@tdxvolt/volt-client-grpc 0.1.0

package/protobuf/tdx/volt_api/volt/v1/volt_api.proto

@@ -0,0 +1,943 @@
+syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/remote.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
+
+// The top-level volt management service. 
+// With the exception of `Bind`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
+// A client certificate can be obtained from the `Bind` method.
+// All methods include a `tdx.volt_api.volt.v1.Status` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
+service VoltAPI {
+  // Issues a request to bind to the volt.
+  // All clients must successfully bind to the Volt in order to gain any kind of access.
+  // A client certificate is optional for this RPC, in which case a JWT must be provided in the call metadata.
+  // If the client plans to register one or more services with the Volt, it should use the 'host' field of the request so that the returned certificate has the appropriate SAN extension in place. Note that if the client IP address changes it will be necessary to re-Bind the client and obtain a new certificate.
+  // If the bind decision is 'permit', the bind response contains various details that should be persisted by the client, including the unique identifier assigned by the Volt and a signed client certificate along with the Volt CA certificate.
+  rpc Bind(BindRequest) returns (BindResponse);
+
+  // Determine if an identity can perform a specific action on a resource.
+  // Third party services can use this to interrogate the Volt policy and determine if a client has permission to perform a certain action on a resource.
+  rpc CanAccessResource(CanAccessResourceRequest) returns (CanAccessResourceResponse);
+
+  // Creates a long-lived, bi-directional connection (session) to the Volt.
+  // The connection stream serves several purposes, including remote invocations via a tunnel, Volt event notifications, pings and service registration management.
+  // A connection session is required in order for a client to be able to register services with the Volt.
+  // When the stream is closed, any services registered on it will be set to offline.
+  rpc Connect(stream ConnectRequest) returns (stream ConnectResponse);
+
+  // This is a work in progress - do not use.
+  rpc CreateVerifiableCredentialSession(CreateVerifiableCredentialSessionRequest) returns (CreateVerifiableCredentialSessionResponse);
+
+  // Remove a custom access rule, such as a file share.
+  rpc DeleteAccess(DeleteAccessRequest) returns (DeleteAccessResponse);
+
+  // Delete a resource from this volt.
+  rpc DeleteResource(DeleteResourceRequest) returns (DeleteResourceResponse);
+
+  // Discover services running on this volt.
+  // Lookup is done via the exposed serviceAPI, e.g. tdx.volt_api.data.v1.SqliteServerAPI.
+  rpc DiscoverServices(DiscoverServicesRequest) returns (DiscoverServicesResponse);
+
+  // Get access rule details.
+  // Only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
+  // If the authenticated identity is the Volt root, all rules will be retrieved that match the criteria.
+  rpc GetAccess(GetAccessRequest) returns (GetAccessResponse);
+
+  // Get the bindings for this volt.
+  // This is a privileged API call and requires Volt root access.
+  rpc GetBindings(GetBindingsRequest) returns (GetBindingsResponse);
+
+  // Retrieve identities matching the given criteria.
+  // Only identities that the authenticated identity has read access to will be retrieved.
+  rpc GetIdentities(GetIdentitiesRequest) returns (GetIdentitiesResponse);
+
+  // Get details of a specific identity.
+  // The identity will only be retrieved if the authenticated identity has read access to it.
+  rpc GetIdentity(GetIdentityRequest) returns (GetIdentityResponse);
+
+  // NOT YET IMPLEMENTED.
+  // Gets a credential for the currently authenticated client, signed by the volt CA.
+  rpc GetIdentityToken(GetIdentityTokenRequest) returns (GetIdentityTokenResponse);
+
+  // Retrieve the Volt parameters.
+  // This is a privileged API call and requires Volt root access.
+  rpc GetParameters(GetParametersRequest) returns (GetParametersResponse);
+
+  // Retrieve the active Volt policy.
+  // This is a privileged API call and requires Volt root access.
+  rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);
+
+  // Get resource from this volt.
