@indorania/contracts 0.1.0 → 0.1.1-alpha.0

package/openapi/2026-09-25.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "Indorania platform API",
     "version": "2026-09-25",
-    "description": "The platform contract that every member, and any outside issuer, builds against (ECOSYSTEM decision 47). A member integrates exactly as a stranger would.\n\n**Versions.** The URL carries the major version (`/v1`). Every request speaks a dated version: send `Indorania-Version: YYYY-MM-DD`, or your organisation's or integration's pinned version applies; with neither, the request is refused. Inside a released version, changes are additive only — new operations, new optional fields, new enum values, new problem codes — so treat anything unknown gracefully. Any other change is a new dated version, and the platform translates between the two. A version is a **preview** until its first release, and may still change in place.\n\n**Exempt from dated versions:** the OpenID4VCI and OpenID4VP endpoints, which their standards version, and documents that describe themselves: the trust list, the webhook keys, the version list, and these documents.\n\n**Errors** are RFC 9457 problem details (`application/problem+json`), each with a stable `code`.\n\n**Idempotency.** Every change made through this API carries an `Idempotency-Key` (IETF draft-07). Without one it is refused (400). The same key and body get the first answer again for 24 hours; the same key with another body is refused (422); a key still running is refused (409). Protocol endpoints rely on their own single-use code or nonce, and webhooks on `webhook-id`.\n\n**Webhooks,** in both directions: Standard Webhooks 1.0.0, v1a (Ed25519), with a 300-second tolerance.\n\n**What it never does.** No endpoint lists a house's members, answers \"everything matching X\", records a decline, meters records, scores a person, or joins a person across relationships: person-side identifiers are relationship identifiers, one at a time. Lints check this document for all of it.\n\n**Status.** Every operation marked `x-indorania-pending` is wired but not built, and answers 501 `not_built`. No host serves this API yet, and nothing it serves reaches real society before ECOSYSTEM decision 30's gate.",
+    "description": "The platform contract that every member, and any outside issuer, builds against (ECOSYSTEM decision 47). A member integrates exactly as a stranger would.\n\n**Versions.** The URL carries the major version (`/v1`). Every request speaks a dated version: send `Indorania-Version: YYYY-MM-DD`, or your organisation's or integration's pinned version applies; with neither, the request is refused. Inside a released version, changes are additive only — new operations, new optional fields, new enum values, new problem codes — so treat anything unknown gracefully. Any other change is a new dated version, and the platform translates between the two. A version is a **preview** until its first release, and may still change in place.\n\n**Exempt from dated versions:** the OpenID4VCI and OpenID4VP endpoints, which their standards version, and documents that describe themselves: the trust list, the webhook keys, issuers' status lists, the version list, and these documents.\n\n**Errors** are RFC 9457 problem details (`application/problem+json`), each with a stable `code`.\n\n**Idempotency.** Every change made through this API carries an `Idempotency-Key` (IETF draft-07). Without one it is refused (400). The same key and body get the first answer again for 24 hours; the same key with another body is refused (422); a key still running is refused (409). Protocol endpoints rely on their own single-use code or nonce, and webhooks on `webhook-id`.\n\n**Webhooks,** in both directions: Standard Webhooks 1.0.0, v1a (Ed25519), with a 300-second tolerance.\n\n**What it never does.** No endpoint lists a house's members, answers \"everything matching X\", records a decline, meters records, scores a person, or joins a person across relationships: person-side identifiers are relationship identifiers, one at a time. Lints check this document for all of it.\n\n**Status.** Every operation marked `x-indorania-pending` is wired but not built, and answers 501 `not_built`. No host serves this API yet, and nothing it serves reaches real society before ECOSYSTEM decision 30's gate.",
     "license": {
       "name": "Apache-2.0",
       "identifier": "Apache-2.0"
@@ -119,6 +119,11 @@
               "answer": {
                 "$ref": "#/components/schemas/AnswerId"
               },
+              "need": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Which need of the ask this answers, by its id. Needed when you deliver later and the ask has more than one."
+              },
               "result": {
                 "type": "string",
                 "enum": [
@@ -144,6 +149,11 @@
               "answer": {
                 "$ref": "#/components/schemas/AnswerId"
               },
+              "need": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Which need of the ask this answers, by its id. Needed when you deliver later and the ask has more than one."
