@tdxvolt/volt-client-grpc 0.16.0-beta.10 → 0.16.0-beta.13

package/protobuf/tdx/volt_api/volt/v1/volt_api.proto

@@ -8,18 +8,16 @@ import "tdx/volt_api/volt/v1/ssi.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
 // The top-level volt management service. 
-// With the exception of `Bind`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
-// A client certificate can be obtained from the `Bind` method.
+// With the exception of `Authenticate`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
+// A client certificate can be obtained from the `Authenticate` method.
 // All methods include a `tdx.volt_api.volt.v1.Status` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
 service VoltAPI {
-  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse);
-
-  // Issues a request to bind to the volt.
-  // All clients must successfully bind to the Volt in order to gain any kind of access.
+  // Issues a request to authenticate on the volt.
+  // All clients must successfully authenticate in order to gain any kind of access.
   // A client certificate is optional for this RPC, if omitted a JWT must be provided in the call metadata.
-  // If the client plans to register one or more services with the Volt, it should use the 'host' field of the request so that the returned certificate has the appropriate SAN extension in place. Note that if the client IP address changes it will be necessary to re-Bind the client and obtain a new certificate.
-  // If the bind decision is 'permit', the bind response contains various details that should be persisted by the client, including the unique identifier assigned by the Volt and a signed client certificate along with the Volt CA certificate.
-  rpc Bind(BindRequest) returns (BindResponse);
+  // If the client plans to register one or more services with the Volt, it should use the 'host' field of the request so that the returned certificate has the appropriate SAN extension in place. Note that if the client IP address changes it will be necessary to re-authenticate the client and obtain a new certificate.
+  // If the authenticate decision is 'permit', the response contains various details that should be persisted by the client, including the unique identifier assigned by the Volt and a signed client certificate along with the Volt CA certificate.
+  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse);
 
   // Determine if an identity can perform a specific action on a resource.
   // Third party services can use this to interrogate the Volt policy and determine if a client has permission to perform a certain action on a resource.
@@ -39,9 +37,6 @@ service VoltAPI {
   // n.b. Copy resources between Volts is not supported by this API. This is achieved by creating an API instance for the source and target Volts, getting the resource from the source and creating it on the target.
   rpc CopyResource(CopyResourceRequest) returns (CopyResourceResponse);
 
-  // This is a work in progress - do not use.
-  rpc CreateVerifiableCredentialSession(CreateVerifiableCredentialSessionRequest) returns (CreateVerifiableCredentialSessionResponse);
-
   // Remove a custom access rule, such as a file share.
   rpc DeleteAccess(DeleteAccessRequest) returns (DeleteAccessResponse);
 
@@ -57,10 +52,6 @@ service VoltAPI {
   // If the authenticated identity is the Volt root, all rules will be retrieved that match the criteria.
   rpc GetAccess(GetAccessRequest) returns (GetAccessResponse);
 
-  // Get the bindings for this volt.
-  // This is a privileged API call and requires Volt root access.
-  rpc GetBindings(GetBindingsRequest) returns (GetBindingsResponse);
-
   // Retrieve identities matching the given criteria.
   // Only identities that the authenticated identity has read access to will be retrieved.
   rpc GetIdentities(GetIdentitiesRequest) returns (GetIdentitiesResponse);
@@ -69,9 +60,8 @@ service VoltAPI {
   // The identity will only be retrieved if the authenticated identity has read access to it.
   rpc GetIdentity(GetIdentityRequest) returns (GetIdentityResponse);
 
-  // NOT YET IMPLEMENTED.
-  // Gets a credential for the currently authenticated client, signed by the volt CA.
-  rpc GetIdentityToken(GetIdentityTokenRequest) returns (GetIdentityTokenResponse);
+  // Gets a one-time token that can be used as a temporary authentication token, for example create an file download link that expires after a certain time.
+  rpc GetOneTimeToken(GetOneTimeTokenRequest) returns (GetOneTimeTokenResponse);
 
