retired","compromised","destroyed"]}}}}
```

## The KeyPropertiesOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"KeyPropertiesOutput":{"type":"object","required":["kid","info","properties_info","properties"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"info":{"$ref":"#/components/schemas/TextField"},"properties_info":{"$ref":"#/components/schemas/TextField"},"properties":{"$ref":"#/components/schemas/OpsKeyProperties"}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"OpsKeyProperties":{"type":"object","required":["version","profile","tag","created_at","lifecycle"],"properties":{"version":{"const":1},"profile":{"enum":["hybrid-performance-v1","hybrid-standard-v1","hybrid-high-assurance-v1","hybrid-long-term-v1","custom"]},"tag":{"$ref":"#/components/schemas/TextField"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"lifecycle":{"$ref":"#/components/schemas/OpsKeyLifecycle"}}},"Timestamp":{"type":"string","pattern":"^[0-9]+$"},"OpsKeyLifecycle":{"type":"object","required":["status","reason","changed_at"],"properties":{"status":{"$ref":"#/components/schemas/LifecycleStatus"},"reason":{"$ref":"#/components/schemas/TextField","maxLength":128},"changed_at":{"type":"string"}}},"LifecycleStatus":{"type":"string","enum":["active","disabled","retired","compromised","destroyed"]}}}}
```

## The OpsKeyProperties object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"OpsKeyProperties":{"type":"object","required":["version","profile","tag","created_at","lifecycle"],"properties":{"version":{"const":1},"profile":{"enum":["hybrid-performance-v1","hybrid-standard-v1","hybrid-high-assurance-v1","hybrid-long-term-v1","custom"]},"tag":{"$ref":"#/components/schemas/TextField"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"lifecycle":{"$ref":"#/components/schemas/OpsKeyLifecycle"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"Timestamp":{"type":"string","pattern":"^[0-9]+$"},"OpsKeyLifecycle":{"type":"object","required":["status","reason","changed_at"],"properties":{"status":{"$ref":"#/components/schemas/LifecycleStatus"},"reason":{"$ref":"#/components/schemas/TextField","maxLength":128},"changed_at":{"type":"string"}}},"LifecycleStatus":{"type":"string","enum":["active","disabled","retired","compromised","destroyed"]}}}}
```

## The OpsKeyLifecycle object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"OpsKeyLifecycle":{"type":"object","required":["status","reason","changed_at"],"properties":{"status":{"$ref":"#/components/schemas/LifecycleStatus"},"reason":{"$ref":"#/components/schemas/TextField","maxLength":128},"changed_at":{"type":"string"}}},"LifecycleStatus":{"type":"string","enum":["active","disabled","retired","compromised","destroyed"]},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The LifecycleStatus object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"LifecycleStatus":{"type":"string","enum":["active","disabled","retired","compromised","destroyed"]}}}}
```

## The UpdateLifecycleInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"UpdateLifecycleInput":{"type":"object","additionalProperties":false,"required":["status","reason"],"properties":{"status":{"$ref":"#/components/schemas/LifecycleStatus"},"reason":{"$ref":"#/components/schemas/TextField","maxLength":128}}},"LifecycleStatus":{"type":"string","enum":["active","disabled","retired","compromised","destroyed"]},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The UpdateLifecycleOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"UpdateLifecycleOutput":{"type":"object","required":["kid","lifecycle"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"lifecycle":{"$ref":"#/components/schemas/OpsKeyLifecycle"}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"OpsKeyLifecycle":{"type":"object","required":["status","reason","changed_at"],"properties":{"status":{"$ref":"#/components/schemas/LifecycleStatus"},"reason":{"$ref":"#/components/schemas/TextField","maxLength":128},"changed_at":{"type":"string"}}},"LifecycleStatus":{"type":"string","enum":["active","disabled","retired","compromised","destroyed"]},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The RoutesOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"RoutesOutput":{"type":"object","required":["routes"],"properties":{"routes":{"type":"array","items":{"$ref":"#/components/schemas/FinalAppRoute"}}}},"FinalAppRoute":{"type":"object","required":["kid","name","final_app_addr","final_app_path"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"name":{"$ref":"#/components/schemas/TextField"},"final_app_addr":{"$ref":"#/components/schemas/TextField"},"final_app_path":{"$ref":"#/components/schemas/TextField"}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The RemoteRoutesOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"RemoteRoutesOutput":{"type":"object","required":["routes"],"properties":{"routes":{"type":"array","items":{"$ref":"#/components/schemas/RemoteRoute"}}}},"RemoteRoute":{"type":"object","required":["remote_kid","name","remote_addr","allowed_local_kids","status"],"properties":{"remote_kid":{"$ref":"#/components/schemas/Kid"},"name":{"$ref":"#/components/schemas/TextField"},"remote_addr":{"$ref":"#/components/schemas/TextField"},"allowed_local_kids":{"type":"array","minItems":1,"items":{"type":"string"}},"status":{"type":"string","enum":["active","disabled"]},"public_keys":{"type":"object","description":"Optional. The peer's full public key set (the `keys` object from its GET /pub/{kid}). When present, /message uses these trusted keys directly and POST /sign/verification can verify tokens signed by this remote kid (cross-instance verification). Vectis validates the material before loading it: DER public keys must be loadable by Botan, X25519/X448 raw public keys must be exactly 32/56 bytes, and ML-KEM public keys must be loadable and usable for encapsulation.\n","required":["eddsa","xecdh","ml-dsa","ml-kem"],"properties":{"eddsa":{"$ref":"#/components/schemas/PublicDerKey"},"xecdh":{"$ref":"#/components/schemas/PublicRawKey"},"ml-dsa":{"$ref":"#/components/schemas/PublicDerKey"},"ml-kem":{"$ref":"#/components/schemas/PublicDerKey"}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"PublicDerKey":{"type":"object","required":["alg","public_key_der_hex"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"public_key_der_hex":{"$ref":"#/components/schemas/HexString"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"PublicRawKey":{"type":"object","required":["alg","public_key_hex"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"public_key_hex":{"$ref":"#/components/schemas/HexString"}}}}}}
```

## The PermissionsOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"PermissionsOutput":{"type":"object","required":["clients"],"properties":{"clients":{"type":"array","items":{"$ref":"#/components/schemas/PermissionClientOutput"}}}},"PermissionClientOutput":{"type":"object","required":["client","admin","permissions"],"properties":{"client":{"$ref":"#/components/schemas/TextField"},"admin":{"type":"boolean"},"permissions":{"type":"array","items":{"$ref":"#/components/schemas/KidPermissionOutput"}}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"KidPermissionOutput":{"type":"object","required":["kid","actions"],"properties":{"kid":{"type":"string"},"actions":{"type":"array","items":{"type":"string","enum":["admin","keys","lifecycle","self-test","sign","message","symmetric","fpe-encrypt","fpe-decrypt","token-encode","token-decode","token-delete","token-deterministic-encode","token-deterministic-decode","subject-create","subject-delete","mac-create","mac-verify","commit-create","commit-verify","share-split","share-combine","index-create","index-verify","mask","time-attest","metrics"]}}}}}}}
```