+              },
               "result": {
                 "type": "string",
                 "enum": [
@@ -775,6 +785,12 @@
         ],
         "additionalProperties": false
       },
+      "IndoraniaOrganisation": {
+        "type": "string",
+        "pattern": "^org_[0123456789abcdefghjkmnpqrstvwxyz]{26}$",
+        "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+        "example": "org_0f5m2c8r1h7k3n9p4q6s2t8v1w"
+      },
       "OrganisationCreate": {
         "oneOf": [
           {
@@ -1853,6 +1869,175 @@
         "additionalProperties": false,
         "description": "`capability` names which of your books answers: the platform routes the ask to the integration running it."
       },
+      "AskAnswerState": {
+        "type": "object",
+        "properties": {
+          "answer": {
+            "$ref": "#/components/schemas/AnswerId"
+          },
+          "ask": {
+            "type": "object",
+            "properties": {
+              "key": {
+                "$ref": "#/components/schemas/AskKey"
+              },
+              "version": {
+                "type": "integer",
+                "minimum": 1
+              }
+            },
+            "required": [
+              "key",
+              "version"
+            ],
+            "additionalProperties": false
+          },
+          "needs": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "need": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "state": {
+                  "type": "string",
+                  "enum": [
+                    "waiting",
+                    "holds"
+                  ]
+                },
+                "predicate": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "When it holds: the predicate credential the book signed, naming its rule version (d43). Hand it to the verifier; it verifies offline."
+                }
+              },
+              "required": [
+                "need",
+                "state"
+              ],
+              "additionalProperties": false
+            },
+            "description": "Each need routed, while it waits or holds. A need the book does not hold is removed, never kept: it simply stops being listed."
+          },
+          "expiresAtUnix": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "Unix seconds, UTC."
+          }
+        },
+        "required": [
+          "answer",
+          "ask",
+          "needs",
+          "expiresAtUnix"
+        ],
+        "additionalProperties": false,
+        "description": "One answer, by its id. The answering organisation sees every need still waiting or holding; the organisation that published the ask sees only the needs that hold — a yes, and nothing else."
+      },
+      "ExcessiveAskReportKept": {
+        "type": "object",
+        "properties": {
+          "keptUntilUnix": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "Unix seconds, UTC."
+          }
+        },
+        "required": [
+          "keptUntilUnix"
+        ],
+        "additionalProperties": false
+      },
+      "ExcessiveAskReport": {
+        "type": "object",
+        "properties": {
+          "reason": {
+            "$ref": "#/components/schemas/ExcessiveReason"
+          },
+          "keepUntilUnix": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "Chosen by the holder who refused: the report is deleted then (at most 366 days ahead, rounded down to the day)."
+          }
+        },
+        "required": [
+          "reason",
+          "keepUntilUnix"
+        ],
+        "additionalProperties": false,
+        "description": "Rule 7: an excessive ask is recordable by the holder who refused it — and only if they choose to. It carries no identifier, no key and no request: nothing links it to a person, an encounter or a decline."
+      },
+      "ExcessiveReason": {
+        "type": "string",
+        "enum": [
+          "more-than-needed",
+          "R1-predicates-only",
+          "R2-says-why",
+          "R3-no-is-answerable",
+          "R4-expires",
+          "R6-no-joining",
+          "R8-no-improvement-item",
+          "FORBIDDEN-NEED"
+        ]
+      },
+      "ExcessiveAskReports": {
+        "type": "object",
+        "properties": {
+          "ask": {
+            "type": "object",
+            "properties": {
+              "key": {
+                "$ref": "#/components/schemas/AskKey"
+              },
+              "version": {
+                "type": "integer",
+                "minimum": 1
+              }
+            },
+            "required": [
+              "key",
+              "version"
+            ],
+            "additionalProperties": false
+          },
+          "shownFrom": {
+            "type": "number",
+            "enum": [
+              5
+            ]
+          },
+          "reasons": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "reason": {
+                  "$ref": "#/components/schemas/ExcessiveReason"
+                },
+                "reports": {
+                  "type": "integer",
+                  "minimum": 5
+                }
+              },
+              "required": [
+                "reason",
+                "reports"
+              ],
+              "additionalProperties": false
+            }
+          }
+        },
+        "required": [
+          "ask",
+          "shownFrom",
+          "reasons"
+        ],
+        "additionalProperties": false,
+        "description": "Reports holders chose to file against one version of an ask, as totals per reason — shown only where five or more agree, so no report can be traced to anyone."