+  rpc GetResource(GetResourceRequest) returns (GetResourceResponse);
+
+  // Get resources from this volt.
+  rpc GetResources(GetResourcesRequest) returns (GetResourcesResponse);
+
+  // Get ancestors of a resource.
+  rpc GetResourceAncestors(GetResourceAncestorsRequest) returns (GetResourceAncestorsResponse);
+
+  // Get descendants of a resource.
+  rpc GetResourceDescendants(GetResourceDescendantsRequest) returns (GetResourceDescendantsResponse);
+
+  // Invoke a method.
+  // This is primarily for use by tunnel connections when proxying invocations.
+  rpc Invoke(stream InvokeRequest) returns (stream InvokeResponse);
+
+  // Request access to a resource.
+  // The subject of the access is assumed to be the identity of the currently authenticated peer.
+  rpc RequestAccess(RequestAccessRequest) returns (RequestAccessResponse);
+
+  // Create or update an access rule.
+  rpc SaveAccess(SaveAccessRequest) returns (SaveAccessResponse);
+
+  // Create or update a cloud connection resource.
+  rpc SaveCloudConnection(SaveCloudConnectionRequest) returns (SaveCloudConnectionResponse);
+
+  // Create or update an identity.
+  rpc SaveIdentity(SaveIdentityRequest) returns (SaveIdentityResponse);
+
+  // Update Volt parameters.
+  // This is a privileged call that requires Volt root access.
+  rpc SaveParameters(SaveParametersRequest) returns (SaveParametersResponse);
+
+  // Create or update resource in this volt.
+  rpc SaveResource(SaveResourceRequest) returns (SaveResourceResponse);
+
+  // Set Volt access request decision.
+  // This is a privileged call that requires Volt root access.
+  rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
+
+  // Set Volt binding decision.
+  // This is a privileged call that requires Volt root access.
+  rpc SetBindingDecision(SetBindingDecisionRequest) returns (SetBindingDecisionResponse);
+
+  // Set the status of a Volt service.
+  rpc SetServiceStatus(SetServiceStatusRequest) returns (SetServiceStatusResponse);
+
+  // Used to shutdown remote Volts.
+  // This is a privileged call that requires Volt root access.
+  rpc Shutdown(ShutdownRequest) returns (ShutdownResponse);
+
+  // Sign or verify an arbitrary message using the Volt key.
+  rpc SignVerify(SignVerifyRequest) returns (SignVerifyResponse);
+}
+
+// Describes a request to bind to a volt.
+message BindRequest {
+
+  // The client public key - must be in PEM format.
+  string public_key = 1;
+
+  // A human-readable name of the entity requesting to bind.
+  string binding_name = 2;
+
+  // The volt challenge code, signed by the private key component of the `public_key` field above, and base64 encoded.
+  // This is optional.
+  string challenge = 3;
+
+  // The host name to add as a SAN to the issued certificate.
+  // This is optional, if you don't intend to host services with the certificate this can be omitted.
+  string host = 5;
+
+  // DO NOT USE
+  // Additional credentials to support the bind request.
+  // If a certificate chain is presented (in the form of a concatenated list of PEM format x509 certificates) that includes a certificate with a public key matching the `public_key` field and that certificate is signed by another certificate for which the volt policy has a trust rule, this can be used to automatically permit/deny the request.
+  // This is probably deprecated in favour of verifiable credentials.
+  repeated string x509_credential = 6;
+
+  // Optional verifiable credentials describing the client.
+  // This is a work in progress.
+  repeated VerifiablePresentation verifiable_presentation = 7;
+}
+
+message BindResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity id assigned to this binding.
+  // Only valid for PERMIT bind decisions.
+  string identity_id = 2;
+
+  // A certificate issued by the volt CA, binding the request public key to the identity.
+  // Only valid for PERMIT bind decisions.
+  string cert = 3;
+
+  // The volt CA chain. This is used by the client in subsequent API calls to secure the connection.
