@tdxvolt/volt-client-grpc 0.18.3 → 0.18.4

package/protobuf/tdx/volt_api/volt/v1/volt_api.proto

@@ -1,1082 +0,0 @@
-syntax = "proto3";
-
-package tdx.volt_api.volt.v1;
-
-import "tdx/volt_api/volt/v1/status.proto";
-import "tdx/volt_api/volt/v1/remote.proto";
-import "tdx/volt_api/volt/v1/ssi.proto";
-import "tdx/volt_api/volt/v1/volt.proto";
-
-// The top-level volt management service. 
-// With the exception of `Authenticate`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
-// A client certificate can be obtained from the `Authenticate` method.
-// All methods include a `tdx.volt_api.volt.v1.Status` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
-service VoltAPI {
-  // Issues a request to authenticate on the volt.
-  // All clients must successfully authenticate in order to gain any kind of access.
-  // A client certificate is optional for this RPC, if omitted a JWT must be provided in the call metadata.
-  // If the client plans to register one or more services with the Volt, it should use the 'host' field of the request so that the returned certificate has the appropriate SAN extension in place. Note that if the client IP address changes it will be necessary to re-authenticate the client and obtain a new certificate.
-  // If the authenticate decision is 'permit', the response contains various details that should be persisted by the client, including the unique identifier assigned by the Volt and a signed client certificate along with the Volt CA certificate.
-  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse);
-
-  // Determine if an identity can perform a specific action on a resource.
-  // Third party services can use this to interrogate the Volt policy and determine if a client has permission to perform a certain action on a resource.
-  rpc CanAccessResource(CanAccessResourceRequest) returns (CanAccessResourceResponse);
-
-  rpc CheckCompatibility(CheckCompatibilityRequest) returns (CheckCompatibilityResponse);
-
-  // Creates a long-lived, bi-directional connection to the Volt.
-  // The connection stream serves several purposes, including remote invocations via a Relay, Volt event notifications, pings and service registration management.
-  // A connection stream is required in order for a client to be able to register services with the Volt.
-  // When the stream is closed, any services registered on it will be set to offline.
-  rpc Connect(stream ConnectRequest) returns (stream ConnectResponse);
-
-  // Copy a resource from one folder to another.
-  // The resource metadata, attributes and store are copied.
-  // The shares attributed to the resource are **not** currently copied.
-  // n.b. Copy resources between Volts is not supported by this API. This is achieved by creating an API instance for the source and target Volts, getting the resource from the source and creating it on the target.
-  rpc CopyResource(CopyResourceRequest) returns (CopyResourceResponse);
-
-  // Remove a custom access rule, such as a file share.
-  rpc DeleteAccess(DeleteAccessRequest) returns (DeleteAccessResponse);
-
-  // Delete a resource from this volt.
-  rpc DeleteResource(DeleteResourceRequest) returns (DeleteResourceResponse);
-
-  // Discover services running on this volt.
-  // Lookup is done via the exposed serviceAPI, e.g. tdx.volt_api.data.v1.SqliteServerAPI.
-  rpc DiscoverServices(DiscoverServicesRequest) returns (DiscoverServicesResponse);
-
-  // Get access rule details.
-  // Only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
-  // If the authenticated identity is the Volt root, all rules will be retrieved that match the criteria.
-  rpc GetAccess(GetAccessRequest) returns (GetAccessResponse);
-
-  // Retrieve identities matching the given criteria.
-  // Only identities that the authenticated identity has read access to will be retrieved.
-  rpc GetIdentities(GetIdentitiesRequest) returns (GetIdentitiesResponse);
-
-  // Get details of a specific identity.
-  // The identity will only be retrieved if the authenticated identity has read access to it.
-  rpc GetIdentity(GetIdentityRequest) returns (GetIdentityResponse);
-
-  // Gets a one-time token that can be used as a temporary authentication token, for example create an file download link that expires after a certain time.
-  rpc GetOneTimeToken(GetOneTimeTokenRequest) returns (GetOneTimeTokenResponse);
-
-  // Retrieve the Volt parameters.