+      },
       "PresentationRequest": {
         "type": "object",
         "properties": {
@@ -1943,6 +2128,23 @@
         "properties": {
           "purpose": {
             "$ref": "#/components/schemas/PresentationPurpose"
+          },
+          "role": {
+            "type": "string",
+            "enum": [
+              "venue",
+              "payer",
+              "employer",
+              "client",
+              "third-party"
+            ],
+            "description": "For an ask: what you are to the person answering, shown to them. A thank-you for answering reads it; left out, none can follow."
+          },
+          "expiresInSec": {
+            "type": "integer",
+            "minimum": 60,
+            "maximum": 86400,
+            "description": "How long the request stands. Unanswered, it then simply expires and is gone."
           }
         },
         "required": [
@@ -2037,6 +2239,15 @@
                 },
                 "issuer": {
                   "type": "string"
+                },
+                "status": {
+                  "type": "string",
+                  "enum": [
+                    "not-revoked",
+                    "revoked",
+                    "unknown"
+                  ],
+                  "description": "From the issuer's status list, as of `statusAsOfUnix`. `unknown` when the list could not be read; a revoked predicate is not a yes."
                 }
               },
               "required": [
@@ -2207,7 +2418,7 @@
           "credential": {
             "type": "string",
             "minLength": 1,
-            "description": "A holder-bound SD-JWT VC. Its type is registered when PL-8 builds it."
+            "description": "A holder-bound SD-JWT VC of the registered predicate type (https://kashscript.com/vct/predicate/1): the standing item as a yes, naming the rule (`standing:…`), its version and hash, and its window. It verifies offline."
           },
           "expiresAtUnix": {
             "type": "integer",
@@ -2322,6 +2533,21 @@
             "minimum": 0,
             "description": "Unix seconds, UTC."
           },
+          "role": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "enum": [
+              "venue",
+              "payer",
+              "employer",
+              "client",
+              "third-party",
+              null
+            ],
+            "description": "What the establishment said it is to the person. Null when it said nothing."
+          },
           "joinUri": {
             "type": "string",
             "format": "uri",
@@ -2415,7 +2641,15 @@
             "type": "integer",
             "minimum": 60,
             "maximum": 86400,
-            "description": "How long the invitation stands; minutes suit a counter."
+            "description": "How long the invitation stands; minutes suit a counter. After the person agrees, it is also how long the platform holds the session after its last line before it forgets it."
+          },
+          "signer": {
+            "type": "string",
+            "pattern": "^did:[a-z0-9]+:[A-Za-z0-9._%:-]+$",
+            "description": "The key that signs your side of every line — one your own system holds, registered as a signer by one of your integrations. The platform never signs a line. Needed when your integrations register more than one signer."
+          },
+          "role": {
+            "$ref": "#/components/schemas/EncounterRole"
           }
         },
         "required": [
@@ -2424,6 +2658,17 @@
         ],
         "additionalProperties": false
       },
+      "EncounterRole": {
+        "type": "string",
+        "enum": [
+          "venue",
+          "payer",
+          "employer",
+          "client",
+          "third-party"
+        ],
+        "description": "What you are to the person: a venue they visit, a payer who pays them, an employer or a client they work for, or a third party running asks. Stated once, shown to them before they agree. Left out, no thank-you can follow (it fails closed)."
+      },
       "SessionTerms": {
         "type": "object",
         "properties": {
@@ -2493,6 +2738,21 @@
             "type": "integer",
             "minimum": 0,
             "description": "Unix seconds, UTC."
+          },
+          "role": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "enum": [
+              "venue",
+              "payer",
+              "employer",
+              "client",
+              "third-party",
+              null
+            ],
+            "description": "What the establishment said it is to the person. Null when it said nothing."
           }
         },
         "required": [
@@ -2890,6 +3150,32 @@
         ],
         "description": "The answering, never the answer (d49 rule 1): confirming and disputing earn the same. The platform finds the person from the session or the request; you never name them."
       },
+      "ThankYouWithdrawn": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "$ref": "#/components/schemas/ThankYouId"
+          },
+          "state": {
+            "type": "string",
+            "enum": [
+              "withdrawn"
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "state"
+        ],
+        "additionalProperties": false,
+        "description": "Its bit is set in your status list: it reads used or withdrawn, and cannot be redeemed. The person's copy still verifies as signed."