## The PermissionClientOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"PermissionClientOutput":{"type":"object","required":["client","admin","permissions"],"properties":{"client":{"$ref":"#/components/schemas/TextField"},"admin":{"type":"boolean"},"permissions":{"type":"array","items":{"$ref":"#/components/schemas/KidPermissionOutput"}}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"KidPermissionOutput":{"type":"object","required":["kid","actions"],"properties":{"kid":{"type":"string"},"actions":{"type":"array","items":{"type":"string","enum":["admin","keys","lifecycle","self-test","sign","message","symmetric","fpe-encrypt","fpe-decrypt","token-encode","token-decode","token-delete","token-deterministic-encode","token-deterministic-decode","subject-create","subject-delete","mac-create","mac-verify","commit-create","commit-verify","share-split","share-combine","index-create","index-verify","mask","time-attest","metrics"]}}}}}}}
```

## The KidPermissionOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"KidPermissionOutput":{"type":"object","required":["kid","actions"],"properties":{"kid":{"type":"string"},"actions":{"type":"array","items":{"type":"string","enum":["admin","keys","lifecycle","self-test","sign","message","symmetric","fpe-encrypt","fpe-decrypt","token-encode","token-decode","token-delete","token-deterministic-encode","token-deterministic-decode","subject-create","subject-delete","mac-create","mac-verify","commit-create","commit-verify","share-split","share-combine","index-create","index-verify","mask","time-attest","metrics"]}}}}}}}
```

## The ReloadConfigResponse object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ReloadConfigResponse":{"type":"object","required":["status","routes_loaded","remote_routes_loaded","clients_loaded","fpe_profiles_loaded","tokenization_profiles_loaded","deterministic_tokenization_profiles_loaded","mac_profiles_loaded","commitment_profiles_loaded","masking_profiles_loaded","sharing_profiles_loaded"],"properties":{"status":{"const":"reloaded"},"warning":{"type":"string","description":"Present only when config.json has changes not covered by config_sign.json and the previous in-memory config was kept."},"routes_loaded":{"type":"integer","minimum":0},"remote_routes_loaded":{"type":"integer","minimum":0},"clients_loaded":{"type":"integer","minimum":0},"fpe_profiles_loaded":{"type":"integer","minimum":0},"tokenization_profiles_loaded":{"type":"integer","minimum":0},"deterministic_tokenization_profiles_loaded":{"type":"integer","minimum":0},"mac_profiles_loaded":{"type":"integer","minimum":0},"commitment_profiles_loaded":{"type":"integer","minimum":0},"masking_profiles_loaded":{"type":"integer","minimum":0},"sharing_profiles_loaded":{"type":"integer","minimum":0}}}}}}
```

## The FinalAppRoute object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FinalAppRoute":{"type":"object","required":["kid","name","final_app_addr","final_app_path"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"name":{"$ref":"#/components/schemas/TextField"},"final_app_addr":{"$ref":"#/components/schemas/TextField"},"final_app_path":{"$ref":"#/components/schemas/TextField"}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The RemoteRoute object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"RemoteRoute":{"type":"object","required":["remote_kid","name","remote_addr","allowed_local_kids","status"],"properties":{"remote_kid":{"$ref":"#/components/schemas/Kid"},"name":{"$ref":"#/components/schemas/TextField"},"remote_addr":{"$ref":"#/components/schemas/TextField"},"allowed_local_kids":{"type":"array","minItems":1,"items":{"type":"string"}},"status":{"type":"string","enum":["active","disabled"]},"public_keys":{"type":"object","description":"Optional. The peer's full public key set (the `keys` object from its GET /pub/{kid}). When present, /message uses these trusted keys directly and POST /sign/verification can verify tokens signed by this remote kid (cross-instance verification). Vectis validates the material before loading it: DER public keys must be loadable by Botan, X25519/X448 raw public keys must be exactly 32/56 bytes, and ML-KEM public keys must be loadable and usable for encapsulation.\n","required":["eddsa","xecdh","ml-dsa","ml-kem"],"properties":{"eddsa":{"$ref":"#/components/schemas/PublicDerKey"},"xecdh":{"$ref":"#/components/schemas/PublicRawKey"},"ml-dsa":{"$ref":"#/components/schemas/PublicDerKey"},"ml-kem":{"$ref":"#/components/schemas/PublicDerKey"}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"PublicDerKey":{"type":"object","required":["alg","public_key_der_hex"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"public_key_der_hex":{"$ref":"#/components/schemas/HexString"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"PublicRawKey":{"type":"object","required":["alg","public_key_hex"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"public_key_hex":{"$ref":"#/components/schemas/HexString"}}}}}}
```

## The PublicKeysOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"PublicKeysOutput":{"type":"object","required":["info","keys"],"properties":{"info":{"$ref":"#/components/schemas/TextField"},"keys":{"type":"object","required":["eddsa","xecdh","ml-dsa","ml-kem"],"properties":{"eddsa":{"$ref":"#/components/schemas/PublicDerKey"},"xecdh":{"$ref":"#/components/schemas/PublicRawKey"},"ml-dsa":{"$ref":"#/components/schemas/PublicDerKey"},"ml-kem":{"$ref":"#/components/schemas/PublicDerKey"}}}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"PublicDerKey":{"type":"object","required":["alg","public_key_der_hex"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"public_key_der_hex":{"$ref":"#/components/schemas/HexString"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"PublicRawKey":{"type":"object","required":["alg","public_key_hex"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"public_key_hex":{"$ref":"#/components/schemas/HexString"}}}}}}
```

## The PublicDerKey object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"PublicDerKey":{"type":"object","required":["alg","public_key_der_hex"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"public_key_der_hex":{"$ref":"#/components/schemas/HexString"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The PublicRawKey object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"PublicRawKey":{"type":"object","required":["alg","public_key_hex"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"public_key_hex":{"$ref":"#/components/schemas/HexString"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The KeyValidationOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"KeyValidationOutput":{"type":"object","required":["timestamp","aad","hash","symmetric","eddsa","xecdh","ml-dsa","ml-kem"],"properties":{"timestamp":{"$ref":"#/components/schemas/Timestamp"},"aad":{"$ref":"#/components/schemas/TextField"},"hash":{"type":"object","required":["variant","value_hex"],"properties":{"variant":{"$ref":"#/components/schemas/HashAlgorithm"},"value_hex":{"$ref":"#/components/schemas/HexString"}}},"symmetric":{"$ref":"#/components/schemas/VariantValidation"},"eddsa":{"$ref":"#/components/schemas/VariantValidation"},"xecdh":{"$ref":"#/components/schemas/VariantValidation"},"ml-dsa":{"$ref":"#/components/schemas/VariantValidation"},"ml-kem":{"$ref":"#/components/schemas/VariantValidation"}}},"Timestamp":{"type":"string","pattern":"^[0-9]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"HashAlgorithm":{"enum":["BLAKE2b(160)","BLAKE2b(224)","BLAKE2b(256)","BLAKE2b(384)","BLAKE2b(512)","SHA-224","SHA-256","SHA-384","SHA-512","SHA-512-256","SHA-3(224)","SHA-3(256)","SHA-3(384)","SHA-3(512)","Whirlpool"]},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"VariantValidation":{"type":"object","required":["variant","valid"],"properties":{"variant":{"$ref":"#/components/schemas/TextField"},"valid":{"type":"boolean"}}}}}}
```