-  // This is a privileged API call and requires Volt root access.
-  rpc GetParameters(GetParametersRequest) returns (GetParametersResponse);
-
-  // Retrieve the active Volt policy.
-  // This is a privileged API call and requires Volt root access.
-  rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);
-
-  // Get resource from this volt.
-  rpc GetResource(GetResourceRequest) returns (GetResourceResponse);
-
-  // Get resources from this volt.
-  rpc GetResources(GetResourcesRequest) returns (GetResourcesResponse);
-
-  // Get ancestors of a resource.
-  rpc GetResourceAncestors(GetResourceAncestorsRequest) returns (GetResourceAncestorsResponse);
-
-  // Get descendants of a resource.
-  rpc GetResourceDescendants(GetResourceDescendantsRequest) returns (GetResourceDescendantsResponse);
-
-  // Get sessions.
-  rpc GetSessions(GetSessionsRequest) returns (GetSessionsResponse);
-
-  // Invoke a method.
-  // This is primarily for use by Relay connections when proxying invocations.
-  rpc Invoke(stream InvokeRequest) returns (stream InvokeResponse);
-
-  // Move a resource from one folder to another.
-  rpc MoveResource(MoveResourceRequest) returns (MoveResourceResponse);
-
-  // Request access to a resource.
-  // The subject of the access is assumed to be the identity of the currently authenticated peer.
-  rpc RequestAccess(RequestAccessRequest) returns (RequestAccessResponse);
-
-  // Create or update an access rule.
-  rpc SaveAccess(SaveAccessRequest) returns (SaveAccessResponse);
-
-  // Create or update a static file HTTP server.
-  rpc SaveHttpFileServer(SaveResourceRequest) returns (SaveResourceResponse);
-
-  // Create or update an HTTP REST API server.
-  rpc SaveHttpApiServer(SaveResourceRequest) returns (SaveResourceResponse);
-
-  // Create or update an identity.
-  rpc SaveIdentity(SaveIdentityRequest) returns (SaveIdentityResponse);
-
-  // Create or update a mirrored link resource.
-  rpc SaveMirroredLink(SaveResourceRequest) returns (SaveResourceResponse);
-
-  // Update Volt parameters.
-  // This is a privileged call that requires Volt root access.
-  rpc SaveParameters(SaveParametersRequest) returns (SaveParametersResponse);
-
-  // Create or update resource in this volt.
-  rpc SaveResource(SaveResourceRequest) returns (SaveResourceResponse);
-
-  // Create or update a symbolic link resource.
-  rpc SaveSymbolicLink(SaveResourceRequest) returns (SaveResourceResponse);
-
-  // Save a session.
-  rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
-
-  // Set Volt access request decision.
-  // This is a privileged call that requires Volt root access.
-  rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
-
-  rpc SetPolicy(SetPolicyRequest) returns (SetPolicyResponse);
-
-  // Set the status of a Volt service.
-  rpc SetServiceStatus(SetServiceStatusRequest) returns (SetServiceStatusResponse);
-
-  // Used to shutdown remote Volts.
-  // This is a privileged call that requires Volt root access.
-  rpc Shutdown(ShutdownRequest) returns (ShutdownResponse);
-
-  // Sign or verify an arbitrary message using the Volt key.
-  rpc SignVerify(SignVerifyRequest) returns (SignVerifyResponse);
-}
-
-// Describes a request to authenticate on a Volt.
-// Present one of the `public_key`, `did_public_key`, `did`, or `did_document` fields.
-message AuthenticateRequest {
-
-  oneof client_identifier {
-    // The client public key in PEM format. The Volt will create a session that is bound to this public key.
-    string public_key = 1;
-
-    // The client public key - must be in PEM format. If the client DID is lost or unknown for some reason, providing the public key here will allow the Volt to match it with the previously registered DID.
-    // Note this is only valid when a DID has previously been registered using this public key.
-    string did_public_key = 2;
-
-    // An existing DID owned by the client.
-    // The JWT presented with the authenticate call must be signed by the private key corresponding to this DID.
-    string did = 3;
-
-    // If the client doesn't have an existing DID, a DID document can be provided here.