+      },
+      "StatusListId": {
+        "type": "string",
+        "pattern": "^sl_[0123456789abcdefghjkmnpqrstvwxyz]{26}$",
+        "description": "One issuer's status list: one bit per record it issued, most of them unused, so no index stands out.",
+        "example": "sl_0f5m2c8r1h7k3n9p4q6s2t8v1w"
+      },
       "Integration": {
         "type": "object",
         "properties": {
@@ -3558,6 +3844,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -4237,6 +4532,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -4309,6 +4613,15 @@
             "description": "The dated API version this request speaks (YYYY-MM-DD). Without it, the caller's pinned version applies; with no pin, the request is refused.",
             "name": "indorania-version",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "responses": {
@@ -4616,7 +4929,6 @@
             "seat": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -4637,6 +4949,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -4680,7 +5001,6 @@
         "summary": "The public ask library",
         "description": "Public, so what establishments ask of people is as auditable as the records themselves (d42 §5, rule 5).",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-collection": "The ask library is public by design (d42 §5 rule 5). Asks are demands made of people, never people or records.",
         "parameters": [
@@ -4762,7 +5082,6 @@
         ],
         "summary": "An ask's latest version",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "parameters": [
           {
@@ -4816,7 +5135,6 @@
         ],
         "summary": "One version of an ask",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "parameters": [
           {
@@ -4884,7 +5202,6 @@
             "seat": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -4923,6 +5240,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -4959,14 +5285,14 @@
         }
       }
     },
-    "/v1/presentation-requests": {
-      "post": {
-        "operationId": "createPresentationRequest",
+    "/v1/asks/{key}/versions/{version}/answers/{answer}": {
+      "get": {
+        "operationId": "getAskAnswer",
         "tags": [
-          "presentations"
+          "asks"
         ],
-        "summary": "Mint a presentation request for one encounter",
-        "description": "Show its requestUri as a QR code, or send it as a link. One request per encounter; it is used once.",
+        "summary": "One answer to an ask, by its id",
+        "description": "For the organisation that answered, and for the one that asked. The answering organisation hands the id to the verifier — a presentation, never a lookup: there is no list of answers.",
         "security": [
           {
             "seat": []
@@ -4975,10 +5301,35 @@
             "integration": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
-        "x-indorania-idempotency": "key",
         "parameters": [
+          {
+            "schema": {
+              "$ref": "#/components/schemas/AskKey"
+            },
+            "required": true,
+            "description": "Rule 7: a stable key a holder's excessive-ask note can name.",
+            "name": "key",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "required": true,
+            "name": "version",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/AnswerId"
+            },
+            "required": true,
+            "description": "One organisation's answer to an ask, routed to the book that answers it.",
+            "name": "answer",
+            "in": "path"
+          },
           {
             "schema": {
               "$ref": "#/components/schemas/IndoraniaVersion"
@@ -4990,12 +5341,217 @@
           },
           {
             "schema": {
-              "$ref": "#/components/schemas/IdempotencyKey"
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
             },
-            "required": true,
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The answer.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AskAnswerState"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "A problem (RFC 9457). Every error of this API has this shape.",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/asks/{key}/versions/{version}/excessive-reports": {
+      "post": {
+        "operationId": "reportExcessiveAsk",
+        "tags": [
+          "asks"
+        ],
+        "summary": "Record an ask as excessive (rule 7)",
+        "description": "Anonymous, and only if the holder who refused chooses to. No account, no key, no request id: a stored Idempotency-Key would itself be a trace, so a repeat is a second report.",
+        "security": [],
+        "x-indorania-versioning": "dated",
+        "x-indorania-idempotency": "protocol",
+        "parameters": [
+          {
+            "schema": {
+              "$ref": "#/components/schemas/AskKey"
+            },
+            "required": true,
+            "description": "Rule 7: a stable key a holder's excessive-ask note can name.",
+            "name": "key",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "required": true,
+            "name": "version",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaVersion"
+            },
+            "required": false,
+            "description": "The dated API version this request speaks (YYYY-MM-DD). Without it, the caller's pinned version applies; with no pin, the request is refused.",
+            "name": "indorania-version",
+            "in": "header"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ExcessiveAskReport"
+              }
+            }
+          }
+        },
+        "responses": {
+          "202": {
+            "description": "Kept until the date the holder chose.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ExcessiveAskReportKept"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "A problem (RFC 9457). Every error of this API has this shape.",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            }
+          }
+        }
+      },
+      "get": {
+        "operationId": "getAskReports",
+        "tags": [
+          "asks"
+        ],
