API reference

Blinds

Credential custody, consent and delegation: hold secrets for agents and grant them narrowly, with an owner in the loop.

Operations: 17
Base path: https://os.one.ml/api/v1/blinds
Scopes: blinds:read blinds:write
API keys: 6 need a signed-in session · 11 not yet tested
SDK: genesis.call('blinds_listActivity', …) · helpers under genesis.blinds
CLI: genesis blinds
MCP: 17 tools

Operations

Operation	Endpoint	API key
Latest Blinds audit events	GET`/activity`	—
List consent decisions	GET`/consent`	—
Revoke a consent decision	DELETE`/consent/{consent_id}`	—
Approve a consent request	POST`/consent/{consent_id}/approve`	Signed-in session
Deny a consent request	POST`/consent/{consent_id}/deny`	Signed-in session
List pending consent requests	GET`/consent/pending`	—
List credential variable names	GET`/credentials`	—
Store a credential (connect a static key)	POST`/credentials`	—
Revoke one credential	DELETE`/credentials/{variable}`	—
List current delegations	GET`/delegates`	—
Delegate variables to an agent	POST`/delegates`	—
Revoke a delegation	DELETE`/delegates/{delegate_id}`	—
List active OAuth connections	GET`/oauth/connections`	—
Original human owner enrollment: attach	POST`/owner-enrollment/attach`	Signed-in session
Original human owner enrollment: p256-ensure	POST`/owner-enrollment/p256-ensure`	Signed-in session
Original human owner enrollment: reserve	POST`/owner-enrollment/reserve`	Signed-in session
Original human owner enrollment: sign	POST`/owner-enrollment/sign`	Signed-in session

Activity

Latest Blinds audit events

GET/v1/blinds/activity

blinds:readblinds_listActivity

Requires blinds:read (or blinds:write). Tenant comes only from the verified Genesis selection. The latest 200 events for the organization.

Responses

200Events
Response fields
- eventsobject[]required
- events[].[].event_idstring (uuid)required
- events[].[].occurred_atstring (date-time)required
- events[].[].kindstringrequired
- events[].[].actionstringrequired
- events[].[].resourcestring | null
- events[].[].outcomestring | null
- events[].[].subject_didstring | null
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/blinds/activity" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_listActivity')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_listActivity",
    "arguments": {}
  }
}

List consent decisions

GET/v1/blinds/consent

blinds:readblinds_listConsentRecords

Requires blinds:read (or blinds:write). Tenant comes only from the verified Genesis selection.

Responses

200Decisions
Response fields
- recordsobject[]required
- records[].[].consent_idstring (uuid)required
- records[].[].agent_didstringrequired
- records[].[].variablesstring[]required
- records[].[].destination_domainsstring[]
- records[].[].scopesstring[]
- records[].[].granted_bystring
- records[].[].status"approved" | "denied" | "revoked" | "expired"required
- records[].[].decided_atstring (date-time)required
- records[].[].expires_atstring | null (date-time)
- records[].[].revocableboolean
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/blinds/consent" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_listConsentRecords')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_listConsentRecords",
    "arguments": {}
  }
}

Revoke a consent decision

DELETE/v1/blinds/consent/{consent_id}

blinds:writeIdempotency-Key requiredblinds_revokeConsent

Requires blinds:write and a UUID Idempotency-Key. Tenant comes only from the verified Genesis selection.

Parameters

consent_idpath · string (uuid)required
Idempotency-Keyheader · string (uuid)required
Client UUID for this logical mutation. Reuse it after an uncertain outcome; the gateway never substitutes one.

Responses

200Revoked
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
404Refusal; error.code and x-request-id identify it
409Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl -X DELETE "https://os.one.ml/api/v1/blinds/consent/$CONSENT_ID" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('blinds_revokeConsent', {
  consent_id: '<consent_id>',
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_revokeConsent",
    "arguments": {
      "consent_id": "<consent_id>",
      "idempotency_key": "<a stable key per change>"
    }
  }
}

List pending consent requests

GET/v1/blinds/consent/pending

blinds:readblinds_listPendingConsent

Requires blinds:read (or blinds:write). Tenant comes only from the verified Genesis selection.

Responses

200Pending requests
Response fields
- requestsobject[]required
- requests[].[].consent_idstring (uuid)required
- requests[].[].agent_didstringrequired
- requests[].[].variablesstring[]required
- requests[].[].destination_domainsstring[]
- requests[].[].providersstring[]
- requests[].[].status"pending"required
- requests[].[].created_atstring (date-time)required
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/blinds/consent/pending" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_listPendingConsent')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_listPendingConsent",
    "arguments": {}
  }
}

Approve

Approve a consent request

POST/v1/blinds/consent/{consent_id}/approve

blinds:writeSigned-in sessionIdempotency-Key requiredblinds_approveConsent

Requires blinds:write and a UUID Idempotency-Key. Tenant comes only from the verified Genesis selection. Approval needs a verifiable One account signature; Blinds answers 403 until a cryptographic verifier is configured and never stores unverifiable evidence.