-    // The Volt will register the DID on behalf of the client.
-    // The JWT presented with the authenticate call must be signed by the private key corresponding to this document.
-    string did_document = 4;
-  }
-
-  // A base64-encoded signature of the DID document, only required if `did_document` is provided above.
-  string did_document_signature = 5;
-
-  // A human-readable name of the entity requesting to authenticate.
-  string client_name = 6;
-
-  // The volt challenge code, signed by the private key component of the `public_key` field above, and base64 encoded.
-  // This is optional.
-  string challenge = 7;
-
-  // The host name to add as a SAN to the issued certificate.
-  // This is optional, if you don't intend to host services with the certificate this can be omitted.
-  string host = 8;
-
-  // Optional verifiable credentials describing the client.
-  repeated VerifiablePresentation verifiable_presentation = 9;
-
-  // Reserved for internal use.
-  bool purge_aliases = 10;
-
-  // Optional additional name to differentiate between multiple sessions for a given client.
-  string session_name = 11;
-}
-
-message AuthenticateResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  string session_id = 2;
-
-  // The identity id assigned to this authentication.
-  string identity_did = 3;
-
-  // A certificate issued by the volt CA, binding the request public key to the identity.
-  // Only valid for PERMIT authenticate decisions.
-  string cert = 4;
-
-  // The volt CA chain. This is used by the client in subsequent API calls to secure the connection.
-  string chain = 5;
-
-  // The authenticate decision.
-  PolicyDecision decision = 6;
-
-  // Reserved for internal use.
-  int64 request_time = 7;
-
-  // Reserved for internal use.
-  int64 decision_time = 8;
-}
-
-message CanAccessResourceRequest {
-  oneof subject {
-    // The subject of the access request.
-    // This is optional, and if omitted will default to the authenticated account.
-    string token = 1;
-
-    // The subject of the access request.
-    // This is optional, and if omitted will default to the authenticated account.
-    string cert = 2;
-  }
-
-  // The resource in question.
-  string resource_id = 3;
-
-  // The type of access that is required.
-  string access = 4;
-}
-
-message CanAccessResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The identity subject that the access relates to.
-  string identity_did = 2;
-
-  // The resource the access relates to.
-  string resource_id = 4;
-
-  // The access type.
-  string access = 5;
-
-  // The policy decision for this access request.
-  PolicyDecision decision = 6;
-}
-
-message  CheckCompatibilityRequest {
-  // The client platform API version.
-  Version version = 1;
-}
-
-message CheckCompatibilityResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The target Volt API version.
-  Version version = 2;
-}
-
-// All fields in this message are optional, send an empty message if necessary.
-message ConnectHello {
-  // Optionally specify the grpc server address of the client. Only used if the client is a Volt (or service).
-  string address = 1;
-
-  // Set to automatically make **all** services owned by the calling identity online.
-  bool online_services = 3;
-
-  // Set to receive notification of resource events.
-  bool subscribe_resource_events = 4;
-
-  // Set this if you are connecting to a relay, i.e. the Volt you are sending to this message is a relay.
-  // This indicates that you are happy to receive method invocations from clients of the Relay.
-  // This will usually be set to the `id` of your Volt, but in theory any client could receive remote invocation requests in this way.
-  string relay_id = 5;
-
-  // A friendly name to present to Relay clients.
-  string relay_name = 6;
-
-  string relay_description = 7;
-
-  // The certificate authority to present to Relay clients.
-  string relay_ca_pem = 8;
-
-  // Set to indicate the connection is discoverable to other Relay clients.
-  bool relay_discoverable = 9;
-
-  // Optionally specify the address of the HTTP server to use for HTTP proxying. If set, a relay will forward HTTP requests to this address from the subdomain that matches the client's DID.
-  string relay_http_address = 10;
-
-  // Set to receive notification of authentication requests.
-  bool subscribe_auth_requests = 11;
-
-  // Set to indicate the connection will accept method invocation requests.
-  bool accept_invocation = 12;
-
-  // Set to subscribe to DID registry updates from the peer.