+        "summary": "What holders recorded against an ask, as totals of five or more",
+        "security": [],
+        "x-indorania-versioning": "dated",
+        "parameters": [
+          {
+            "schema": {
+              "$ref": "#/components/schemas/AskKey"
+            },
+            "required": true,
+            "description": "Rule 7: a stable key a holder's excessive-ask note can name.",
+            "name": "key",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "required": true,
+            "name": "version",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaVersion"
+            },
+            "required": false,
+            "description": "The dated API version this request speaks (YYYY-MM-DD). Without it, the caller's pinned version applies; with no pin, the request is refused.",
+            "name": "indorania-version",
+            "in": "header"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The totals.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ExcessiveAskReports"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "A problem (RFC 9457). Every error of this API has this shape.",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/presentation-requests": {
+      "post": {
+        "operationId": "createPresentationRequest",
+        "tags": [
+          "presentations"
+        ],
+        "summary": "Mint a presentation request for one encounter",
+        "description": "Show its requestUri as a QR code, or send it as a link. One request per encounter; it is used once.",
+        "security": [
+          {
+            "seat": []
+          },
+          {
+            "integration": []
+          }
+        ],
+        "x-indorania-versioning": "dated",
+        "x-indorania-idempotency": "key",
+        "parameters": [
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaVersion"
+            },
+            "required": false,
+            "description": "The dated API version this request speaks (YYYY-MM-DD). Without it, the caller's pinned version applies; with no pin, the request is refused.",
+            "name": "indorania-version",
+            "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IdempotencyKey"
+            },
+            "required": true,
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -5047,7 +5603,6 @@
             "integration": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "parameters": [
           {
@@ -5067,6 +5622,15 @@
             "description": "The dated API version this request speaks (YYYY-MM-DD). Without it, the caller's pinned version applies; with no pin, the request is refused.",
             "name": "indorania-version",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "responses": {
@@ -5102,7 +5666,6 @@
         "summary": "The wallet's answer (OpenID4VP direct_post)",
         "description": "A standard endpoint: any conforming wallet can answer, with no account and no Indorania header, so it is exempt from dated versions. Holder binding is the KB-JWT in each presentation; the request's nonce makes it single-use.",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "exempt",
         "x-indorania-idempotency": "protocol",
         "parameters": [
@@ -5158,7 +5721,6 @@
         ],
         "summary": "The published standing rules",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-collection": "The standing rules are published, so anyone can re-implement or check them (d47(d)).",
         "parameters": [
@@ -5226,13 +5788,12 @@
           "standing"
         ],
         "summary": "Derive standing from presented predicates",
-        "description": "Answered at once, and forgotten: no request is stored, so none can be listed or looked up.",
+        "description": "Answered at once, and forgotten: no request is stored, so none can be listed or looked up — not even its answer under the Idempotency-Key, so a retry derives standing afresh.",
         "security": [
           {
             "relationshipProof": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -5304,7 +5865,6 @@
             "integration": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -5325,6 +5885,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -5370,7 +5939,6 @@
         "summary": "What the person is asked to agree to",
         "description": "Needs only the join secret. Reading it records nothing.",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "parameters": [
           {
@@ -5440,7 +6008,6 @@
             "relationshipProof": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -5536,7 +6103,6 @@
             "relationshipProof": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -5566,6 +6132,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -5618,7 +6193,6 @@
             "relationshipProof": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-collection": "The lines of one session, for its two parties only: one relationship, never a search.",
         "parameters": [
@@ -5663,6 +6237,15 @@
             "description": "The dated API version this request speaks (YYYY-MM-DD). Without it, the caller's pinned version applies; with no pin, the request is refused.",
             "name": "indorania-version",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "responses": {
@@ -5707,7 +6290,6 @@
             "relationshipProof": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -5749,6 +6331,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -5804,7 +6395,6 @@
             "relationshipProof": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -5834,6 +6424,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -5888,7 +6487,6 @@
             "relationshipProof": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -5918,6 +6516,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -5972,7 +6579,6 @@
             "relationshipProof": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "parameters": [
           {
@@ -5992,6 +6598,15 @@
             "description": "The dated API version this request speaks (YYYY-MM-DD). Without it, the caller's pinned version applies; with no pin, the request is refused.",