## The VariantValidation object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"VariantValidation":{"type":"object","required":["variant","valid"],"properties":{"variant":{"$ref":"#/components/schemas/TextField"},"valid":{"type":"boolean"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The SignInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SignInput":{"type":"object","additionalProperties":false,"required":["message_hash"],"properties":{"message_hash":{"$ref":"#/components/schemas/MessageHash"}}},"MessageHash":{"oneOf":[{"$ref":"#/components/schemas/Hash160"},{"$ref":"#/components/schemas/Hash224Blake2b"},{"$ref":"#/components/schemas/Hash224Sha2"},{"$ref":"#/components/schemas/Hash224Sha3"},{"$ref":"#/components/schemas/Hash256"},{"$ref":"#/components/schemas/Hash384"},{"$ref":"#/components/schemas/Hash512"}]},"Hash160":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"BLAKE2b(160)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{40}$"}}},"Hash224Blake2b":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"BLAKE2b(224)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}},"Hash224Sha2":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"SHA-224"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}},"Hash224Sha3":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"SHA-3(224)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}},"Hash256":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(256)","SHA-256","SHA-512-256","SHA-3(256)"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}},"Hash384":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(384)","SHA-384","SHA-3(384)"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{96}$"}}},"Hash512":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(512)","SHA-512","SHA-3(512)","Whirlpool"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{128}$"}}}}}}
```

## The MessageHash object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MessageHash":{"oneOf":[{"$ref":"#/components/schemas/Hash160"},{"$ref":"#/components/schemas/Hash224Blake2b"},{"$ref":"#/components/schemas/Hash224Sha2"},{"$ref":"#/components/schemas/Hash224Sha3"},{"$ref":"#/components/schemas/Hash256"},{"$ref":"#/components/schemas/Hash384"},{"$ref":"#/components/schemas/Hash512"}]},"Hash160":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"BLAKE2b(160)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{40}$"}}},"Hash224Blake2b":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"BLAKE2b(224)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}},"Hash224Sha2":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"SHA-224"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}},"Hash224Sha3":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"SHA-3(224)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}},"Hash256":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(256)","SHA-256","SHA-512-256","SHA-3(256)"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}},"Hash384":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(384)","SHA-384","SHA-3(384)"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{96}$"}}},"Hash512":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(512)","SHA-512","SHA-3(512)","Whirlpool"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{128}$"}}}}}}
```

## The Hash160 object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Hash160":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"BLAKE2b(160)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{40}$"}}}}}}
```

## The Hash224Blake2b object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Hash224Blake2b":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"BLAKE2b(224)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}}}}}
```

## The Hash224Sha2 object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Hash224Sha2":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"SHA-224"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}}}}}
```

## The Hash224Sha3 object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Hash224Sha3":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"const":"SHA-3(224)"},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{56}$"}}}}}}
```

## The Hash256 object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Hash256":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(256)","SHA-256","SHA-512-256","SHA-3(256)"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}}}}}
```

## The Hash384 object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Hash384":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(384)","SHA-384","SHA-3(384)"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{96}$"}}}}}}
```

## The Hash512 object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Hash512":{"type":"object","additionalProperties":false,"required":["alg","hex"],"properties":{"alg":{"enum":["BLAKE2b(512)","SHA-512","SHA-3(512)","Whirlpool"]},"hex":{"type":"string","pattern":"^[0-9a-fA-F]{128}$"}}}}}}
```

## The CompactSignatureToken object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CompactSignatureToken":{"type":"object","additionalProperties":false,"required":["kid","signature"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"signature":{"type":"string","maxLength":65536,"description":"Four unpadded Base64URL segments: header.payload.eddsa.ml-dsa."}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}}}
```

## The DualSignatures object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DualSignatures":{"type":"object","required":["eddsa","ml-dsa"],"properties":{"eddsa":{"$ref":"#/components/schemas/SignatureBlock"},"ml-dsa":{"$ref":"#/components/schemas/SignatureBlock"}}},"SignatureBlock":{"type":"object","required":["alg","sig"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"sig":{"$ref":"#/components/schemas/HexString"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The SignatureBlock object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SignatureBlock":{"type":"object","required":["alg","sig"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"sig":{"$ref":"#/components/schemas/HexString"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The VerificationOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"VerificationOutput":{"type":"object","required":["status","valid"],"properties":{"status":{"type":"object","required":["eddsa","ml-dsa"],"properties":{"eddsa":{"enum":["ok","fail","not_checked"]},"ml-dsa":{"enum":["ok","fail"]}}},"valid":{"enum":["ok","fail"]}}}}}}
```

## The SendMessageInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SendMessageInput":{"type":"object","required":["recipient_kid","message"],"properties":{"recipient_kid":{"$ref":"#/components/schemas/Kid"},"message":{"$ref":"#/components/schemas/TextField"}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The SendMessageOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SendMessageOutput":{"type":"object","required":["message","symmetric","eddsa","xecdh","ml-dsa","ml-kem"],"properties":{"message":{"type":"object","required":["valid"],"properties":{"valid":{"type":"boolean"}}},"symmetric":{"$ref":"#/components/schemas/VariantValidation"},"eddsa":{"$ref":"#/components/schemas/VariantValidation"},"xecdh":{"$ref":"#/components/schemas/VariantValidation"},"ml-dsa":{"$ref":"#/components/schemas/VariantValidation"},"ml-kem":{"$ref":"#/components/schemas/VariantValidation"}}},"VariantValidation":{"type":"object","required":["variant","valid"],"properties":{"variant":{"$ref":"#/components/schemas/TextField"},"valid":{"type":"boolean"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The ProtectedMessageToken object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ProtectedMessageToken":{"type":"object","required":["version","payload","signatures"],"properties":{"version":{"const":"v1","description":"Envelope version for dispatch; must equal payload.version."},"payload":{"type":"object","required":["version","type","created_at","sender","recipient","kem","cipher"],"properties":{"version":{"const":"v1","description":"Signed payload version; integrity-protected by the signatures."},"type":{"const":"protected-message"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"sender":{"type":"object","required":["host","kid"],"properties":{"host":{"$ref":"#/components/schemas/TextField"},"kid":{"$ref":"#/components/schemas/Kid"}}},"recipient":{"type":"object","required":["kid"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"}}},"kem":{"type":"object","required":["alg","xecdh_ephemeral_public","ml_kem_ciphertext","ml_kem_salt","hkdf_salt"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"xecdh_ephemeral_public":{"$ref":"#/components/schemas/HexString"},"ml_kem_ciphertext":{"$ref":"#/components/schemas/HexString"},"ml_kem_salt":{"$ref":"#/components/schemas/HexString"},"hkdf_salt":{"$ref":"#/components/schemas/HexString"}}},"cipher":{"$ref":"#/components/schemas/MessageCipher"}}},"signatures":{"$ref":"#/components/schemas/DualSignatures"}}},"Timestamp":{"type":"string","pattern":"^[0-9]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"MessageCipher":{"type":"object","required":["alg","nonce","aad","ct"],"properties":{"alg":{"$ref":"#/components/schemas/SymmetricAlgorithm"},"nonce":{"$ref":"#/components/schemas/HexString"},"aad":{"$ref":"#/components/schemas/TextField"},"ct":{"$ref":"#/components/schemas/HexString"}}},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]},"DualSignatures":{"type":"object","required":["eddsa","ml-dsa"],"properties":{"eddsa":{"$ref":"#/components/schemas/SignatureBlock"},"ml-dsa":{"$ref":"#/components/schemas/SignatureBlock"}}},"SignatureBlock":{"type":"object","required":["alg","sig"],"properties":{"alg":{"$ref":"#/components/schemas/TextField"},"sig":{"$ref":"#/components/schemas/HexString"}}}}}}
```