+  string chain = 4;
+
+  // The bind decision.
+  PolicyDecision decision = 5;
+
+  // Reserved for internal use.
+  int64 request_time = 6;
+
+  // Reserved for internal use.
+  int64 decision_time = 7;
+}
+
+message CanAccessResourceRequest {
+  oneof subject {
+    // The subject of the access request.
+    // This is optional, and if omitted will default to the authenticated account.
+    string token = 1;
+
+    // The subject of the access request.
+    // This is optional, and if omitted will default to the authenticated account.
+    string cert = 2;
+  }
+
+  // The resource in question.
+  string resource_id = 3;
+
+  // The type of access that is required.
+  string access = 4;
+}
+
+message CanAccessResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity subject that the access relates to.
+  string identity_id = 2;
+
+  // Optional identity that issued the access.
+  string issuer_id = 3;
+
+  // The resource the access relates to.
+  string resource_id = 4;
+
+  // The access type.
+  string access = 5;
+
+  // The policy decision for this access request.
+  PolicyDecision decision = 6;
+}
+
+// All fields in this message are optional, send an empty message if necessary.
+message ConnectHello {
+  // Optionally specify the calling address of the peer.
+  // Not currently in use.
+  string address = 1;
+
+  // Set to automatically make **all** services owned by the calling identity online.
+  bool online_services = 2;
+
+  // Set to receive notification of resource events.
+  bool subscribe_resource_events = 3;
+
+  // Set this to support tunnelled service invocation.
+  // This indicates that the callee is happy to receive method invocations from other clients of the tunnel.
+  // Currently this will usually be set to the `id` of the calling Volt, but in theory any client could receive remote invocation requests in this way.
+  string tunnel_id = 4;
+
+  // A friendly name to present to other tunnel clients.
+  string tunnel_name = 5;
+
+  // The certificate authority to present to other tunnel clients.
+  string tunnel_ca_pem = 6;
+
+  // Set to indicate the connection is discoverable to other tunnel clients.
+  bool tunnel_discoverable = 7;
+}
+
+// A session ping message.
+message ConnectPing {
+  // The time on the originating server.
+  uint64 timestamp = 1;
+}
+
+// Reserved for internal use.
+enum ConnectMessageType {
+  CONNECT_MESSAGE_TYPE_UNKNOWN = 0;
+  CONNECT_MESSAGE_TYPE_ORIGINAL = 1;
+  CONNECT_MESSAGE_TYPE_ECHO = 2;
+  CONNECT_MESSAGE_TYPE_FORWARD = 3;
+}
+
+// Reserved for internal use.
+enum ConnectMessageRelay {
+  CONNECT_MESSAGE_RELAY_UNKNOWN = 0;
+  CONNECT_MESSAGE_RELAY_OUTGOING = 1;
+  CONNECT_MESSAGE_RELAY_INCOMING = 2;
+}
+
+// This message is reserved for internal use.
+message ConnectMessage {
+  string id = 1;
+  string thread_id = 2;
+  string to_id = 4;
+  string to_identity_id = 5;
+  string to_name = 6;
+  string message = 7;
+  uint64 timestamp = 8;
+  string from_id = 9;
+  string from_identity_id = 10;
+  string from_name = 11;
+
+  repeated string receipts = 12;
+  ConnectMessageType message_type = 15;
+  ConnectMessageRelay message_relay = 16;
+}
+
+message ConnectGoodbye {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Set if the session was ended gracefully, as opposed to errored.
+  bool ended = 2;
+}
+
+message ConnectTunnel {
+  // Indicates the tunnel connection status.
+  bool connected = 1;
+}
+
+enum ConnectResourceEvent {
+  CONNECT_RESOURCE_EVENT_UNKNOWN = 0;
+  CONNECT_RESOURCE_EVENT_CREATE = 1;
+  CONNECT_RESOURCE_EVENT_UPDATE = 2;
+  CONNECT_RESOURCE_EVENT_DELETE = 3;
+  CONNECT_RESOURCE_EVENT_CREATE_CHILD = 4;
+  CONNECT_RESOURCE_EVENT_DELETE_CHILD = 5;
+}
+
+message ConnectResource {
+  // The type of resource event that has occurred.