   // Retrieve the Volt parameters.
   // This is a privileged API call and requires Volt root access.
@@ -93,8 +83,8 @@ service VoltAPI {
   // Get descendants of a resource.
   rpc GetResourceDescendants(GetResourceDescendantsRequest) returns (GetResourceDescendantsResponse);
 
-  // Get session(s).
-  rpc GetSession(GetSessionRequest) returns (GetSessionResponse);
+  // Get sessions.
+  rpc GetSessions(GetSessionsRequest) returns (GetSessionsResponse);
 
   // Invoke a method.
   // This is primarily for use by Relay connections when proxying invocations.
@@ -110,11 +100,18 @@ service VoltAPI {
   // Create or update an access rule.
   rpc SaveAccess(SaveAccessRequest) returns (SaveAccessResponse);
 
-  rpc SaveAuthentication(SaveAuthenticationRequest) returns (SaveAuthenticationResponse);
+  // Create or update a static file HTTP server.
+  rpc SaveHttpFileServer(SaveResourceRequest) returns (SaveResourceResponse);
+
+  // Create or update an HTTP REST API server.
+  rpc SaveHttpApiServer(SaveResourceRequest) returns (SaveResourceResponse);
 
   // Create or update an identity.
   rpc SaveIdentity(SaveIdentityRequest) returns (SaveIdentityResponse);
 
+  // Create or update a mirrored link resource.
+  rpc SaveMirroredLink(SaveResourceRequest) returns (SaveResourceResponse);
+
   // Update Volt parameters.
   // This is a privileged call that requires Volt root access.
   rpc SaveParameters(SaveParametersRequest) returns (SaveParametersResponse);
@@ -122,6 +119,9 @@ service VoltAPI {
   // Create or update resource in this volt.
   rpc SaveResource(SaveResourceRequest) returns (SaveResourceResponse);
 
+  // Create or update a symbolic link resource.
+  rpc SaveSymbolicLink(SaveResourceRequest) returns (SaveResourceResponse);
+
   // Save a session.
   rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
 
@@ -129,10 +129,6 @@ service VoltAPI {
   // This is a privileged call that requires Volt root access.
   rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
 
-  // Set Volt binding decision.
-  // This is a privileged call that requires Volt root access.
-  rpc SetBindingDecision(SetBindingDecisionRequest) returns (SetBindingDecisionResponse);
-
   rpc SetPolicy(SetPolicyRequest) returns (SetPolicyResponse);
 
   // Set the status of a Volt service.
@@ -146,45 +142,50 @@ service VoltAPI {
   rpc SignVerify(SignVerifyRequest) returns (SignVerifyResponse);
 }
 
-// Describes a request to bind to a volt.
+// Describes a request to authenticate on a Volt.
+// Present one of the `public_key`, `did_public_key`, `did`, or `did_document` fields.
 message AuthenticateRequest {
 
   oneof client_identifier {
+    // The client public key in PEM format. The Volt will create a session that is bound to this public key.
+    string public_key = 1;
+
+    // The client public key - must be in PEM format. If the client DID is lost or unknown for some reason, providing the public key here will allow the Volt to match it with the previously registered DID.
+    // Note this is only valid when a DID has previously been registered using this public key.
+    string did_public_key = 2;
+
     // An existing DID owned by the client.
-    // The JWT presented with the Bind call must be signed by the private key corresponding to this DID.
-    string did = 1;
+    // The JWT presented with the authenticate call must be signed by the private key corresponding to this DID.
+    string did = 3;
 
     // If the client doesn't have an existing DID, a DID document can be provided here.
-    // The document must include a proof that the client owns the public key given in `public_key`.
     // The Volt will register the DID on behalf of the client.
-    // The JWT presented with the Bind call must be signed by the private key corresponding to this document.
-    string did_document = 2;
-
-    // The client public key - must be in PEM format. If the client DID is lost or unknown for some reason, providing the public key here will allow the Volt to match it with the previously registered DID.
-    // Note this is only valid when a DID has previously been registered using this public key.
-    string public_key = 3;
+    // The JWT presented with the authenticate call must be signed by the private key corresponding to this document.
+    string did_document = 4;
   }
 
