@tdxvolt/volt-client-grpc 0.15.1 → 0.16.0-beta.1

package/protobuf/tdx/volt_api/volt/v1/ssi_api.proto

@@ -0,0 +1,126 @@
+syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/ssi.proto";
+import "tdx/volt_api/volt/v1/status.proto";
+
+service SsiAPI {
+  rpc DeleteDID(DeleteDIDRequest) returns (DeleteDIDResponse);
+  rpc GetDIDDocument(GetDIDDocumentRequest) returns (GetDIDDocumentResponse);
+  rpc GetDIDRegistryUpdates(GetDIDRegistryUpdatesRequest) returns (GetDIDRegistryUpdatesResponse);
+  rpc ParseCredential(ParseCredentialRequest) returns (ParseCredentialResponse);
+  rpc ResolveDID(ResolveDIDRequest) returns (ResolveDIDResponse);
+  rpc RegisterDIDDocument(RegisterDIDDocumentRequest) returns (RegisterDIDDocumentResponse);
+}
+
+message DeleteDIDRequest {
+  // The id of the identity to delete.
+  string did = 1;
+}
+
+message DeleteDIDResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message GetDIDDocumentRequest {
+  // The id of the identity to retrieve.
+  string did = 1;
+
+  // If set, the search is restricted to the local registry only, otherwise all configured registries are searched.
+  bool local_only = 2;
+}
+
+message GetDIDDocumentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  DIDRegistryUpdate did_document = 2;
+}
+
+message GetDIDRegistryUpdatesRequest {
+  // The id of the last update received.
+  // All updates since this id will be returned, limited to the maximum number of updates specified in the request.
+  // To fully synchronise, clients should continue calling this method until the response contains no updates.
+  // If this is the first call, then this should be set to 0.
+  uint64 since_id = 1;
+
+  // The maximum number of updates to return, defaults to 1000.
+  uint32 max_updates = 2;
+
+  string origin_volt = 3;
+}
+
+message GetDIDRegistryUpdatesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updates.
+  repeated DIDRegistryUpdate update = 2;
+}
+
+message ResolveDIDRequest {
+  // The DID to resolve.
+  string did = 1;
+
+  // Set to search all known registries rather than just the local registry.
+  bool include_registries = 2;
+}
+
+message ResolveDIDResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The JSON representation of the DID document.
+  string did_document = 2;
+
+  // The signature used to save this version of the DID document.
+  string update_signature = 3;
+
+  // The DID of the Volt that saved this version of the DID document.
+  string origin_volt = 4;
+}
+
+message RegisterDIDDocumentRequest {
+  bool create = 1;
+
+  // The DID document to save.
+  DIDRegistryUpdate did_update = 2;
+
+  // When updating an existing DID document, it is necessary to include a signature of the document JSON, signed by the DID document's current owner.
+  // This is different from the proof contained in the DID document itself.
+  string update_signature = 3;
+}
+
+message RegisterDIDDocumentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  DIDRegistryUpdate did_document = 2;
+}
+
+
+// Empty ATM - a VC is issued for the authenticated identity.
+message TrustVerifiableCredentialRequest {
+}
+
+message TrustVerifiableCredentialResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string verifiable_credential_json = 2;
+}
+
+message ParseCredentialRequest {
+  oneof credential {
+    VerifiablePresentation verifiable_presentation = 1;
+    string url = 2;
+  }
+  string public_key = 3;
+}
+
+message ParseCredentialResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string id = 2;
+  string issuer_id = 3;
+  string subject_id = 4;
+  string claim_json = 5;
+}

package/protobuf/tdx/volt_api/volt/v1/volt.proto

@@ -24,18 +24,6 @@ enum OnlineStatus {
   ONLINE_STATUS_OFFLINE = 2;
 }
 
-// @todo currently this must align with AuthorisationDecision enum in policy library, but some of the values are irrelevant outside of the public API so we need a public-facing enum and some translation.
-enum PolicyDecision {
-  POLICY_DECISION_UNKNOWN = 0;
-  POLICY_DECISION_PROMPT = 1;
-  POLICY_DECISION_PERMIT = 2;
-  POLICY_DECISION_DENY = 3;
-  POLICY_DECISION_INDETERMINATE = 4;
-  POLICY_DECISION_NOT_APPLICABLE = 5;
-  POLICY_DECISION_APPLICABLE = 6;
-  POLICY_DECISION_PENDING = 7;
-}
-
 // Not used ATM.
 enum ResourceStatus {
   RESOURCE_STATUS_UNKNOWN = 0;
@@ -51,6 +39,31 @@ enum ShareMode {
   SHARE_MODE_PUBLIC_READ = 2;
 }
 