## The ReceiveMessageOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ReceiveMessageOutput":{"type":"object","required":["status","sender_kid","recipient_kid","local_cipher"],"properties":{"status":{"const":"ok"},"sender_kid":{"$ref":"#/components/schemas/Kid"},"recipient_kid":{"$ref":"#/components/schemas/Kid"},"local_cipher":{"type":"object","required":["alg","nonce","aad","ct"],"properties":{"alg":{"$ref":"#/components/schemas/SymmetricAlgorithm"},"nonce":{"$ref":"#/components/schemas/HexString"},"aad":{"$ref":"#/components/schemas/TextField"},"ct":{"$ref":"#/components/schemas/HexString"}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The DecryptMessageInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DecryptMessageInput":{"type":"object","required":["sender_host","sender_kid","timestamp","message"],"properties":{"sender_host":{"$ref":"#/components/schemas/TextField"},"sender_kid":{"$ref":"#/components/schemas/Kid"},"timestamp":{"$ref":"#/components/schemas/Timestamp"},"message":{"$ref":"#/components/schemas/DecryptMessageCipher"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Timestamp":{"type":"string","pattern":"^[0-9]+$"},"DecryptMessageCipher":{"type":"object","required":["ctx","nonce","aad","variant"],"properties":{"ctx":{"$ref":"#/components/schemas/HexString"},"nonce":{"$ref":"#/components/schemas/HexString"},"aad":{"$ref":"#/components/schemas/TextField"},"variant":{"$ref":"#/components/schemas/SymmetricAlgorithm"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]}}}}
```

## The DecryptMessageCipher object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DecryptMessageCipher":{"type":"object","required":["ctx","nonce","aad","variant"],"properties":{"ctx":{"$ref":"#/components/schemas/HexString"},"nonce":{"$ref":"#/components/schemas/HexString"},"aad":{"$ref":"#/components/schemas/TextField"},"variant":{"$ref":"#/components/schemas/SymmetricAlgorithm"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]}}}}
```

## The DecryptMessageOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DecryptMessageOutput":{"type":"object","required":["plaintext"],"properties":{"plaintext":{"$ref":"#/components/schemas/TextField"}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The InternalEncryptMessageInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"InternalEncryptMessageInput":{"type":"object","required":["plaintext"],"properties":{"plaintext":{"$ref":"#/components/schemas/TextField","description":"Maximum 1,047,552 bytes when encoded as UTF-8."}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The InternalMessageOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"InternalMessageOutput":{"type":"object","required":["timestamp","kid","message"],"properties":{"timestamp":{"$ref":"#/components/schemas/Timestamp"},"kid":{"$ref":"#/components/schemas/Kid"},"subject":{"$ref":"#/components/schemas/Subject","description":"Present only for subject-bound symmetric envelopes; never nullable."},"message":{"$ref":"#/components/schemas/InternalMessageCipher"}}},"Timestamp":{"type":"string","pattern":"^[0-9]+$"},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"InternalMessageCipher":{"type":"object","required":["ctx","nonce","aad","variant"],"properties":{"ctx":{"$ref":"#/components/schemas/HexString"},"nonce":{"$ref":"#/components/schemas/HexString"},"aad":{"$ref":"#/components/schemas/TextField"},"variant":{"$ref":"#/components/schemas/SymmetricAlgorithm"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]}}}}
```

## The SubjectSymmetricEnvelope object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SubjectSymmetricEnvelope":{"allOf":[{"$ref":"#/components/schemas/InternalMessageOutput"},{"type":"object","required":["subject"]}]},"InternalMessageOutput":{"type":"object","required":["timestamp","kid","message"],"properties":{"timestamp":{"$ref":"#/components/schemas/Timestamp"},"kid":{"$ref":"#/components/schemas/Kid"},"subject":{"$ref":"#/components/schemas/Subject","description":"Present only for subject-bound symmetric envelopes; never nullable."},"message":{"$ref":"#/components/schemas/InternalMessageCipher"}}},"Timestamp":{"type":"string","pattern":"^[0-9]+$"},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"InternalMessageCipher":{"type":"object","required":["ctx","nonce","aad","variant"],"properties":{"ctx":{"$ref":"#/components/schemas/HexString"},"nonce":{"$ref":"#/components/schemas/HexString"},"aad":{"$ref":"#/components/schemas/TextField"},"variant":{"$ref":"#/components/schemas/SymmetricAlgorithm"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]}}}}
```

## The InternalMessageCipher object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"InternalMessageCipher":{"type":"object","required":["ctx","nonce","aad","variant"],"properties":{"ctx":{"$ref":"#/components/schemas/HexString"},"nonce":{"$ref":"#/components/schemas/HexString"},"aad":{"$ref":"#/components/schemas/TextField"},"variant":{"$ref":"#/components/schemas/SymmetricAlgorithm"}}},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]}}}}
```

## The FpeAuthTag object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeAuthTag":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"HMAC-BLAKE2b-256; required for authenticated profiles and prohibited for legacy decrypt. Never nullable."}}}}
```