   // A base64-encoded signature of the DID document, only required if `did_document` is provided above.
-  string did_document_signature = 4;
+  string did_document_signature = 5;
 
-  // A human-readable name of the entity requesting to bind.
-  string binding_name = 5;
+  // A human-readable name of the entity requesting to authenticate.
+  string client_name = 6;
 
   // The volt challenge code, signed by the private key component of the `public_key` field above, and base64 encoded.
   // This is optional.
-  string challenge = 6;
+  string challenge = 7;
 
   // The host name to add as a SAN to the issued certificate.
   // This is optional, if you don't intend to host services with the certificate this can be omitted.
-  string host = 7;
+  string host = 8;
 
   // Optional verifiable credentials describing the client.
-  // This is a work in progress.
-  repeated VerifiablePresentation verifiable_presentation = 8;
+  repeated VerifiablePresentation verifiable_presentation = 9;
 
   // Reserved for internal use.
-  bool purge_aliases = 9;
+  bool purge_aliases = 10;
+
+  // Optional additional name to differentiate between multiple sessions for a given client.
+  string session_name = 11;
 }
 
 message AuthenticateResponse {
@@ -193,18 +194,17 @@ message AuthenticateResponse {
 
   string session_id = 2;
 
-  // The identity id assigned to this binding.
-  // Only valid for PERMIT bind decisions.
-  string identity_id = 3;
+  // The identity id assigned to this authentication.
+  string identity_did = 3;
 
   // A certificate issued by the volt CA, binding the request public key to the identity.
-  // Only valid for PERMIT bind decisions.
+  // Only valid for PERMIT authenticate decisions.
   string cert = 4;
 
   // The volt CA chain. This is used by the client in subsequent API calls to secure the connection.
   string chain = 5;
 
-  // The bind decision.
+  // The authenticate decision.
   PolicyDecision decision = 6;
 
   // Reserved for internal use.
@@ -214,72 +214,6 @@ message AuthenticateResponse {
   int64 decision_time = 8;
 }
 
-// Describes a request to bind to a volt.
-message BindRequest {
-
-  oneof client_identifier {
-    // An existing DID owned by the client.
-    // The JWT presented with the Bind call must be signed by the private key corresponding to this DID.
-    string did = 1;
-
-    // If the client doesn't have an existing DID, a DID document can be provided here.
-    // The document must include a proof that the client owns the public key given in `public_key`.
-    // The Volt will register the DID on behalf of the client.
-    // The JWT presented with the Bind call must be signed by the private key corresponding to this document.
-    string did_document = 2;
-
-    // The client public key - must be in PEM format. If the client DID is lost or unknown for some reason, providing the public key here will allow the Volt to match it with the previously registered DID.
-    // Note this is only valid when a DID has previously been registered using this public key.
-    string public_key = 3;
-  }
-
-  // A base64-encoded signature of the DID document, only required if `did_document` is provided above.
-  string did_document_signature = 4;
-
-  // A human-readable name of the entity requesting to bind.
-  string binding_name = 5;
-
-  // The volt challenge code, signed by the private key component of the `public_key` field above, and base64 encoded.
-  // This is optional.
-  string challenge = 6;
-
-  // The host name to add as a SAN to the issued certificate.
-  // This is optional, if you don't intend to host services with the certificate this can be omitted.
-  string host = 7;
-
-  // Optional verifiable credentials describing the client.
-  // This is a work in progress.
-  repeated VerifiablePresentation verifiable_presentation = 8;
-
-  // Reserved for internal use.
-  bool purge_aliases = 9;
-}
-
-message BindResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The identity id assigned to this binding.
-  // Only valid for PERMIT bind decisions.
-  string identity_id = 2;
-
-  // A certificate issued by the volt CA, binding the request public key to the identity.
-  // Only valid for PERMIT bind decisions.
-  string cert = 3;
-
-  // The volt CA chain. This is used by the client in subsequent API calls to secure the connection.
-  string chain = 4;
-
-  // The bind decision.
-  PolicyDecision decision = 5;
-
-  // Reserved for internal use.
-  int64 request_time = 6;
-
-  // Reserved for internal use.
-  int64 decision_time = 7;
-}
-
 message CanAccessResourceRequest {
   oneof subject {
     // The subject of the access request.
@@ -303,10 +237,7 @@ message CanAccessResourceResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 
   // The identity subject that the access relates to.
-  string identity_id = 2;
-
-  // Optional identity that issued the access.
-  string issuer_id = 3;
+  string identity_did = 2;
 