+  ConnectResourceEvent resource_event = 1;
+
+  // Details of the resource.
+  Resource resource = 2;
+}
+
+message ConnectEvent {
+  oneof event {
+    // A resource event notification, such as updated or deleted.
+    ConnectResource connect_resource = 3;
+
+    // Events relating to tunnel connections.
+    ConnectTunnel tunnel = 6;
+  }
+}
+
+// One of the following payloads will be present in a given ConnectRequest message.
+message ConnectRequest {
+  oneof payload {
+    // A ConnectHello message is the first message a client sends to the target upon successfully starting the call.
+    ConnectHello hello = 1;
+
+    // Indicates the client is closing the session.
+    ConnectGoodbye goodbye = 2;
+
+    // Reserved for internal use.
+    ConnectMessage msg = 3;
+
+    // Clients should periodically send ping requests to the target to confirm the stream is still live.
+    ConnectPing ping = 4;
+
+    // Send invocation responses back to the caller.
+    // n.b. The 'request' and 'response' semantics are inverted with remote invocations because the tunnelled connection is established by a request **from** the 'target' Volt to the tunnel. Hence any invocation on behalf of a client of the tunnel involves sending a **response** back down the tunnel connection to the 'target' Volt.
+    InvokeResponse invoke_response = 5;
+
+    // Send HTTP response back to the originating request.
+    // n.b. The 'request' and 'response' semantics are inverted with HTTP proxying for the same reason as `invoke_response` above.
+    HttpResponse http_response = 6;
+  }
+}
+
+// One of the following payloads will be present in a given ConnectResponse message.
+message ConnectResponse {
+  oneof payload {
+    // Server response to initial handshake.
+    ConnectHello hello = 1;
+
+    // Indicates the server is ending the session.
+    ConnectGoodbye goodbye = 2;
+
+    // Notifies clients of various events on the Volt.
+    ConnectEvent evt = 3;
+
+    // Reserved for internal use.
+    ConnectMessage msg = 4;
+
+    // Periodic ping response.
+    ConnectPing ping = 5;
+
+    // Send an invocation request to a remote target.
+    // n.b. The 'request' and 'response' semantics are inverted for remote invocations because the tunnelled connection is established by a request **from** the 'target' Volt to the tunnel. Hence any invocation on behalf of a client of the tunnel involves sending a **response** back down the tunnel connection to the 'target' Volt.
+    InvokeRequest invoke_request = 6;
+
+    // Send an HTTP request to a remote target.
+    // n.b. The 'request' and 'response' semantics are inverted for HTTP requests for the same reason as `invoke_request` above.
+    HttpRequest http_request = 7;
+  }
+}
+
+message CreateVerifiableCredentialSessionRequest {
+  string presentation = 1;
+}
+
+message CreateVerifiableCredentialSessionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string session_id = 2;
+}
+
+message DeleteAccessRequest {
+  // The id of the access rule to delete.
+  string id = 1;
+}
+
+message DeleteAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message DeleteResourceRequest {
+  // The resource to delete.
+  string resource_id = 1;
+
+  // Set to indicate all descendant resources should also be deleted.
+  // If this is not set and the resource has descendants, the call will fail.
+  bool recursive = 2;
+}
+
+message DeleteResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message DiscoverServicesRequest {
+  // List the service APIs that should be discovered.
+  // The response will include services that match **any of** the terms given.
+  // Use of '*' to indicate wildcards is supported.
+  repeated string service_api = 2;
+
+  // Set to indicate that offline services should be included in the response.
+  bool include_offline = 3;
+
+  // Set to include the service protobuf in the response.
+  bool include_protobuf = 4;
+}
+
+message DiscoverServicesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The services that were discovered.