## The FpeProfileConfig object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeProfileConfig":{"type":"object","description":"Signed configuration entry, not an HTTP operation input. Exactly one alphabet selector is required. Custom alphabet order is preserved without normalization. Preserved characters must be distinct and disjoint from the resolved alphabet; these constraints are enforced by Vectis. Length bounds include separators; the effective FF1 domain counts only encrypted characters and must contain at least 1,000,000 values.\n","additionalProperties":false,"required":["name","fpe_version","min_len","max_len","tweak_aad","kid"],"properties":{"name":{"$ref":"#/components/schemas/AadSafeText","maxLength":128},"fpe_version":{"type":"string","const":"fpe-ff1-2025"},"kid":{"$ref":"#/components/schemas/Kid"},"alphabet":{"$ref":"#/components/schemas/TextField","minLength":2,"maxLength":65536},"alphabet_preset":{"type":"string","enum":["num","alpha","alphanum"]},"letter_case":{"type":"string","enum":["uppercase","lowercase","mixed"]},"preserve_characters":{"type":"string","maxLength":32,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]*$","description":"Optional, empty when absent. Distinct Unicode characters; no controls, trimming or normalization. Explicit empty string remains present when serialized."},"authenticated":{"type":"boolean","default":false,"description":"Signed policy; false is omitted in canonical serialization. Requests cannot override it."},"subject_mode":{"$ref":"#/components/schemas/SubjectMode"},"min_len":{"type":"integer","minimum":6,"maximum":1024},"max_len":{"type":"integer","minimum":6,"maximum":1024},"tweak_aad":{"type":"string","minLength":1,"maxLength":128}},"oneOf":[{"required":["alphabet"],"not":{"anyOf":[{"required":["alphabet_preset"]},{"required":["letter_case"]}]}},{"required":["alphabet_preset"],"properties":{"alphabet_preset":{"const":"num"}},"not":{"anyOf":[{"required":["alphabet"]},{"required":["letter_case"]}]}},{"required":["alphabet_preset","letter_case"],"properties":{"alphabet_preset":{"enum":["alpha","alphanum"]}},"not":{"required":["alphabet"]}}]},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"SubjectMode":{"type":"string","enum":["none","stored"],"default":"none","description":"Signed tokenization profile policy; never supplied in an operation request."}}}}
```

## The FpeEncryptInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeEncryptInput":{"type":"object","additionalProperties":false,"required":["ref","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"profile":{"$ref":"#/components/schemas/TextField"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The FpeSubjectEncryptOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeSubjectEncryptOutput":{"allOf":[{"$ref":"#/components/schemas/FpeEncryptOutput"},{"type":"object","required":["subject"],"properties":{"subject":{"$ref":"#/components/schemas/Subject"}}}]},"FpeEncryptOutput":{"type":"object","required":["ref","kid","profile","ciphertext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"ciphertext":{"$ref":"#/components/schemas/TextField"},"tag":{"$ref":"#/components/schemas/FpeAuthTag"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"FpeAuthTag":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"HMAC-BLAKE2b-256; required for authenticated profiles and prohibited for legacy decrypt. Never nullable."},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."}}}}
```

## The FpeSubjectEncryptBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeSubjectEncryptBatchOutput":{"allOf":[{"$ref":"#/components/schemas/FpeEncryptBatchOutput"},{"type":"object","required":["subject"],"properties":{"subject":{"$ref":"#/components/schemas/Subject"}}}]},"FpeEncryptBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","items":{"type":"object","required":["ref","ciphertext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"ciphertext":{"$ref":"#/components/schemas/TextField"},"tag":{"$ref":"#/components/schemas/FpeAuthTag"}}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"FpeAuthTag":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"HMAC-BLAKE2b-256; required for authenticated profiles and prohibited for legacy decrypt. Never nullable."},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."}}}}
```

## The FpeEncryptOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeEncryptOutput":{"type":"object","required":["ref","kid","profile","ciphertext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"ciphertext":{"$ref":"#/components/schemas/TextField"},"tag":{"$ref":"#/components/schemas/FpeAuthTag"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"FpeAuthTag":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"HMAC-BLAKE2b-256; required for authenticated profiles and prohibited for legacy decrypt. Never nullable."}}}}
```

## The FpeEncryptBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeEncryptBatchInput":{"type":"object","additionalProperties":false,"required":["profile","items"],"properties":{"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}}}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The FpeEncryptBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeEncryptBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","items":{"type":"object","required":["ref","ciphertext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"ciphertext":{"$ref":"#/components/schemas/TextField"},"tag":{"$ref":"#/components/schemas/FpeAuthTag"}}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"FpeAuthTag":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"HMAC-BLAKE2b-256; required for authenticated profiles and prohibited for legacy decrypt. Never nullable."}}}}
```

## The FpeDecryptInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeDecryptInput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","ciphertext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored FPE profiles, prohibited for none; never nullable. One subject applies to all batch items."},"profile":{"$ref":"#/components/schemas/TextField"},"ciphertext":{"$ref":"#/components/schemas/TextField"},"tag":{"$ref":"#/components/schemas/FpeAuthTag"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"FpeAuthTag":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"HMAC-BLAKE2b-256; required for authenticated profiles and prohibited for legacy decrypt. Never nullable."}}}}
```

## The FpeDecryptOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeDecryptOutput":{"type":"object","required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The FpeDecryptBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeDecryptBatchInput":{"type":"object","additionalProperties":false,"required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored FPE profiles, prohibited for none; never nullable. One subject applies to all batch items."},"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"type":"object","additionalProperties":false,"required":["ref","ciphertext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"ciphertext":{"$ref":"#/components/schemas/TextField"},"tag":{"$ref":"#/components/schemas/FpeAuthTag"}}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"FpeAuthTag":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"HMAC-BLAKE2b-256; required for authenticated profiles and prohibited for legacy decrypt. Never nullable."}}}}
```

## The FpeDecryptBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"FpeDecryptBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","items":{"type":"object","required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The Subject object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."}}}}
```

## The SubjectMode object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SubjectMode":{"type":"string","enum":["none","stored"],"default":"none","description":"Signed tokenization profile policy; never supplied in an operation request."}}}}
```

## The CreateSubjectInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CreateSubjectInput":{"type":"object","additionalProperties":false,"required":["profile","subject_name"],"properties":{"profile":{"$ref":"#/components/schemas/AadSafeText","maxLength":128},"subject_name":{"$ref":"#/components/schemas/AadSafeText","maxLength":128,"description":"Not whitespace-only; no controls, semicolon or equals. No trimming or Unicode normalization. Not stored or logged."}}},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."}}}}
```

## The CreateSubjectOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CreateSubjectOutput":{"type":"object","additionalProperties":false,"required":["kid","profile","subject"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"subject":{"$ref":"#/components/schemas/Subject"}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."}}}}
```

## The SubjectTokenEncodeOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SubjectTokenEncodeOutput":{"allOf":[{"$ref":"#/components/schemas/TokenEncodeOutput"},{"type":"object","required":["subject"]}]},"TokenEncodeOutput":{"type":"object","required":["ref","kid","profile","token"],"properties":{"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored profiles and absent for legacy none profiles."},"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"token":{"$ref":"#/components/schemas/TextField","description":"Visible token in the form <token_prefix>_<base64url-no-pad random bytes>. The configured token_prefix is capped at 16 characters; the decoded random byte length equals the signed profile token_len."}}},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The SubjectTokenEncodeBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SubjectTokenEncodeBatchOutput":{"allOf":[{"$ref":"#/components/schemas/TokenEncodeBatchOutput"},{"type":"object","required":["subject"]}]},"TokenEncodeBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored profiles and absent for legacy none profiles."},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","items":{"$ref":"#/components/schemas/TokenEncodeBatchOutputItem"}}}},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"TokenEncodeBatchOutputItem":{"type":"object","required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"$ref":"#/components/schemas/TextField","description":"Visible token in the form <token_prefix>_<base64url-no-pad random bytes>. The configured token_prefix is capped at 16 characters; the decoded random byte length equals the signed profile token_len."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenEncodeInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenEncodeInput":{"type":"object","additionalProperties":false,"required":["ref","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"profile":{"type":"string","minLength":1,"maxLength":128},"plaintext":{"type":"string","minLength":1,"maxLength":16384,"description":"Unicode scalar count, also bounded by the signed profile."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenEncodeOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenEncodeOutput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"type":"string","minLength":1,"maxLength":128},"token":{"type":"string","maxLength":131072,"pattern":"^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$","description":"Canonical context and complete AES-256-SIV output, Base64URL without padding."},"subject":{"$ref":"#/components/schemas/Subject"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."}}}}
```

## The DeterministicTokenEncodeBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenEncodeBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"type":"string","minLength":1,"maxLength":16384,"description":"Unicode scalar count, also bounded by the signed profile."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenEncodeBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenEncodeBatchInput":{"type":"object","additionalProperties":false,"required":["profile","items"],"properties":{"profile":{"type":"string","minLength":1,"maxLength":128},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/DeterministicTokenEncodeBatchItemInput"}}}},"DeterministicTokenEncodeBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"type":"string","minLength":1,"maxLength":16384,"description":"Unicode scalar count, also bounded by the signed profile."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenEncodeBatchItemOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenEncodeBatchItemOutput":{"type":"object","additionalProperties":false,"required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"type":"string","maxLength":131072,"pattern":"^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$","description":"Canonical context and complete AES-256-SIV output, Base64URL without padding."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenEncodeBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenEncodeBatchOutput":{"type":"object","additionalProperties":false,"required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"type":"string","minLength":1,"maxLength":128},"subject":{"$ref":"#/components/schemas/Subject"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/DeterministicTokenEncodeBatchItemOutput"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"DeterministicTokenEncodeBatchItemOutput":{"type":"object","additionalProperties":false,"required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"type":"string","maxLength":131072,"pattern":"^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$","description":"Canonical context and complete AES-256-SIV output, Base64URL without padding."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenDecodeInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenDecodeInput":{"type":"object","additionalProperties":false,"description":"Subject is required for stored profiles and prohibited for none profiles. Null is invalid.","required":["ref","kid","profile","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"type":"string","minLength":1,"maxLength":128},"token":{"type":"string","maxLength":131072,"pattern":"^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$","description":"Canonical context and complete AES-256-SIV output, Base64URL without padding."},"subject":{"$ref":"#/components/schemas/Subject"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."}}}}
```

## The DeterministicTokenDecodeOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenDecodeOutput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"type":"string","minLength":1,"maxLength":128},"plaintext":{"type":"string","minLength":1,"maxLength":16384,"description":"Unicode scalar count, also bounded by the signed profile."},"subject":{"$ref":"#/components/schemas/Subject"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."}}}}
```

## The DeterministicTokenDecodeBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenDecodeBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"type":"string","maxLength":131072,"pattern":"^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$","description":"Canonical context and complete AES-256-SIV output, Base64URL without padding."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenDecodeBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenDecodeBatchInput":{"type":"object","additionalProperties":false,"description":"One common subject for all items, required for stored profiles and prohibited for none profiles. Null is invalid.","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"type":"string","minLength":1,"maxLength":128},"subject":{"$ref":"#/components/schemas/Subject"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/DeterministicTokenDecodeBatchItemInput"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"DeterministicTokenDecodeBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"type":"string","maxLength":131072,"pattern":"^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$","description":"Canonical context and complete AES-256-SIV output, Base64URL without padding."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenDecodeBatchItemOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenDecodeBatchItemOutput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"type":"string","minLength":1,"maxLength":16384,"description":"Unicode scalar count, also bounded by the signed profile."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenDecodeBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenDecodeBatchOutput":{"type":"object","additionalProperties":false,"required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"type":"string","minLength":1,"maxLength":128},"subject":{"$ref":"#/components/schemas/Subject"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/DeterministicTokenDecodeBatchItemOutput"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"DeterministicTokenDecodeBatchItemOutput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"type":"string","minLength":1,"maxLength":16384,"description":"Unicode scalar count, also bounded by the signed profile."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The DeterministicTokenProfileConfig object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"DeterministicTokenProfileConfig":{"type":"object","additionalProperties":false,"required":["name","kid","context","min_plaintext_len","max_plaintext_len"],"description":"Signed profile; 1 <= min_plaintext_len <= max_plaintext_len <= 16384. Subject policy is mandatory per profile: default none prohibits subject; stored requires its existing seed, not token storage.","properties":{"name":{"type":"string","minLength":1,"maxLength":128},"kid":{"$ref":"#/components/schemas/Kid"},"context":{"type":"string","minLength":1,"maxLength":128,"description":"Validated ordered key=value labels; bound to HKDF and AAD."},"subject_mode":{"type":"string","enum":["none","stored"],"default":"none","description":"None is omitted when serialized; stored requires subject in route or decode body. Null is invalid. Policy only, not part of HKDF or AAD."},"min_plaintext_len":{"type":"integer","minimum":1,"maximum":16384},"max_plaintext_len":{"type":"integer","minimum":1,"maximum":16384}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}}}
```

## The TokenEncodeInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenEncodeInput":{"type":"object","additionalProperties":false,"required":["ref","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"profile":{"$ref":"#/components/schemas/TextField"},"plaintext":{"$ref":"#/components/schemas/TextField","maxLength":16384,"description":"Unicode character count must also fit the selected signed profile maximum."},"metadata":{"type":"object","description":"Optional JSON object. Its compact serialized JSON representation must be at most 128 characters. Object keys under the reserved $serde_json::private:: namespace are rejected at any nesting depth.","additionalProperties":true}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenEncodeOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenEncodeOutput":{"type":"object","required":["ref","kid","profile","token"],"properties":{"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored profiles and absent for legacy none profiles."},"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"token":{"$ref":"#/components/schemas/TextField","description":"Visible token in the form <token_prefix>_<base64url-no-pad random bytes>. The configured token_prefix is capped at 16 characters; the decoded random byte length equals the signed profile token_len."}}},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenEncodeBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenEncodeBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField","maxLength":16384,"description":"Unicode character count must also fit the selected signed profile maximum."},"metadata":{"type":"object","description":"Optional JSON object. Its compact serialized JSON representation must be at most 128 characters. Object keys under the reserved $serde_json::private:: namespace are rejected at any nesting depth.","additionalProperties":true}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenEncodeBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenEncodeBatchInput":{"type":"object","additionalProperties":false,"required":["profile","items"],"properties":{"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/TokenEncodeBatchItemInput"}}}},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"TokenEncodeBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField","maxLength":16384,"description":"Unicode character count must also fit the selected signed profile maximum."},"metadata":{"type":"object","description":"Optional JSON object. Its compact serialized JSON representation must be at most 128 characters. Object keys under the reserved $serde_json::private:: namespace are rejected at any nesting depth.","additionalProperties":true}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The TokenEncodeBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenEncodeBatchOutputItem":{"type":"object","required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"$ref":"#/components/schemas/TextField","description":"Visible token in the form <token_prefix>_<base64url-no-pad random bytes>. The configured token_prefix is capped at 16 characters; the decoded random byte length equals the signed profile token_len."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenEncodeBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenEncodeBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored profiles and absent for legacy none profiles."},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","items":{"$ref":"#/components/schemas/TokenEncodeBatchOutputItem"}}}},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"TokenEncodeBatchOutputItem":{"type":"object","required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"$ref":"#/components/schemas/TextField","description":"Visible token in the form <token_prefix>_<base64url-no-pad random bytes>. The configured token_prefix is capped at 16 characters; the decoded random byte length equals the signed profile token_len."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The TokenDecodeInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenDecodeInput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","token"],"properties":{"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored profiles and absent for legacy none profiles."},"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"token":{"$ref":"#/components/schemas/TextField","description":"Visible token in the form <token_prefix>_<base64url-no-pad random bytes>. Decode validates the configured prefix (capped at 16 characters) and decoded byte length before lookup."}}},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenDeleteInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenDeleteInput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","token"],"properties":{"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored profiles and absent for legacy none profiles."},"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"token":{"$ref":"#/components/schemas/TextField"}}},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenDeleteOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenDeleteOutput":{"type":"object","additionalProperties":false,"required":["ref","deleted"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"deleted":{"type":"boolean","const":true}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The TokenDecodeOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenDecodeOutput":{"type":"object","required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"},"metadata":{"type":"object","additionalProperties":true}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenDecodeBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenDecodeBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"$ref":"#/components/schemas/TextField","description":"Visible token in the form <token_prefix>_<base64url-no-pad random bytes>. Decode validates the configured prefix (capped at 16 characters) and decoded byte length before lookup."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenDecodeBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenDecodeBatchInput":{"type":"object","additionalProperties":false,"required":["kid","profile","items"],"properties":{"subject":{"$ref":"#/components/schemas/Subject","description":"Required for stored profiles and absent for legacy none profiles."},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/TokenDecodeBatchItemInput"}}}},"Subject":{"type":"string","minLength":64,"maxLength":64,"pattern":"^[0-9a-f]{64}$","description":"Profile-scoped HMAC identifier returned by subject creation. Not a user authorization credential."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"TokenDecodeBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","token"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"token":{"$ref":"#/components/schemas/TextField","description":"Visible token in the form <token_prefix>_<base64url-no-pad random bytes>. Decode validates the configured prefix (capped at 16 characters) and decoded byte length before lookup."}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The TokenDecodeBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenDecodeBatchOutputItem":{"type":"object","required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"},"metadata":{"type":"object","additionalProperties":true}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The TokenDecodeBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"TokenDecodeBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/TextField"},"items":{"type":"array","items":{"$ref":"#/components/schemas/TokenDecodeBatchOutputItem"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"TokenDecodeBatchOutputItem":{"type":"object","required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"},"metadata":{"type":"object","additionalProperties":true}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The MacCreateInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacCreateInput":{"type":"object","additionalProperties":false,"required":["ref","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The MacCreateOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacCreateOutput":{"type":"object","required":["ref","kid","profile","algorithm","digest"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"algorithm":{"type":"string","description":"HMAC(<ops-key-hash>) or KMAC-224/256/384/512 for SHA-3 keys."},"digest":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The MacVerifyInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacVerifyInput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","plaintext","digest"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"},"digest":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The MacVerifyOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacVerifyOutput":{"type":"object","required":["ref","valid"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"valid":{"type":"boolean"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The MacCreateBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacCreateBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The MacCreateBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacCreateBatchInput":{"type":"object","additionalProperties":false,"required":["profile","items"],"properties":{"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/MacCreateBatchItemInput"}}}},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"MacCreateBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The MacCreateBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacCreateBatchOutputItem":{"type":"object","required":["ref","digest"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"digest":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The MacCreateBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacCreateBatchOutput":{"type":"object","required":["kid","profile","algorithm","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"algorithm":{"type":"string","description":"HMAC(<ops-key-hash>) or KMAC-224/256/384/512 for SHA-3 keys."},"items":{"type":"array","items":{"$ref":"#/components/schemas/MacCreateBatchOutputItem"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"MacCreateBatchOutputItem":{"type":"object","required":["ref","digest"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"digest":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The MacVerifyBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacVerifyBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext","digest"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"},"digest":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The MacVerifyBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacVerifyBatchInput":{"type":"object","additionalProperties":false,"required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/MacVerifyBatchItemInput"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"MacVerifyBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext","digest"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"},"digest":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The MacVerifyBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacVerifyBatchOutputItem":{"type":"object","required":["ref","valid"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"valid":{"type":"boolean"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The MacVerifyBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MacVerifyBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","items":{"$ref":"#/components/schemas/MacVerifyBatchOutputItem"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"MacVerifyBatchOutputItem":{"type":"object","required":["ref","valid"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"valid":{"type":"boolean"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The CommitCreateInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitCreateInput":{"type":"object","additionalProperties":false,"required":["ref","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The CommitCreateOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitCreateOutput":{"type":"object","required":["ref","kid","profile","algorithm","commitment","opening"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"algorithm":{"type":"string","description":"HMAC(<ops-key-hash>) or KMAC-224/256/384/512 for SHA-3 keys."},"commitment":{"$ref":"#/components/schemas/HexString"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"}}}}
```

## The CommitVerifyInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitVerifyInput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","plaintext","opening","commitment"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"},"commitment":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The CommitVerifyOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitVerifyOutput":{"type":"object","required":["ref","kid","profile","valid"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"valid":{"type":"boolean"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."}}}}
```

## The ShareSplitInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ShareSplitInput":{"type":"object","additionalProperties":false,"required":["profile","plaintext"],"properties":{"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The ShareSplitOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ShareSplitOutput":{"type":"object","required":["kid","profile","threshold","set_id","shares"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"threshold":{"type":"integer","minimum":2},"set_id":{"$ref":"#/components/schemas/Base64UrlNoPad"},"shares":{"type":"array","minItems":2,"maxItems":32,"items":{"type":"string","pattern":"^vectis-sss-v1\\.[A-Za-z0-9_-]+$"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"}}}}
```

## The ShareCombineInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ShareCombineInput":{"type":"object","additionalProperties":false,"required":["kid","profile","shares"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"shares":{"type":"array","minItems":2,"maxItems":32,"items":{"type":"string","pattern":"^vectis-sss-v1\\.[A-Za-z0-9_-]+$"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."}}}}
```

## The ShareCombineOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"ShareCombineOutput":{"type":"object","required":["kid","profile","set_id","plaintext"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"set_id":{"$ref":"#/components/schemas/Base64UrlNoPad"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The CommitCreateBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitCreateBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The CommitCreateBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitCreateBatchInput":{"type":"object","additionalProperties":false,"required":["profile","items"],"properties":{"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/CommitCreateBatchItemInput"}}}},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"CommitCreateBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The CommitCreateBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitCreateBatchOutputItem":{"type":"object","required":["ref","commitment","opening"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"commitment":{"$ref":"#/components/schemas/HexString"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"}}}}
```