-  bool subscribe_did_registry_updates = 13;
-
-  // The interval at which the client will send ping requests to the target.
-  uint32 ping_interval = 14;
-
-  // The current time on the client.
-  uint64 timestamp = 15;
-
-  // Optionally specify the DID registries supported.
-  repeated string did_registry = 16;
-}
-
-message ConnectAcknowledge {
-  // A unique identifier for this connection.
-  string connection_id = 1;
-
-  // The current time on the Volt.
-  uint64 timestamp = 2;
-
-  // The interval at which the target will send ping requests to the client.
-  uint32 ping_interval = 3;
-}
-
-// A connection ping message - intentionally empty.
-message ConnectPing {
-}
-
-message ConnectGoodbye {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // Set if the connection was ended gracefully, as opposed to errored.
-  bool ended = 2;
-}
-
-message ConnectRelay {
-  // Indicates the Relay connection status.
-  bool connected = 1;
-}
-
-enum ConnectResourceEvent {
-  CONNECT_RESOURCE_EVENT_UNKNOWN = 0;
-  CONNECT_RESOURCE_EVENT_CREATE = 1;
-  CONNECT_RESOURCE_EVENT_UPDATE = 2;
-  CONNECT_RESOURCE_EVENT_DELETE = 3;
-  CONNECT_RESOURCE_EVENT_CREATE_CHILD = 4;
-  CONNECT_RESOURCE_EVENT_DELETE_CHILD = 5;
-  CONNECT_RESOURCE_EVENT_DATABASE_WRITE = 6;
-}
-
-message ConnectResource {
-  // The type of resource event that has occurred.
-  ConnectResourceEvent event = 1;
-
-  // Details of the resource.
-  Resource resource = 2;
-}
-
-message ConnectAuthRequest {
-  Session session = 1;
-
-  string context = 5;
-
-  string challenge = 6;
-
-  uint64 timestamp = 7;
-}
-
-message ConnectDIDRegistryUpdate {
-  DIDRegistryUpdate update = 1;
-}
-
-message ConnectEvent {
-  oneof event {
-    // An authentication request event.
-    ConnectAuthRequest connect_auth_request = 1;
-
-    // A resource event notification, such as updated or deleted.
-    ConnectResource connect_resource = 2;
-
-    // A DID registry entry update.
-    ConnectDIDRegistryUpdate did_registry_update = 3;
-  }
-}
-
-// One of the following payloads will be present in a given ConnectRequest message.
-message ConnectRequest {
-  oneof payload {
-    // A ConnectHello message is the first message a client sends to the target upon successfully starting the call.
-    ConnectHello hello = 1;
-
-    // Indicates the client is closing the connection.
-    ConnectGoodbye goodbye = 2;
-
-    // Clients should periodically send ping requests to the target to confirm the stream is still live.
-    ConnectPing ping = 4;
-
-    // Send invocation responses back to the caller.
-    // n.b. The 'request' and 'response' semantics are inverted with remote invocations because the Relayed connection is established by a request **from** the 'target' Volt to the Relay. Hence any invocation on behalf of a client of the Relay involves sending a **response** back down the Relay connection to the 'target' Volt.
-    InvokeResponse invoke_response = 5;
-
-    // Send HTTP response back to the originating request.
-    // n.b. The 'request' and 'response' semantics are inverted with HTTP proxying for the same reason as `invoke_response` above.
-    HttpResponse http_response = 6;
-  }
-}
-
-// One of the following payloads will be present in a given ConnectResponse message.
-message ConnectResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  oneof payload {
-    // Server response to initial handshake.
-    ConnectAcknowledge acknowledge = 2;
-
-    // Indicates the server is ending the connection.
-    ConnectGoodbye goodbye = 3;
-
-    // Notifies clients of various events on the Volt.
-    ConnectEvent evt = 4;
-
-    // Periodic ping response.
-    ConnectPing ping = 6;
-
-    // Send an invocation request to a remote target.
-    // n.b. The 'request' and 'response' semantics are inverted for remote invocations because the Relayed connection is established by a request **from** the 'target' Volt to the Relay. Hence any invocation on behalf of a client of the Relay involves sending a **response** back down the Relay connection to the 'target' Volt.