+// @todo currently this must align with AuthorisationDecision enum in policy library, but some of the values are irrelevant outside of the public API so we need a public-facing enum and some translation.
+enum PolicyDecision {
+  POLICY_DECISION_UNKNOWN = 0;
+  POLICY_DECISION_PROMPT = 1;
+  POLICY_DECISION_PERMIT = 2;
+  POLICY_DECISION_DENY = 3;
+  POLICY_DECISION_INDETERMINATE = 4;
+  POLICY_DECISION_NOT_APPLICABLE = 5;
+  POLICY_DECISION_APPLICABLE = 6;
+  POLICY_DECISION_PENDING = 7;
+}
+
+// Attribute data types.
+enum AttributeDataType {
+  ATTRIBUTE_DATA_TYPE_UNKNOWN = 0;
+  ATTRIBUTE_DATA_TYPE_STRING = 1;
+  ATTRIBUTE_DATA_TYPE_INTEGER = 2;
+  ATTRIBUTE_DATA_TYPE_REAL = 3;
+  ATTRIBUTE_DATA_TYPE_BOOLEAN = 4;
+  ATTRIBUTE_DATA_TYPE_BYTES = 5;
+
+  ATTRIBUTE_DATA_TYPE_IDENTITY = 100;
+  ATTRIBUTE_DATA_TYPE_RESOURCE = 101;
+}
+
 // Represents an outbound connection from a Volt to a remote service that will act as a proxy for that Volt.
 // This enables Volts to bypass firewall and NATs.
 // Example - connection from a Volt to a Relay Volt running on the public internet, such as tdxvolt.com
@@ -81,6 +94,15 @@ message ProxyConnection {
 
   // Optional challenge that can be presented in the bind phase when initialising the connection.
   string challenge = 10;
+
+  // Indicates that this connection hosts a DID registry that we should synchronise with.
+  bool sync_did_registry = 11;
+
+  // The id of the last DID registry operation that was synchronised.
+  uint64 did_registry_sync_id = 12;
+
+  // The id of the target Volt that this connection is bound to.
+  string target_id = 13;
 }
 
 enum SecureMode {
@@ -192,6 +214,13 @@ message VoltParameters {
   // The certificate authority of the Relay if this is a remote connection via a Relay.
   string relay_ca_pem = 33;
 
+  // Optional override of the http address, rather than using the default of fixed_host:http_port.
+  // This is useful if the Volt is behind a firewall or NAT, and the http server is listening on a different port
+  // from 80 or 443 but this is hidden by the proxy. For example, if the `fixed_host` is `coreid.com` and http server is
+  // listening on 2115, but the proxy is forwarding 443 to 2115, then the http_address_override would be set to
+  // `https://coreid.com`.
+  string http_address_override = 34;
+
   // An optional alias that can be used to refer to the Volt rather than the `id` field.
   // This alias must be unique within the scope of the Battery in which the Volt is stored.
   string alias = 35;
@@ -201,6 +230,12 @@ message VoltParameters {
 
   // If set, indicates that any client that provides the correct challenge in the bind phase will automatically be approved to access the Volt.
   bool approve_on_challenge = 37;
+
+  // Maintain and expose a database of DIDs.
+  bool enable_did_registry = 38;
+
+  // Zero or more URLs of trusted peer DID registries.
+  repeated string did_registry = 40;
 }
 
 message VoltEndpoint {
@@ -261,8 +296,11 @@ message ProtoFile {
 
 enum ServiceHostType {
   SERVICE_HOST_TYPE_UNKNOWN = 0;
+  // A built-in service hosted by the Volt.
   SERVICE_HOST_TYPE_BUILTIN = 1;
+  // A service hosted by a grpc server other than the Volt.
   SERVICE_HOST_TYPE_SERVER = 2;
+  // A service hosted by a Volt client via a relay connection, i.e. the service is not exposed by a server as such, rather a Volt client implements the service and a Volt acts as a proxy, calling back to the client to implement the methods.
   SERVICE_HOST_TYPE_RELAYED = 3;
 }
 