+  repeated Resource resources = 2;
+}
+
+message GetAccessRequest {
+  // The resource id that is the target of the access rule. If omitted, all resources will be considered.
+  string resource_id = 1;
+
+  // The identity id that is the subject of the access rule. If omitted, all identities will be considered.
+  string identity_id = 2;
+
+  // The issuer of the access rule. If omitted, all issuers will be considered.
+  string issuer_id = 3;
+
+  // The type of access to retrieve, if omitted all access will be considered.
+  string access = 4;
+
+  // The type of decision, if omitted all decisions will be considered.
+  PolicyDecision decision = 5;
+}
+
+message GetAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The access rules that match the criteria.
+  repeated Access access = 2;
+}
+
+message GetBindingsRequest {
+  // The fingerprint of the binding subject. If omitted, all bindings are retrieved.
+  string fingerprint = 1;
+
+  // The decision of the binding. If omitted, all binding decisions are retrieved.
+  PolicyDecision decision = 2;
+}
+
+message GetBindingsResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The bindings that match the criteria.
+  repeated Binding bindings = 2;
+}
+
+message GetIdentitiesRequest {
+  // Optional name of the identity.
+  // Use '*' to perform a wildcard search.
+  // If omitted all identities will be retrieved.
+  string name = 1;
+
+  // The identity alias criteria, if omitted all identities will be considered.
+  IdentityAlias alias = 2;
+}
+
+message GetIdentitiesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity list that matched the criteria.
+  repeated Identity identities = 2;
+}
+
+// One of `identity_id` or `fingerprint` must be populated.
+message GetIdentityRequest {
+  oneof lookup {
+    // The id of the identity to retrieve.
+    string identity_id = 1;
+    // The public key fingerprint of the identity to retrieve.
+    string fingerprint = 2;
+  }
+}
+
+message GetIdentityResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity details.
+  Identity identity = 2;
+}
+
+message GetIdentityTokenRequest {
+  // The token TTL, in seconds.
+  int32 ttl = 1;
+
+  // The intended token audience - usually the common name of the target volt
+  // CA.
+  string audience = 2;
+}
+
+message GetIdentityTokenResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string token = 2;
+}
+
+// This an empty message.
+message GetParametersRequest {
+}
+
+message GetParametersResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved Volt parameters.
+  VoltParameters parameters = 2;
+}
+
+// This an empty message.
+message GetPolicyRequest {
+}
+
+message GetPolicyResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The live policy in JSON format.
+  string policy = 2;
+}
+
+message GetResourceRequest {
+  // The id of the resource to retrieve.
+  string resource_id = 1;
+
+  // Set to include resource attributes in the response.
+  bool include_attributes = 2;
+
+  // Set to include service description protobuf in the response, if applicable.
+  bool include_protobuf = 3;
+
+  // Set to include any aliases associated with the resource.
+  bool include_aliases = 4;
+}
+
+message GetResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved resource metadata.
+  Resource resource = 2;
+}
+
+// Lookup is performed by combining the criteria below in the form:
+// (id = id[0] or id = id[1]) and (name = name[0] or name = name[1]) etc...
+// Also see note below regarding attributes.
+message GetResourcesRequest {
+  repeated string id = 1;
+
+  // Wildcards permitted.
+  repeated string name = 2;
+
+  // Wildcards permitted.
+  repeated string description = 3;
+
+  // Wildcards permitted.
+  repeated string kind = 4;
+
+  repeated string parent_id = 5;
+
+  // Wildcards permitted.
+  repeated string service_api = 6;
+
+  repeated string owner = 8;
+
+  repeated string store = 9;
+
+  // Attributes to search by.
+  // n.b. currently this API is mutually exclusive in that if any attribute queries are specified the rpc will only search on those attributes, ignoring any parameters defined above.
+  repeated ResourceAttributeQuery attributes = 100;
+
+  // If set, will return resources where *any of* the attribute queries apply, otherwise will only return resources where *all of* the attribute queries apply.