-    InvokeRequest invoke_request = 7;
-
-    // Send an HTTP request to a remote target.
-    // n.b. The 'request' and 'response' semantics are inverted for HTTP requests for the same reason as `invoke_request` above.
-    HttpRequest http_request = 8;
-  }
-}
-
-enum CopyResourceMode {
-  COPY_RESOURCE_MODE_UNKNOWN = 0;
-  COPY_RESOURCE_MODE_COPY = 1;
-  COPY_RESOURCE_MODE_LINK = 2;
-}
-
-message CopyResourceRequest {
-  // The id of the resource to copy.
-  string resource_id = 1;
-
-  // The id of the resource to receive the new copy.
-  string to_resource_id = 2;
-
-  // The copy mode to use.
-  CopyResourceMode mode = 3;
-
-  // Indicates if all descendants of the resource should be copied too. Only relevant for COPY_RESOURCE_MODE_COPY mode.
-  bool recursive = 4;
-
-  // The parent resource to link from, only relevant for COPY_RESOURCE_MODE_LINK mode.
-  string from_resource_id = 5;
-}
-
-message CopyResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-message DeleteAccessRequest {
-  // The id of the access rule to delete.
-  string id = 1;
-}
-
-message DeleteAccessResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-message DeleteResourceRequest {
-  // The resource to delete.
-  string resource_id = 1;
-
-  // Set to indicate all descendant resources should also be deleted.
-  // If this is not set and the resource has descendants, the call will fail.
-  bool recursive = 2;
-
-  // Set to attempt to unlink the resource from this parent resource, rather than completely delete it.
-  // The resource will be removed as a descendant from the `parent_id` resource. If the resource is has more than one parent, it will not be removed from those other parents.
-  // Note that if the resource's only parent is `parent_id` it will be removed from that parent and deleted as normal.
-  string parent_id = 3;
-}
-
-message DeleteResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-message DiscoverServicesRequest {
-  // List the service APIs that should be discovered.
-  // The response will include services that match **any of** the terms given.
-  // Use of '*' to indicate wildcards is supported.
-  repeated string service_api = 1;
-
-  // Set to indicate that offline services should be included in the response.
-  bool include_offline = 2;
-
-  // Set to include the service attributes in the response.
-  bool include_attributes = 3;
-
-  // Set to include the service protobuf in the response.
-  bool include_protobuf = 4;
-}
-
-message DiscoverServicesResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The services that were discovered.
-  repeated Resource resource = 2;
-}
-
-message GetAccessRequest {
-  // The resource id that is the target of the access rule. If omitted, all resources will be considered.
-  string resource_id = 1;
-
-  // The identity id that is the subject of the access rule. If omitted, all identities will be considered.
-  string identity_did = 2;
-
-  // The type of access to retrieve, if omitted all access will be considered.
-  string access = 4;
-
-  // The type of decision, if omitted all decisions will be considered.
-  PolicyDecision decision = 5;
-}
-
-message GetAccessResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The access rules that match the criteria.
-  repeated Access access = 2;
-}
-
-message GetIdentitiesRequest {
-  // Optional name of the identity.
-  // Use '*' to perform a wildcard search.
-  // If omitted all identities will be retrieved.
-  string name = 1;
-
-  // The identity alias criteria, if omitted all identities will be considered.
-  IdentityAlias alias = 2;
-}
-
-message GetIdentitiesResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The identity list that matched the criteria.
-  repeated Identity identity = 2;
-}
-
-// One of `identity_did` or `fingerprint` must be populated.
-message GetIdentityRequest {
-  oneof lookup {
-    // The id of the identity to retrieve.
-    string identity_did = 1;
-    // The public key fingerprint of the identity to retrieve.
-    string fingerprint = 2;
-  }
-}
-
-message GetIdentityResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The identity details.
-  Identity identity = 2;
-}
-
-message GetOneTimeTokenRequest {
-  // Optional token TTL, in seconds. Default is 10 seconds.