@@ -270,16 +308,19 @@ enum ServiceHostType {
 message ServiceDescription {
   ServiceHostType host_type = 1;
 
-  // The id of the server resource that is hosting this service.
-  // For built-in services, i.e. those hosted by the Volt, this will set to the Volt id.
-  string host_service_id = 2;
+  // The identity of the client that is exposing the service.
+  // For example, if a third party is exposing a database service via a Volt, it will first bind to the Volt and obtain a client DID and credentials in order to be able to create service resource(s).
+  // Any resources that are owned by this client will be marked as online if the client itself is online, i.e. has a live connection to the Volt.
+  // This will be empty if the service is a built-in Volt service.
+  string host_client_id = 2;
 
-  // The identity of the client that is exposing the service via a relay connection.
-  // This will be empty if the service is exposed via a grpc server.
-  string host_client_id = 3;
+  // The id of the resource that holds the protobuf definition for this resource.
+  // For example, if a third party is exposing a database service via a Volt, it will create a service resource that holds details of the protobuf methods exposed by the service.
+  // For built-in services, i.e. those hosted by the Volt, this will set to the Volt id.
+  string host_service_id = 3;
 
   // The address of the grpc server hosting this service.
-  // This will be empty if the service is hosted by a relay client (see `relay_public_key` below).
+  // Only relevant to grpc-hosted services.
   string host_address = 4;
 
   // The certificate authority (chain) that signed the service server certificate.
@@ -290,9 +331,6 @@ message ServiceDescription {
   // This may change as the service comes and goes online.
   string host_public_key = 6;
 
-  // The fingerprint derived from `host_public_key`, included for convenience.
-  string host_fingerprint = 7;
-
   // The connection id currently used to host this service.
   string host_connection_id = 8;
 
@@ -312,24 +350,11 @@ message ServiceDescription {
   repeated MethodDescription method = 100;
 }
 
-// Resource attribute data types.
-enum AttributeDataType {
-  ATTRIBUTE_DATA_TYPE_UNKNOWN = 0;
-  ATTRIBUTE_DATA_TYPE_STRING = 1;
-  ATTRIBUTE_DATA_TYPE_INTEGER = 2;
-  ATTRIBUTE_DATA_TYPE_REAL = 3;
-  ATTRIBUTE_DATA_TYPE_BOOLEAN = 4;
-  ATTRIBUTE_DATA_TYPE_BYTES = 5;
-
-  ATTRIBUTE_DATA_TYPE_IDENTITY = 100;
-  ATTRIBUTE_DATA_TYPE_RESOURCE = 101;
-}
-
-// Resource attribute value will be one of the following fields, depending on the data type.
+// Attribute value will be one of the following fields, depending on the data type.
 message AttributeValue {
   oneof value {
     string string = 1;
-    int32 integer = 2;
+    int64 integer = 2;
     double real = 3;
     bool boolean = 4;
     bytes bytes = 5;
@@ -429,32 +454,38 @@ enum IdentityType {
 }
 
 message IdentityAlias {
+  // The alias id.
+  uint32 id = 1;
+
   // The corresponding identity id.
-  string identity_id = 1;
+  string identity_id = 2;
 
   // The actual alias, e.g. a common name or key fingerprint.
-  string alias = 2;
-
-  // This will only be populated if alias_type == tdx:public-key
-  string public_key = 3;
+  string alias = 3;
 
   // This will only be populated if alias_type == tdx:public-key
-  string private_key = 4;
+  string public_key = 4;
 
-  string alias_type = 5;
+  // This will only be populated if alias_type == tdx:public-key, and the key is stored in the Volt.
+  string private_key = 5;
 
-  string issuer_id = 6;
+  // The alias type, for example public key, email, phone number etc.
+  string alias_type = 6;
 