## The CommitCreateBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitCreateBatchOutput":{"type":"object","required":["kid","profile","algorithm","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"algorithm":{"type":"string","description":"HMAC(<ops-key-hash>) or KMAC-224/256/384/512 for SHA-3 keys."},"items":{"type":"array","items":{"$ref":"#/components/schemas/CommitCreateBatchOutputItem"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"CommitCreateBatchOutputItem":{"type":"object","required":["ref","commitment","opening"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"commitment":{"$ref":"#/components/schemas/HexString"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"}}}}
```

## The CommitVerifyBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitVerifyBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext","opening","commitment"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"},"commitment":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The CommitVerifyBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitVerifyBatchInput":{"type":"object","additionalProperties":false,"required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/CommitVerifyBatchItemInput"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"CommitVerifyBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext","opening","commitment"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"},"opening":{"$ref":"#/components/schemas/Base64UrlNoPad"},"commitment":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"},"Base64UrlNoPad":{"type":"string","pattern":"^[A-Za-z0-9_-]+$"},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The CommitVerifyBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitVerifyBatchOutputItem":{"type":"object","required":["ref","valid"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"valid":{"type":"boolean"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The CommitVerifyBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CommitVerifyBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","items":{"$ref":"#/components/schemas/CommitVerifyBatchOutputItem"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"CommitVerifyBatchOutputItem":{"type":"object","required":["ref","valid"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"valid":{"type":"boolean"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."}}}}
```

## The MaskInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MaskInput":{"type":"object","additionalProperties":false,"required":["ref","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The MaskOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MaskOutput":{"type":"object","required":["ref","kid","profile","masked"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"masked":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The MaskBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MaskBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The MaskBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MaskBatchInput":{"type":"object","additionalProperties":false,"required":["profile","items"],"properties":{"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/MaskBatchItemInput"}}}},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"MaskBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The MaskBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MaskBatchOutputItem":{"type":"object","required":["ref","masked"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"masked":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The MaskBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MaskBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","items":{"$ref":"#/components/schemas/MaskBatchOutputItem"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"MaskBatchOutputItem":{"type":"object","required":["ref","masked"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"masked":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The IndexCreateInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexCreateInput":{"type":"object","additionalProperties":false,"required":["ref","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The IndexCreateOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexCreateOutput":{"type":"object","required":["ref","kid","profile","index"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"index":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The IndexVerifyInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexVerifyInput":{"type":"object","additionalProperties":false,"required":["ref","kid","profile","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The IndexVerifyOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexVerifyOutput":{"type":"object","required":["ref","kid","profile","matched","index"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"matched":{"type":"boolean"},"index":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The IndexBatchItemInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The IndexBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexBatchInput":{"type":"object","additionalProperties":false,"required":["profile","items"],"properties":{"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/IndexBatchItemInput"}}}},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"IndexBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The IndexVerifyBatchInput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexVerifyBatchInput":{"type":"object","additionalProperties":false,"required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","minItems":1,"maxItems":128,"items":{"$ref":"#/components/schemas/IndexBatchItemInput"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"IndexBatchItemInput":{"type":"object","additionalProperties":false,"required":["ref","plaintext"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"plaintext":{"$ref":"#/components/schemas/TextField"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The IndexCreateBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexCreateBatchOutputItem":{"type":"object","required":["ref","index"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"index":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The IndexCreateBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexCreateBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","items":{"$ref":"#/components/schemas/IndexCreateBatchOutputItem"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"IndexCreateBatchOutputItem":{"type":"object","required":["ref","index"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"index":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The IndexVerifyBatchOutputItem object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexVerifyBatchOutputItem":{"type":"object","required":["ref","matched","index"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"matched":{"type":"boolean"},"index":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The IndexVerifyBatchOutput object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"IndexVerifyBatchOutput":{"type":"object","required":["kid","profile","items"],"properties":{"kid":{"$ref":"#/components/schemas/Kid"},"profile":{"$ref":"#/components/schemas/AadSafeText"},"items":{"type":"array","items":{"$ref":"#/components/schemas/IndexVerifyBatchOutputItem"}}}},"Kid":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"},"AadSafeText":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F;=]+$","description":"Text safe to embed in a key=value;... AAD string (no ';' or '=')."},"IndexVerifyBatchOutputItem":{"type":"object","required":["ref","matched","index"],"properties":{"ref":{"$ref":"#/components/schemas/ClientRef"},"matched":{"type":"boolean"},"index":{"$ref":"#/components/schemas/HexString"}}},"ClientRef":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$","description":"Client-defined correlation reference. Echoed in FPE, tokenization, MAC, commitment, blind-index, and masking responses; not used for cryptographic derivation, storage lookup, audit, or metrics."},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"}}}}
```

## The MessageCipher object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MessageCipher":{"type":"object","required":["alg","nonce","aad","ct"],"properties":{"alg":{"$ref":"#/components/schemas/SymmetricAlgorithm"},"nonce":{"$ref":"#/components/schemas/HexString"},"aad":{"$ref":"#/components/schemas/TextField"},"ct":{"$ref":"#/components/schemas/HexString"}}},"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]},"HexString":{"type":"string","pattern":"^[0-9a-fA-F]+$"},"TextField":{"type":"string","minLength":1,"pattern":"^[^\\x00-\\x1F\\x7F-\\x9F]+$"}}}}
```

## The CryptoProfile object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"CryptoProfile":{"enum":["hybrid-performance-v1","hybrid-standard-v1","hybrid-high-assurance-v1","hybrid-long-term-v1"]}}}}
```

## The HashAlgorithm object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"HashAlgorithm":{"enum":["BLAKE2b(160)","BLAKE2b(224)","BLAKE2b(256)","BLAKE2b(384)","BLAKE2b(512)","SHA-224","SHA-256","SHA-384","SHA-512","SHA-512-256","SHA-3(224)","SHA-3(256)","SHA-3(384)","SHA-3(512)","Whirlpool"]}}}}
```

## The SymmetricAlgorithm object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"SymmetricAlgorithm":{"enum":["ChaCha20Poly1305","AES-128/GCM","AES-192/GCM","AES-256/GCM"]}}}}
```

## The EdDsaAlgorithm object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"EdDsaAlgorithm":{"enum":["Ed25519","Ed448"]}}}}
```

## The XecdhAlgorithm object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"XecdhAlgorithm":{"enum":["X25519","X448"]}}}}
```

## The MlDsaVariant object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MlDsaVariant":{"enum":["ML-DSA-44","ML-DSA-65","ML-DSA-87"]}}}}
```

## The MlKemVariant object

```json
{"openapi":"3.1.0","info":{"title":"Vectis HTTP API","version":"v1"},"components":{"schemas":{"MlKemVariant":{"enum":["ML-KEM-512","ML-KEM-768","ML-KEM-1024"]}}}}
```