-  int32 ttl = 1;
-}
-
-message GetOneTimeTokenResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The one-time token.
-  string token = 2;
-}
-
-// This an empty message.
-message GetParametersRequest {
-}
-
-message GetParametersResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The retrieved Volt parameters.
-  VoltParameters parameters = 2;
-}
-
-// This an empty message.
-message GetPolicyRequest {
-  // Set to only retrieve the custom policy document.
-  bool custom_policy = 1;
-}
-
-message GetPolicyResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The live policy in JSON format.
-  string policy = 2;
-}
-
-message GetResourceRequest {
-  // The id of the resource to retrieve.
-  string resource_id = 1;
-
-  // Set to include the resource attributes in the response.
-  bool include_attributes = 2;
-
-  // Set to include service description protobuf in the response, if applicable.
-  bool include_protobuf = 3;
-}
-
-message GetResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The retrieved resource metadata.
-  Resource resource = 2;
-}
-
-// By default, the lookup is performed by combining the criteria below in the form:
-// (id = id[0] or id = id[1]) and (name = name[0] or name = name[1]) etc...
-// To combine using 'or' rather than 'and', set the `combine_terms_exclusive` flag.
-// Also see note below regarding attributes.
-message GetResourcesRequest {
-  repeated string id = 1;
-
-  // Wildcards permitted.
-  repeated string name = 2;
-
-  // Wildcards permitted.
-  repeated string description = 3;
-
-  // Wildcards permitted.
-  repeated string kind = 4;
-
-  repeated string parent_id = 5;
-
-  // Wildcards permitted.
-  repeated string service_api = 6;
-
-  repeated string owner = 7;
-
-  repeated string store = 8;
-
-  // Indicates that the above terms should be combined using 'or' rather than 'and' (the default).
-  bool combine_terms_exclusive = 9;
-
-  // Attributes to search by.
-  repeated ResourceAttributeQuery attribute = 10;
-
-  // If set, will return resources where *any of* the attribute queries apply, otherwise will only return resources where *all of* the attribute queries apply.
-  bool any_of = 11;
-
-  // Set to include the resource attributes in the response.
-  bool include_attributes = 12;
-
-  // Set to include service description protobuf in the response where applicable.
-  bool include_protobuf = 13;
-
-  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
-  uint64 modified_since = 14;
-
-  // Limit the number of resources returned. Default is 0, which means all resources will be returned.
-  uint32 limit = 15;
-}
-
-message GetResourcesResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The list of resources that match the lookup.
-  repeated Resource resource = 2;
-}
-
-message GetResourceAncestorsRequest {
-  // The resource id whose ancestors will be retrieved.
-  string resource_id = 1;
-
-  // Optional - if set the resource_id resource will be included in the set of resources returned.
-  bool include_resource_id = 2;
-
-  // Optional - restrict the depth search, e.g. for immediate parents depth = 1
-  int32 depth = 3;
-
-  // Optional - only match ancestors of the given kind.
-  string ancestor_kind = 4;
-
-  // Optional - can be used to determine if a resource is an ancestor.
-  string ancestor_id = 5;
-
-  // Set to include the service attributes in the response.
-  bool include_attributes = 6;
-
-  // Set to include the service protobuf in the response.
-  bool include_protobuf = 7;
-}
-
-message GetResourceAncestorsResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The retrieved ancestors.
-  repeated Resource ancestor = 2;
-}
-
-message GetResourceDescendantsRequest {
-  // The resource id whose descendants will be retrieved.
-  string resource_id = 1;
-
-  // Optional - if set, the fully populated `resource_id` resource (i.e. the parent) will be included in the set of resources returned.
-  bool include_resource_id = 2;
-
-  // Optional - restrict the depth search, e.g. for immediate children depth = 1
-  int32 depth = 3;
-
-  // Optional - only match descendants of the given kind.
-  // If multiple kinds are given, resources matching **any of** the kinds will be included.
-  repeated string descendant_kind = 4;
-
-  // Optional - can be used to determine if a resource is a descendant.
-  string descendant_id = 5;
-
-  // Optional - restrict to descendants of a given parent, for use in multi-parent hierarchies.