-  // Indicates if this alias has an 'authenticate' policy decision assigned.
-  PolicyDecision authenticate = 7;
+  // The identity that issued this alias.
+  string issuer_id = 7;
 
   // Indicates if this alias has an 'bind' policy decision assigned.
   PolicyDecision bind = 8;
+
+  // Optional description of this alias.
+  string description = 9;
 }
 
 // A Volt identity encompasses a Resource and a set of identity aliases.
 message Identity {
   Resource resource = 1;
+
   repeated IdentityAlias alias = 2;
 }
 
@@ -514,6 +545,10 @@ message Binding {
 
   // Set if the bind request presented a valid challenge code.
   bool volt_challenge = 15;
+
+  string did_document = 16;
+
+  string did_document_signature = 17;
 }
 
 message Access {
@@ -571,27 +606,49 @@ enum SessionStatus {
   SESSION_STATUS_REJECTED = 3;
 }
 
+message SessionCredential {
+  // The alias id.
+  uint32 id = 1;
+
+  // The corresponding session id.
+  string session_id = 2;
+
+  // The actual credential, e.g. a key fingerprint or VC.
+  string credential = 3;
+
+  // The credential type, for example public key, email, phone number etc.
+  string credential_type = 4;
+
+  // The identity that issued this alias.
+  string issuer_id = 5;
+
+  // Optional description of this alias.
+  string description = 6;
+
+  // Type-specific extra data stored with the credential.
+  string extra = 7;
+
+  // More type-specific data stored with the credential.
+  string extra_2 = 8;
+}
+
 message Session {
   string id = 1;
 
-  string identity_id = 2;
+  //  string public_key = 2;
 
-  string identity_name = 3;
+  string identity_id = 3;
 
-  string ip = 4;
+  string identity_name = 4;
 
-  uint64 created = 5;
+  string ip = 5;
 
-  uint64 modified = 6;
+  repeated SessionCredential credential = 6;
 
-  SessionStatus status = 7;
-}
+  uint64 created = 7;
 
-message VerifiableCredential {
-  string encoded = 1;
-}
+  uint64 modified = 8;
 
-message VerifiablePresentation {
-  VerifiableCredential credential = 1;
-  string signature = 2;
+  SessionStatus status = 9;
 }
+

package/protobuf/tdx/volt_api/volt/v1/volt_api.proto

@@ -4,6 +4,7 @@ package tdx.volt_api.volt.v1;
 
 import "tdx/volt_api/volt/v1/status.proto";
 import "tdx/volt_api/volt/v1/remote.proto";
+import "tdx/volt_api/volt/v1/ssi.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
 // The top-level volt management service. 
@@ -11,9 +12,11 @@ import "tdx/volt_api/volt/v1/volt.proto";
 // A client certificate can be obtained from the `Bind` method.
 // All methods include a `tdx.volt_api.volt.v1.Status` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
 service VoltAPI {
+  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse);
+
   // Issues a request to bind to the volt.
   // All clients must successfully bind to the Volt in order to gain any kind of access.
-  // A client certificate is optional for this RPC, in which case a JWT must be provided in the call metadata.
+  // A client certificate is optional for this RPC, if omitted a JWT must be provided in the call metadata.
   // If the client plans to register one or more services with the Volt, it should use the 'host' field of the request so that the returned certificate has the appropriate SAN extension in place. Note that if the client IP address changes it will be necessary to re-Bind the client and obtain a new certificate.
   // If the bind decision is 'permit', the bind response contains various details that should be persisted by the client, including the unique identifier assigned by the Volt and a signed client certificate along with the Volt CA certificate.
   rpc Bind(BindRequest) returns (BindResponse);
@@ -122,9 +125,6 @@ service VoltAPI {
   // Save a session.
   rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
 
-  // Experimental - please ignore.
-  rpc Session(SessionRequest) returns (SessionResponse);
-
   // Set Volt access request decision.
   // This is a privileged call that requires Volt root access.
   rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
@@ -133,6 +133,8 @@ service VoltAPI {
   // This is a privileged call that requires Volt root access.
   rpc SetBindingDecision(SetBindingDecisionRequest) returns (SetBindingDecisionResponse);
 