+  bool any_of = 101;
+
+  // Set to include service description protobuf in the response where applicable.
+  bool include_protobuf = 102;
+}
+
+message GetResourcesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The list of resources that match the lookup.
+  repeated Resource resources = 2;
+}
+
+message GetResourceAncestorsRequest {
+  // The resource id whose ancestors will be retrieved.
+  string resource_id = 1;
+
+  // Optional - if set the resource_id resource will be included in the set of resources returned.
+  bool include_resource_id = 2;
+
+  // Optional - restrict the depth search, e.g. for immediate parents depth = 1
+  int32 depth = 3;
+
+  // Optional - only match ancestors of the given kind.
+  string ancestor_kind = 4;
+
+  // Optional - can be used to determine if a resource is an ancestor.
+  string ancestor_id = 5;
+
+  // Pre-load all resource attributes.
+  bool include_attributes = 6;
+
+  // Set to include any aliases associated with the resource.
+  bool include_aliases = 7;
+}
+
+message GetResourceAncestorsResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved ancestors.
+  repeated Resource ancestors = 2;
+}
+
+message GetResourceDescendantsRequest {
+  // The resource id whose descendants will be retrieved.
+  string resource_id = 1;
+
+  // Optional - if set, the fully populated `resource_id` resource (i.e. the parent) will be included in the set of resources returned.
+  bool include_resource_id = 2;
+
+  // Optional - restrict the depth search, e.g. for immediate children depth = 1
+  int32 depth = 3;
+
+  // Optional - only match descendants of the given kind.
+  // If multiple kinds are given, resources matching **any of** the kinds will be included.
+  repeated string descendant_kind = 4;
+
+  // Optional - can be used to determine if a resource is a descendant.
+  string descendant_id = 5;
+
+  // Optional - restrict to descendants of a given parent, for use in multi-parent hierarchies.
+  string parent_id = 6;
+
+  // Restrict to a specific named resource.
+  string name = 7;
+
+  // Pre-load all resource attributes.
+  bool include_attributes = 8;
+
+  // Set to include any aliases associated with the resource.
+  bool include_aliases = 9;
+}
+
+message GetResourceDescendantsResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved descendants.
+  repeated Resource descendants = 2;
+}
+
+message InvokeRequest {
+  // Client-assigned identifier for the request. Will be used to match responses and any subsequent requests.
+  uint64 invoke_id = 1;
+
+  // The client token to use for the invocation.
+  string token = 2;
+
+  // Key fingerprint of the target Volt.
+  // This is used by the tunnel to route the request.
+  string identity_fingerprint = 3;
+
+  oneof request_payload {
+    // A serialised and encrypted instance of `RemoteResponse` in pure binary format.
+    bytes payload = 4;
+
+    // A serialised and encrypted instance of `RemoteResponse` as serialised JSON.
+    string json_payload = 5;
+  }
+
+  // Indicates the client has ended the invocation.
+  bool client_end = 6;
+}
+
+message InvokeResponse {
+  // The invocation id to match the originating request.
+  uint64 invoke_id = 1;
+
+  oneof response_payload {
+    // A serialised and encrypted instance of `RemoteRequest` in pure binary format.
+    bytes payload = 2;
+
+    // A serialised and encrypted instance of `RemoteRequest` as serialised JSON.
+    string json_payload = 3;
+
+    // Details of any error that occurred on the call.
+    tdx.volt_api.volt.v1.Status status = 4;
+  }
+
+  // Indicates the server has ended the invocation.
+  bool server_end = 5;
+}
+
+message RequestAccessRequest {
+  // The target resource id.
+  string resource_id = 1;
+
+  // The type of access requested.
+  string access = 3;
+}
+
+message RequestAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The resource being accessed.
+  string resource_id = 2;
+
+  // The identity attempting access.
+  string identity_id = 4;
+
+  // The identity of the issuer of the access.
+  string issuer_id = 5;
+
+  // Requested access.