-  string parent_id = 6;
-
-  // Restrict to a specific named resource.
-  string name = 7;
-
-  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
-  uint64 modified_since = 8;
-
-  // Set to include the service attributes in the response.
-  bool include_attributes = 9;
-
-  // Set to include the service protobuf in the response.
-  bool include_protobuf = 10;
-}
-
-message GetResourceDescendantsResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The retrieved descendants.
-  repeated Resource descendant = 2;
-}
-
-message GetSessionsRequest {
-  string id = 1;
-
-  string identity_did = 2;
-
-  string identity_name = 3;
-
-  SessionStatus status = 4;
-}
-
-message GetSessionsResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  repeated Session session = 2;
-}
-
-message InvokeRequestKeyExchange {
-  bytes nonce = 1;
-
-  bytes encryption_key = 2;
-
-  bytes signature = 3;
-}
-
-message InvokeRequest {
-  // Client-assigned identifier for the request. Will be used to match responses and any subsequent requests.
-  uint64 invoke_id = 1;
-
-  // Optional client token to use for the invocation. This is for use by the websocket proxy and is only necessary on the first request of the rpc.
-  string token = 2;
-
-  // The DID of the target at each hop of the path to the service.
-  // This is used by Relays to route the request.
-  repeated string target_did = 4;
-
-  // The initialisation vector for the request payload encryption. This should be a random 16 byte value, that is different for each request.
-  bytes iv = 5;
-
-  // One of the following payloads will be present in a given InvokeRequest message.
-  oneof request_payload {
-    // A serialised and encrypted instance of `RemoteResponse` in pure binary format.
-    bytes payload = 6;
-
-    // A serialised and encrypted instance of `RemoteResponse` as serialised JSON.
-    bytes json_payload = 7;
-  }
-
-  // Indicates the client has ended the invocation.
-  bool client_end = 8;
-
-  // Reserved for internal use.
-  uint32 hop_index = 9;
-
-  // Reserved for internal use.
-  string target_service_id = 10;
-}
-
-message InvokeResponse {
-  // The invocation id to match the originating request.
-  uint64 invoke_id = 1;
-
-  InvokeRequestKeyExchange key_exchange = 2;
-
-  // The initialisation vector for the response payload encryption. This will be a random 16 byte value, that is different for each response.
-  bytes iv = 4;
-
-  // One of the following payloads will be present in a given InvokeResponse message.
-  oneof response_payload {
-    // A serialised and encrypted instance of `RemoteRequest` in pure binary format.
-    bytes payload = 5;
-
-    // A serialised and encrypted instance of `RemoteRequest` as serialised JSON.
-    bytes json_payload = 6;
-
-    // Details of any error that occurred on the call.
-    tdx.volt_api.volt.v1.Status status = 7;
-  }
-
-  // Indicates the server has ended the invocation.
-  bool server_end = 8;
-}
-
-message MoveResourceRequest {
-  // The id of the resource to move.
-  string resource_id = 1;
-
-  // The resource the parent folder to move the resource from.
-  string from_resource_id = 2;
-
-  // The target folder to move the resource into.
-  string to_resource_id = 3;
-}
-
-message MoveResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-message RequestAccessRequest {
-  // The target resource id.
-  string resource_id = 1;
-
-  // The type of access requested.
-  string access = 3;
-}
-
-message RequestAccessResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The resource being accessed.
-  string resource_id = 2;
-
-  // The identity attempting access.
-  string identity_did = 3;
-
-  // Requested access.
-  string access = 5;
-
-  // Assigned decision.
-  PolicyDecision decision = 6;
-
-  // Time at which the request was made.
-  int64 request_time = 7;
-
-  // Time at which the decision was taken.
-  int64 decision_time = 8;
-
-  // Counter of number times this access was requested.
-  int32 request_count = 9;
-}
-
-message ResourceAttributeQuery {
-  string attribute_id = 1;
-  AttributeDataType data_type = 2;
-  AttributeValue value = 3;
-}
-
-message SaveAccessRequest {
-  // Omit `id` if creating new access.