   // The resource the access relates to.
   string resource_id = 4;
@@ -333,79 +264,63 @@ message CheckCompatibilityResponse {
 
 // All fields in this message are optional, send an empty message if necessary.
 message ConnectHello {
-  // Optionally specify the calling address of the peer.
-  // Not currently in use.
+  // Optionally specify the grpc server address of the client. Only used if the client is a Volt (or service).
   string address = 1;
 
   // Set to automatically make **all** services owned by the calling identity online.
-  bool online_services = 2;
+  bool online_services = 3;
 
   // Set to receive notification of resource events.
-  bool subscribe_resource_events = 3;
+  bool subscribe_resource_events = 4;
 
-  // Set this to support Relayed service invocation.
-  // This indicates that the callee is happy to receive method invocations from other clients of the Relay.
-  // Currently this will usually be set to the `id` of the calling Volt, but in theory any client could receive remote invocation requests in this way.
-  string relay_id = 4;
+  // Set this if you are connecting to a relay, i.e. the Volt you are sending to this message is a relay.
+  // This indicates that you are happy to receive method invocations from clients of the Relay.
+  // This will usually be set to the `id` of your Volt, but in theory any client could receive remote invocation requests in this way.
+  string relay_id = 5;
 
   // A friendly name to present to Relay clients.
-  string relay_name = 5;
+  string relay_name = 6;
+
+  string relay_description = 7;
 
   // The certificate authority to present to Relay clients.
-  string relay_ca_pem = 6;
+  string relay_ca_pem = 8;
 
   // Set to indicate the connection is discoverable to other Relay clients.
-  bool relay_discoverable = 7;
+  bool relay_discoverable = 9;
+
+  // Optionally specify the address of the HTTP server to use for HTTP proxying. If set, a relay will forward HTTP requests to this address from the subdomain that matches the client's DID.
+  string relay_http_address = 10;
 
   // Set to receive notification of authentication requests.
-  bool subscribe_auth_requests = 8;
+  bool subscribe_auth_requests = 11;
+
+  // Set to indicate the connection will accept method invocation requests.
+  bool accept_invocation = 12;
 
-  bool accept_invocation = 9;
+  // Set to subscribe to DID registry updates from the peer.
+  bool subscribe_did_registry_updates = 13;
 
-  bool subscribe_did_registry_updates = 10;
+  // The interval at which the client will send ping requests to the target.
+  uint32 ping_interval = 14;
+
+  // The current time on the client.
+  uint64 timestamp = 15;
 }
 
 message ConnectAcknowledge {
+  // A unique identifier for this connection.
   string connection_id = 1;
-}
 
-// A connection ping message.
-message ConnectPing {
-  // The time on the originating server.
-  uint64 timestamp = 1;
-}
-
-// Reserved for internal use.
-enum ConnectMessageType {
-  CONNECT_MESSAGE_TYPE_UNKNOWN = 0;
-  CONNECT_MESSAGE_TYPE_ORIGINAL = 1;
-  CONNECT_MESSAGE_TYPE_ECHO = 2;
-  CONNECT_MESSAGE_TYPE_FORWARD = 3;
-}
+  // The current time on the Volt.
+  uint64 timestamp = 2;
 