+  string access = 7;
+
+  // Assigned decision.
+  PolicyDecision decision = 9;
+
+  // Time at which the request was made.
+  int64 request_time = 10;
+
+  // Time at which the decision was taken.
+  int64 decision_time = 11;
+
+  // Counter of number times this access was requested.
+  int32 request_count = 12;
+}
+
+message ResourceAttributeQuery {
+  string attribute_id = 1;
+  AttributeDataType data_type = 2;
+  AttributeValue value = 3;
+}
+
+message SaveAccessRequest {
+  // Omit `id` if creating new access.
+  Access access = 1;
+}
+
+message SaveAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SaveCloudConnectionRequest {
+  // Details of the cloud connection.
+  ProxyConnection connection = 1;
+
+  // Set to indicate that this is a new cloud connection.
+  bool create = 2;
+
+  // Reserved for system use.
+  string create_in_parent_id = 3;
+}
+
+message SaveCloudConnectionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated connection details.
+  ProxyConnection connection = 2;
+}
+
+message SaveIdentityRequest {
+  // Details of the identity to save.
+  Identity identity = 1;
+
+  // Set to indicate this is a new identity.
+  bool create = 2;
+
+  // The list of aliases that should be removed.
+  // For example, this allows a simple form of key rotation whereby an existing public key alias is replaced by a new one while still maintaining the same root identity id.
+  repeated IdentityAlias delete_alias = 3;
+
+  // Reserved for system use.
+  string create_in_parent_id = 4;
+}
+
+message SaveIdentityResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated identity details.
+  Identity identity = 2;
+}
+
+message SaveParametersRequest {
+  // The updated parameters.
+  VoltParameters parameters = 1;
+
+  // The current root key passphrase. Only necessary if changes are being made to the Volt key.
+  string key_passphrase = 2;
+
+  // The new root key passphrase. Only necessary if changes are being made to the Volt key.
+  string new_key_passphrase = 3;
+}
+
+message SaveParametersResponse {
+  // Details of any errors that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated Volt parameters.
+  VoltParameters parameters = 2;
+
+  // If set, the client will need to reconnect (usually because the key has changed).
+  bool reconnect = 3;
+}
+
+message SaveResourceRequest {
+  // Details of the resource to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new resource.
+  bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+}
+
+message SaveResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
+  Resource resource = 2;
+}
+
+message SetServiceStatusRequest {
+  // The service description details.
+  Resource service = 2;
+}
+
+message SetServiceStatusResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated service resource details.
+  Resource resource = 2;
+}
+
+message SetAccessRequestDecisionRequest {
+  // The id of the access request.
+  string id = 1;
+
+  // The decision to save against the access request.
+  PolicyDecision decision = 2;
+}
+
+message SetAccessRequestDecisionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SetBindingDecisionRequest {
+  // The fingerprint of the bind request.
+  string fingerprint = 1;
+
+  // The policy decision to assign to the bind request.
+  PolicyDecision decision = 2;
+}
+
+message SetBindingDecisionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+// This message is emtpy.
+message ShutdownRequest {
+}
+
+message ShutdownResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SignVerifyRequest {
+  // Set to indicate this is a request to verify rather than sign.
+  bool verify = 1;
+
+  // Set to indicate the signature should be base64 encoded in the response.
+  // Only valid when signing.
+  bool encode = 2;
+
+  // The message to sign.
+  // Only valid when signing.
+  string message = 3;
+
+  oneof digest {
+    // The digest in raw binary form.
+    // Only valid if verifying.
+    bytes digest_raw = 4;
+
+    // The digest encoded using base64.
+    // Only valid if verifying.
+    string digest_encoded = 5;
+  }
+}
+
+// Note that if verification was successful the response will be empty (there is no error and no digest is returned).
+message SignVerifyResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  oneof payload {
+    // The signature in raw binary form.
+    bytes digest = 3;
+
+    // The signature encoded using base64.
+    string digest_encoded = 4;
+  }
+}