             "name": "indorania-version",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "responses": {
@@ -6033,7 +6648,6 @@
             "integration": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -6054,6 +6668,15 @@
             "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
             "name": "idempotency-key",
             "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
           }
         ],
         "requestBody": {
@@ -6098,7 +6721,6 @@
         ],
         "summary": "Credential Issuer Metadata (OpenID4VCI 1.0 §12.2)",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "exempt",
         "responses": {
           "200": {
@@ -6133,7 +6755,6 @@
         ],
         "summary": "Authorization Server Metadata (RFC 8414), for the pre-authorized code flow",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "exempt",
         "responses": {
           "200": {
@@ -6169,7 +6790,6 @@
         "summary": "Redeem a pre-authorized code (OpenID4VCI 1.0 §6)",
         "description": "Anonymous: no wallet client_id is ever sent (holder contract §1). The code is single-use.",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "exempt",
         "x-indorania-idempotency": "protocol",
         "requestBody": {
@@ -6235,7 +6855,6 @@
         ],
         "summary": "A fresh nonce for the key proof (OpenID4VCI 1.0 §7)",
         "security": [],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "exempt",
         "x-indorania-idempotency": "protocol",
         "responses": {
@@ -6284,7 +6903,6 @@
             "issuanceToken": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "exempt",
         "x-indorania-idempotency": "protocol",
         "requestBody": {
@@ -6370,6 +6988,131 @@
         }
       }
     },
+    "/v1/thank-yous/{id}/withdraw": {
+      "post": {
+        "operationId": "withdrawThankYou",
+        "tags": [
+          "thank-yous"
+        ],
+        "summary": "Withdraw a thank-you you gave",
+        "description": "A status change at you, the issuer: nothing is deleted from the person's wallet.",
+        "security": [
+          {
+            "seat": []
+          },
+          {
+            "integration": []
+          }
+        ],
+        "x-indorania-versioning": "dated",
+        "x-indorania-idempotency": "key",
+        "parameters": [
+          {
+            "schema": {
+              "$ref": "#/components/schemas/ThankYouId"
+            },
+            "required": true,
+            "description": "One thank-you, as its issuer knows it: an offer and a status index, never the person.",
+            "name": "id",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaVersion"
+            },
+            "required": false,
+            "description": "The dated API version this request speaks (YYYY-MM-DD). Without it, the caller's pinned version applies; with no pin, the request is refused.",
+            "name": "indorania-version",
+            "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IdempotencyKey"
+            },
+            "required": true,
+            "description": "A fresh random value (a UUID) per change. Kept 24 hours: a retry with the same key and body gets the first answer; the same key with another body is refused (422); a key still running is refused (409).",
+            "name": "idempotency-key",
+            "in": "header"
+          },
+          {
+            "schema": {
+              "$ref": "#/components/schemas/IndoraniaOrganisation"
+            },
+            "required": false,
+            "description": "Which of your organisations this request acts for. Needed only when your login holds seats in more than one; an integration always acts for its own.",
+            "name": "indorania-organisation",
+            "in": "header"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Withdrawn.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ThankYouWithdrawn"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "A problem (RFC 9457). Every error of this API has this shape.",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/status-lists/{listId}": {
+      "get": {
+        "operationId": "getStatusList",
+        "tags": [
+          "thank-yous"
+        ],
+        "summary": "An issuer's signed status list",
+        "description": "Public, and the same for everyone who asks, so fetching it says nothing about which record is checked. A kashscript-status-list/1 DSSE envelope signed by the issuer (W3C Bitstring Status List), at least 131,072 entries. Its address lives inside credentials, so it is exempt from dated versions.",
+        "security": [],
+        "x-indorania-versioning": "exempt",
+        "parameters": [
+          {
+            "schema": {
+              "$ref": "#/components/schemas/StatusListId"
+            },
+            "required": true,
+            "description": "One issuer's status list: one bit per record it issued, most of them unused, so no index stands out.",
+            "name": "listId",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The signed list.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DsseEnvelope"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "A problem (RFC 9457). Every error of this API has this shape.",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/v1/organisations/{orgId}/integrations": {
       "post": {
         "operationId": "createIntegration",
@@ -6576,7 +7319,6 @@
             "integration": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -6645,7 +7387,6 @@
             "integration": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "key",
         "parameters": [
@@ -6714,7 +7455,6 @@
             "webhookSignature": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "webhook-id",
         "parameters": [
@@ -6797,7 +7537,6 @@
             "webhookSignature": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "webhook-id",
         "parameters": [
@@ -6887,7 +7626,6 @@
             "webhookSignature": []
           }
         ],
-        "x-indorania-pending": "PL-8",
         "x-indorania-versioning": "dated",
         "x-indorania-idempotency": "webhook-id",
         "parameters": [