-// Reserved for internal use.
-enum ConnectMessageRelay {
-  CONNECT_MESSAGE_RELAY_UNKNOWN = 0;
-  CONNECT_MESSAGE_RELAY_OUTGOING = 1;
-  CONNECT_MESSAGE_RELAY_INCOMING = 2;
+  // The interval at which the target will send ping requests to the client.
+  uint32 ping_interval = 3;
 }
 
-// This message is reserved for internal use.
-message ConnectMessage {
-  string id = 1;
-  string thread_id = 2;
-  string to_id = 3;
-  string to_identity_id = 4;
-  string to_name = 5;
-  string message = 6;
-  uint64 timestamp = 7;
-  string from_id = 8;
-  string from_identity_id = 9;
-  string from_name = 10;
-
-  repeated string receipt = 11;
-  ConnectMessageType message_type = 12;
-  ConnectMessageRelay message_relay = 13;
+// A connection ping message - intentionally empty.
+message ConnectPing {
 }
 
 message ConnectGoodbye {
@@ -455,11 +370,13 @@ message ConnectDIDRegistryUpdate {
 
 message ConnectEvent {
   oneof event {
+    // An authentication request event.
     ConnectAuthRequest connect_auth_request = 1;
 
     // A resource event notification, such as updated or deleted.
     ConnectResource connect_resource = 2;
 
+    // A DID registry entry update.
     ConnectDIDRegistryUpdate did_registry_update = 3;
   }
 }
@@ -473,9 +390,6 @@ message ConnectRequest {
     // Indicates the client is closing the connection.
     ConnectGoodbye goodbye = 2;
 
-    // Reserved for internal use.
-    ConnectMessage msg = 3;
-
     // Clients should periodically send ping requests to the target to confirm the stream is still live.
     ConnectPing ping = 4;
 
@@ -504,9 +418,6 @@ message ConnectResponse {
     // Notifies clients of various events on the Volt.
     ConnectEvent evt = 4;
 
-    // Reserved for internal use.
-    ConnectMessage msg = 5;
-
     // Periodic ping response.
     ConnectPing ping = 6;
 
@@ -548,15 +459,6 @@ message CopyResourceResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
-message CreateVerifiableCredentialSessionRequest {
-  string presentation = 1;
-}
-
-message CreateVerifiableCredentialSessionResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  string session_id = 2;
-}
-
 message DeleteAccessRequest {
   // The id of the access rule to delete.
   string id = 1;
@@ -595,8 +497,11 @@ message DiscoverServicesRequest {
   // Set to indicate that offline services should be included in the response.
   bool include_offline = 2;
 
+  // Set to include the service attributes in the response.
+  bool include_attributes = 3;
+
   // Set to include the service protobuf in the response.
-  bool include_protobuf = 3;
+  bool include_protobuf = 4;
 }
 
 message DiscoverServicesResponse {
@@ -612,10 +517,7 @@ message GetAccessRequest {
   string resource_id = 1;
 
   // The identity id that is the subject of the access rule. If omitted, all identities will be considered.
-  string identity_id = 2;
-
-  // The issuer of the access rule. If omitted, all issuers will be considered.
-  string issuer_id = 3;
+  string identity_did = 2;
 
   // The type of access to retrieve, if omitted all access will be considered.
   string access = 4;
@@ -632,22 +534,6 @@ message GetAccessResponse {
   repeated Access access = 2;
 }
 
-message GetBindingsRequest {
-  // The fingerprint of the binding subject. If omitted, all bindings are retrieved.
-  string fingerprint = 1;
-
-  // The decision of the binding. If omitted, all binding decisions are retrieved.
-  PolicyDecision decision = 2;
-}
-
-message GetBindingsResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The bindings that match the criteria.
-  repeated Binding binding = 2;
-}
-
 message GetIdentitiesRequest {
   // Optional name of the identity.
   // Use '*' to perform a wildcard search.
@@ -666,11 +552,11 @@ message GetIdentitiesResponse {
   repeated Identity identity = 2;
 }
 