+  rpc SetPolicy(SetPolicyRequest) returns (SetPolicyResponse);
+
   // Set the status of a Volt service.
   rpc SetServiceStatus(SetServiceStatusRequest) returns (SetServiceStatusResponse);
 
@@ -145,31 +147,112 @@ service VoltAPI {
 }
 
 // Describes a request to bind to a volt.
-message BindRequest {
+message AuthenticateRequest {
+
+  oneof client_identifier {
+    // An existing DID owned by the client.
+    // The JWT presented with the Bind call must be signed by the private key corresponding to this DID.
+    string did = 1;
+
+    // If the client doesn't have an existing DID, a DID document can be provided here.
+    // The document must include a proof that the client owns the public key given in `public_key`.
+    // The Volt will register the DID on behalf of the client.
+    // The JWT presented with the Bind call must be signed by the private key corresponding to this document.
+    string did_document = 2;
+
+    // The client public key - must be in PEM format. If the client DID is lost or unknown for some reason, providing the public key here will allow the Volt to match it with the previously registered DID.
+    // Note this is only valid when a DID has previously been registered using this public key.
+    string public_key = 3;
+  }
 
-  // The client public key - must be in PEM format.
-  string public_key = 1;
+  // A base64-encoded signature of the DID document, only required if `did_document` is provided above.
+  string did_document_signature = 4;
 
   // A human-readable name of the entity requesting to bind.
-  string binding_name = 2;
+  string binding_name = 5;
 
   // The volt challenge code, signed by the private key component of the `public_key` field above, and base64 encoded.
   // This is optional.
-  string challenge = 3;
+  string challenge = 6;
 
   // The host name to add as a SAN to the issued certificate.
   // This is optional, if you don't intend to host services with the certificate this can be omitted.
-  string host = 4;
+  string host = 7;
+
+  // Optional verifiable credentials describing the client.
+  // This is a work in progress.
+  repeated VerifiablePresentation verifiable_presentation = 8;
+
+  // Reserved for internal use.
+  bool purge_aliases = 9;
+}
+
+message AuthenticateResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  string session_id = 2;
+
+  // The identity id assigned to this binding.
+  // Only valid for PERMIT bind decisions.
+  string identity_id = 3;
+
+  // A certificate issued by the volt CA, binding the request public key to the identity.
+  // Only valid for PERMIT bind decisions.
+  string cert = 4;
+
+  // The volt CA chain. This is used by the client in subsequent API calls to secure the connection.
+  string chain = 5;
+
+  // The bind decision.
+  PolicyDecision decision = 6;
+
+  // Reserved for internal use.
+  int64 request_time = 7;
 
-  // DO NOT USE
-  // Additional credentials to support the bind request.
-  // If a certificate chain is presented (in the form of a concatenated list of PEM format x509 certificates) that includes a certificate with a public key matching the `public_key` field and that certificate is signed by another certificate for which the volt policy has a trust rule, this can be used to automatically permit/deny the request.
-  // This is probably deprecated in favour of verifiable credentials.
-  repeated string x509_credential = 5;
+  // Reserved for internal use.
+  int64 decision_time = 8;
+}
+
+// Describes a request to bind to a volt.
+message BindRequest {
+
+  oneof client_identifier {
+    // An existing DID owned by the client.
+    // The JWT presented with the Bind call must be signed by the private key corresponding to this DID.
+    string did = 1;
+
+    // If the client doesn't have an existing DID, a DID document can be provided here.
+    // The document must include a proof that the client owns the public key given in `public_key`.
+    // The Volt will register the DID on behalf of the client.
+    // The JWT presented with the Bind call must be signed by the private key corresponding to this document.
+    string did_document = 2;
+
+    // The client public key - must be in PEM format. If the client DID is lost or unknown for some reason, providing the public key here will allow the Volt to match it with the previously registered DID.
+    // Note this is only valid when a DID has previously been registered using this public key.
+    string public_key = 3;
+  }
+
+  // A base64-encoded signature of the DID document, only required if `did_document` is provided above.
+  string did_document_signature = 4;
+
+  // A human-readable name of the entity requesting to bind.
+  string binding_name = 5;
+
+  // The volt challenge code, signed by the private key component of the `public_key` field above, and base64 encoded.
+  // This is optional.
+  string challenge = 6;
+
+  // The host name to add as a SAN to the issued certificate.
+  // This is optional, if you don't intend to host services with the certificate this can be omitted.
+  string host = 7;
 