-  Access access = 1;
-}
-
-message SaveAccessResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-message SaveIdentityRequest {
-  // Details of the identity to save.
-  Identity identity = 1;
-
-  // Set to indicate this is a new identity.
-  bool create = 2;
-
-  // The list of aliases that should be removed.
-  // For example, this allows a simple form of key rotation whereby an existing public key alias is replaced by a new one while still maintaining the same root identity id.
-  repeated IdentityAlias delete_alias = 3;
-
-  // Reserved for system use.
-  string create_in_parent_id = 4;
-
-  // Set to indicate the identity aliases should be purged before saving the identity.
-  // If the `identity` field contains aliases they will be saved after the purge.
-  // If the `identity` field does not contain aliases this effectively deletes all aliases for this identity.
-  // This allows you to selectively update aliases if required, i.e. don't set this flag and include a single alias in the update.
-  bool purge_aliases = 5;
-
-  string did_document = 6;
-
-  // The signature of the identity did document, if present.
-  string did_update_signature = 7;
-}
-
-message SaveIdentityResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The updated identity details.
-  Identity identity = 2;
-}
-
-message SaveParametersRequest {
-  // The updated parameters.
-  VoltParameters parameters = 1;
-
-  // The current root key passphrase. Only necessary if changes are being made to the Volt key.
-  string key_passphrase = 2;
-
-  // The new root key passphrase. Only necessary if changes are being made to the Volt key.
-  string new_key_passphrase = 3;
-}
-
-message SaveParametersResponse {
-  // Details of any errors that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The updated Volt parameters.
-  VoltParameters parameters = 2;
-
-  // If set, the client will need to reconnect (usually because the key has changed).
-  bool reconnect = 3;
-}
-
-message SaveResourceRequest {
-  // Details of the resource to save.
-  Resource resource = 1;
-
-  // Set to indicate this is a new resource.
-  bool create = 2;
-
-  // The id of the folder resource in which a new resource should be created.
-  // If omitted, the home folder of the currently authenticated identity will be used.
-  string create_in_parent_id = 3;
-
-  // Set to indicate the resource attributes should be purged before saving the resource.
-  // If the `resource` field contains attributes they will be saved after the purge.
-  // If the `resource` field does not contain attributes this effectively deletes all attributes for this resource.
-  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
-  bool purge_attributes = 4;
-}
-
-message SaveResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The updated resource.
-  Resource resource = 2;
-}
-
-message SaveSessionRequest {
-  Session session = 1;
-}
-
-message SaveSessionResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  Session session = 2;
-}
-
-message SetPolicyRequest {
-  string custom_policy = 1;
-}
-
-message SetPolicyResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-message SetServiceStatusRequest {
-  // The service description details.
-  Resource service = 2;
-}
-
-message SetServiceStatusResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  // The updated service resource details.
-  Resource resource = 2;
-}
-
-message SetAccessRequestDecisionRequest {
-  // The id of the access request.
-  string id = 1;
-
-  // The decision to save against the access request.
-  PolicyDecision decision = 2;
-}
-
-message SetAccessRequestDecisionResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-// This message is emtpy.
-message ShutdownRequest {
-}
-
-message ShutdownResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-message SignVerifyRequest {
-  // Set to indicate this is a request to verify rather than sign.
-  bool verify = 1;
-
-  // Set to indicate the signature should be base64 encoded in the response.
-  // Only valid when signing.
-  bool encode = 2;
-
-  // The message to sign.
-  // Only valid when signing.
-  string message = 3;
-
-  oneof digest {
-    // The digest in raw binary form.
-    // Only valid if verifying.
-    bytes digest_raw = 4;
-
-    // The digest encoded using base64.
-    // Only valid if verifying.
-    string digest_encoded = 5;
-  }
-}
-
-// Note that if verification was successful the response will be empty (there is no error and no digest is returned).
-message SignVerifyResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-
-  oneof payload {
-    // The signature in raw binary form.
-    bytes digest = 2;
-
-    // The signature encoded using base64.
-    string digest_encoded = 3;
-  }
-}