-// One of `identity_id` or `fingerprint` must be populated.
+// One of `identity_did` or `fingerprint` must be populated.
 message GetIdentityRequest {
   oneof lookup {
     // The id of the identity to retrieve.
-    string identity_id = 1;
+    string identity_did = 1;
     // The public key fingerprint of the identity to retrieve.
     string fingerprint = 2;
   }
@@ -684,17 +570,16 @@ message GetIdentityResponse {
   Identity identity = 2;
 }
 
-message GetIdentityTokenRequest {
-  // The token TTL, in seconds.
+message GetOneTimeTokenRequest {
+  // Optional token TTL, in seconds. Default is 10 seconds.
   int32 ttl = 1;
-
-  // The intended token audience - usually the common name of the target volt
-  // CA.
-  string audience = 2;
 }
 
-message GetIdentityTokenResponse {
+message GetOneTimeTokenResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The one-time token.
   string token = 2;
 }
 
@@ -728,8 +613,11 @@ message GetResourceRequest {
   // The id of the resource to retrieve.
   string resource_id = 1;
 
+  // Set to include the resource attributes in the response.
+  bool include_attributes = 2;
+
   // Set to include service description protobuf in the response, if applicable.
-  bool include_protobuf = 2;
+  bool include_protobuf = 3;
 }
 
 message GetResourceResponse {
@@ -769,14 +657,22 @@ message GetResourcesRequest {
   bool combine_terms_exclusive = 9;
 
   // Attributes to search by.
-  // n.b. currently this API is mutually exclusive in that if any attribute queries are specified the rpc will only search on those attributes, ignoring any parameters defined above.
   repeated ResourceAttributeQuery attribute = 10;
 
   // If set, will return resources where *any of* the attribute queries apply, otherwise will only return resources where *all of* the attribute queries apply.
   bool any_of = 11;
 
+  // Set to include the resource attributes in the response.
+  bool include_attributes = 12;
+
   // Set to include service description protobuf in the response where applicable.
-  bool include_protobuf = 12;
+  bool include_protobuf = 13;
+
+  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
+  uint64 modified_since = 14;
+
+  // Limit the number of resources returned. Default is 0, which means all resources will be returned.
+  uint32 limit = 15;
 }
 
 message GetResourcesResponse {
@@ -802,6 +698,12 @@ message GetResourceAncestorsRequest {
 
   // Optional - can be used to determine if a resource is an ancestor.
   string ancestor_id = 5;
+
+  // Set to include the service attributes in the response.
+  bool include_attributes = 6;
+
+  // Set to include the service protobuf in the response.
+  bool include_protobuf = 7;
 }
 
 message GetResourceAncestorsResponse {
@@ -834,6 +736,15 @@ message GetResourceDescendantsRequest {
 
   // Restrict to a specific named resource.
   string name = 7;
+
+  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
+  uint64 modified_since = 8;
+
+  // Set to include the service attributes in the response.
+  bool include_attributes = 9;
+
+  // Set to include the service protobuf in the response.
+  bool include_protobuf = 10;
 }
 
 message GetResourceDescendantsResponse {
@@ -844,66 +755,87 @@ message GetResourceDescendantsResponse {
   repeated Resource descendant = 2;
 }
 
-message GetSessionRequest {
+message GetSessionsRequest {
   string id = 1;
 
-  string identity_id = 2;
+  string identity_did = 2;
+
+  string identity_name = 3;
+
+  SessionStatus status = 4;
 }
 
-message GetSessionResponse {
+message GetSessionsResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
   repeated Session session = 2;
 }
 