   // Optional verifiable credentials describing the client.
   // This is a work in progress.
-  repeated VerifiablePresentation verifiable_presentation = 6;
+  repeated VerifiablePresentation verifiable_presentation = 8;
+
+  // Reserved for internal use.
+  bool purge_aliases = 9;
 }
 
 message BindResponse {
@@ -278,13 +361,15 @@ message ConnectHello {
   bool subscribe_auth_requests = 8;
 
   bool accept_invocation = 9;
+
+  bool subscribe_did_registry_updates = 10;
 }
 
 message ConnectAcknowledge {
   string connection_id = 1;
 }
 
-// A session ping message.
+// A connection ping message.
 message ConnectPing {
   // The time on the originating server.
   uint64 timestamp = 1;
@@ -343,6 +428,7 @@ enum ConnectResourceEvent {
   CONNECT_RESOURCE_EVENT_DELETE = 3;
   CONNECT_RESOURCE_EVENT_CREATE_CHILD = 4;
   CONNECT_RESOURCE_EVENT_DELETE_CHILD = 5;
+  CONNECT_RESOURCE_EVENT_DATABASE_WRITE = 6;
 }
 
 message ConnectResource {
@@ -363,12 +449,18 @@ message ConnectAuthRequest {
   uint64 timestamp = 7;
 }
 
+message ConnectDIDRegistryUpdate {
+  DIDRegistryUpdate update = 1;
+}
+
 message ConnectEvent {
   oneof event {
     ConnectAuthRequest connect_auth_request = 1;
 
     // A resource event notification, such as updated or deleted.
     ConnectResource connect_resource = 2;
+
+    ConnectDIDRegistryUpdate did_registry_update = 3;
   }
 }
 
@@ -620,6 +712,8 @@ message GetParametersResponse {
 
 // This an empty message.
 message GetPolicyRequest {
+  // Set to only retrieve the custom policy document.
+  bool custom_policy = 1;
 }
 
 message GetPolicyResponse {
@@ -771,10 +865,9 @@ message InvokeRequest {
   // This contains the key and iv used to encrypt the payload, which only the token audience can access because the key and iv are themselves encrypted using the public key of the invocation target.
   string token = 2;
 
-  // Key fingerprint of the target Volt.
+  // The DID of the target identity hosting the service.
   // This is used by Relays to route the request.
-  // We can't (currently) use the target Volt id here, since there is currently no way to universally 'reason about' a given identity (Volt). For example, Alice may have assigned Bob an identity of 123, whereas Carol assigned Bob an identity of 456.
-  repeated string target_fingerprint = 3;
+  repeated string target_did = 3;
 
   oneof request_payload {
     // A serialised and encrypted instance of `RemoteResponse` in pure binary format.
@@ -916,6 +1009,17 @@ message SaveIdentityRequest {
 
   // Reserved for system use.
   string create_in_parent_id = 4;
+
+  // Set to indicate the identity aliases should be purged before saving the identity.
+  // If the `identity` field contains aliases they will be saved after the purge.
+  // If the `identity` field does not contain aliases this effectively deletes all aliases for this identity.
+  // This allows you to selectively update aliases if required, i.e. don't set this flag and include a single alias in the update.
+  bool purge_aliases = 5;
+
+  string did_document = 6;
+
+  // The signature of the identity did document, if present.
+  string did_update_signature = 7;
 }
 
 message SaveIdentityResponse {
@@ -985,19 +1089,13 @@ message SaveSessionResponse {
   Session session = 2;
 }
 
-message SessionRequest {
-  string session_id = 1;
-  oneof payload {
-    string fingerprint = 2;
-    string signature = 3;
-  }
+message SetPolicyRequest {
+  string custom_policy = 1;
 }
 
-message SessionResponse {
+message SetPolicyResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
-  string proof = 2;
-  string session_id = 3;
 }
 
 message SetServiceStatusRequest {