+message InvokeRequestKeyExchange {
+  bytes nonce = 1;
+
+  bytes encryption_key = 2;
+
+  bytes signature = 3;
+}
+
 message InvokeRequest {
   // Client-assigned identifier for the request. Will be used to match responses and any subsequent requests.
   uint64 invoke_id = 1;
 
-  // The client token to use for the invocation.
-  // This contains the key and iv used to encrypt the payload, which only the token audience can access because the key and iv are themselves encrypted using the public key of the invocation target.
+  // Optional client token to use for the invocation. This is for use by the websocket proxy and is only necessary on the first request of the rpc.
   string token = 2;
 
-  // The DID of the target identity hosting the service.
+  // The DID of the target at each hop of the path to the service.
   // This is used by Relays to route the request.
-  repeated string target_did = 3;
+  repeated string target_did = 4;
 
+  // The initialisation vector for the request payload encryption. This should be a random 16 byte value, that is different for each request.
+  bytes iv = 5;
+
+  // One of the following payloads will be present in a given InvokeRequest message.
   oneof request_payload {
     // A serialised and encrypted instance of `RemoteResponse` in pure binary format.
-    bytes payload = 4;
+    bytes payload = 6;
 
     // A serialised and encrypted instance of `RemoteResponse` as serialised JSON.
-    string json_payload = 5;
+    bytes json_payload = 7;
   }
 
   // Indicates the client has ended the invocation.
-  bool client_end = 6;
+  bool client_end = 8;
 
   // Reserved for internal use.
-  uint32 hop_index = 7;
+  uint32 hop_index = 9;
 
   // Reserved for internal use.
-  string target_service_id = 8;
+  string target_service_id = 10;
 }
 
 message InvokeResponse {
   // The invocation id to match the originating request.
   uint64 invoke_id = 1;
 
+  InvokeRequestKeyExchange key_exchange = 2;
+
+  // The initialisation vector for the response payload encryption. This will be a random 16 byte value, that is different for each response.
+  bytes iv = 4;
+
+  // One of the following payloads will be present in a given InvokeResponse message.
   oneof response_payload {
     // A serialised and encrypted instance of `RemoteRequest` in pure binary format.
-    bytes payload = 2;
+    bytes payload = 5;
 
     // A serialised and encrypted instance of `RemoteRequest` as serialised JSON.
-    string json_payload = 3;
+    bytes json_payload = 6;
 
     // Details of any error that occurred on the call.
-    tdx.volt_api.volt.v1.Status status = 4;
+    tdx.volt_api.volt.v1.Status status = 7;
   }
 
   // Indicates the server has ended the invocation.
-  bool server_end = 5;
+  bool server_end = 8;
 }
 
 message MoveResourceRequest {
@@ -938,10 +870,7 @@ message RequestAccessResponse {
   string resource_id = 2;
 
   // The identity attempting access.
-  string identity_id = 3;
-
-  // The identity of the issuer of the access.
-  string issuer_id = 4;
+  string identity_did = 3;
 
   // Requested access.
   string access = 5;
@@ -975,27 +904,6 @@ message SaveAccessResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
-message SaveAuthenticationRequest {
-  string id = 1;
-
-  string identity_id = 2;
-
-  string identity_did = 3;
-
-  string public_key = 4;
-
-  string encrypt_key = 5;
-
-  string encrypt_iv = 6;
-
-  PolicyDecision decision = 7;
-}
-
-message SaveAuthenticationResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
 message SaveIdentityRequest {
   // Details of the identity to save.
   Identity identity = 1;
@@ -1124,19 +1032,6 @@ message SetAccessRequestDecisionResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
-message SetBindingDecisionRequest {
-  // The fingerprint of the bind request.
-  string fingerprint = 1;
-
-  // The policy decision to assign to the bind request.
-  PolicyDecision decision = 2;
-}
-
-message SetBindingDecisionResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
 // This message is emtpy.
 message ShutdownRequest {
 }