Parameters

consent_idpath · string (uuid)required
Idempotency-Keyheader · string (uuid)required
Client UUID for this logical mutation. Reuse it after an uncertain outcome; the gateway never substitutes one.

Request body application/json

signaturestringrequired
expires_in_secondsinteger

Responses

200Approved
400Refusal; error.code and x-request-id identify it
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
404Refusal; error.code and x-request-id identify it
409Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/blinds/consent/$CONSENT_ID/approve" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "signature": "string"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('blinds_approveConsent', {
  consent_id: '<consent_id>',
  body: {
    signature: 'string',
  },
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_approveConsent",
    "arguments": {
      "consent_id": "<consent_id>",
      "body": {
        "signature": "string"
      },
      "idempotency_key": "<a stable key per change>"
    }
  }
}

Deny

Deny a consent request

POST/v1/blinds/consent/{consent_id}/deny

blinds:writeSigned-in sessionIdempotency-Key requiredblinds_denyConsent

Requires blinds:write and a UUID Idempotency-Key. Tenant comes only from the verified Genesis selection.

Parameters

consent_idpath · string (uuid)required
Idempotency-Keyheader · string (uuid)required
Client UUID for this logical mutation. Reuse it after an uncertain outcome; the gateway never substitutes one.

Responses

200Denied
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
404Refusal; error.code and x-request-id identify it
409Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/blinds/consent/$CONSENT_ID/deny" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('blinds_denyConsent', {
  consent_id: '<consent_id>',
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_denyConsent",
    "arguments": {
      "consent_id": "<consent_id>",
      "idempotency_key": "<a stable key per change>"
    }
  }
}

Credentials

List credential variable names

GET/v1/blinds/credentials

blinds:readblinds_listCredentials

Requires blinds:read (or blinds:write). Tenant comes only from the verified Genesis selection. Names only; values are never returned.

Responses

200Variable names
Response fields
- credentialsstring[]required
  Variable names only. Values never leave Blinds.
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/blinds/credentials" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_listCredentials')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_listCredentials",
    "arguments": {}
  }
}

Store a credential (connect a static key)

POST/v1/blinds/credentials

blinds:writeIdempotency-Key requiredblinds_storeCredential

Requires blinds:write and a UUID Idempotency-Key. Tenant comes only from the verified Genesis selection. The value is KMS-encrypted and is never returned.

Parameters

Idempotency-Keyheader · string (uuid)required
Client UUID for this logical mutation. Reuse it after an uncertain outcome; the gateway never substitutes one.

Request body application/json

variable_namestringrequired
valuestringrequired
Encrypted with KMS on arrival; never returned or logged.
credential_typestringrequired
destination_domainsstring[]
providerstring
descriptionstring

Responses

201Stored
Response fields
- variable_namestringrequired
400Refusal; error.code and x-request-id identify it
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
409Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/blinds/credentials" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "variable_name": "string",
    "value": "string",
    "credential_type": "string"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('blinds_storeCredential', {
  body: {
    variable_name: 'string',
    value: 'string',
    credential_type: 'string',
  },
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_storeCredential",
    "arguments": {
      "body": {
        "variable_name": "string",
        "value": "string",
        "credential_type": "string"
      },
      "idempotency_key": "<a stable key per change>"
    }
  }
}

Revoke one credential

DELETE/v1/blinds/credentials/{variable}

blinds:writeIdempotency-Key requiredblinds_deleteCredential

Requires blinds:write and a UUID Idempotency-Key. Tenant comes only from the verified Genesis selection.

Parameters

variablepath · stringrequired
Idempotency-Keyheader · string (uuid)required
Client UUID for this logical mutation. Reuse it after an uncertain outcome; the gateway never substitutes one.

Responses

200Revoked
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
404Refusal; error.code and x-request-id identify it
409Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl -X DELETE "https://os.one.ml/api/v1/blinds/credentials/$VARIABLE" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('blinds_deleteCredential', {
  variable: '<variable>',
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_deleteCredential",
    "arguments": {
      "variable": "<variable>",
      "idempotency_key": "<a stable key per change>"
    }
  }
}

Delegates

List current delegations

GET/v1/blinds/delegates

blinds:readblinds_listDelegates

Requires blinds:read (or blinds:write). Tenant comes only from the verified Genesis selection. Non-revoked, unexpired grants: which agents hold which variables.

Responses

200Delegations
Response fields
- delegatesobject[]required
- delegates[].[].delegate_idstring (uuid)required
- delegates[].[].parent_idstring | null (uuid)
- delegates[].[].namestringrequired
- delegates[].[].issuer_didstringrequired
- delegates[].[].delegated_variablesstring[]required
- delegates[].[].max_depthinteger
- delegates[].[].current_depthinteger
- delegates[].[].ttl_secondsinteger
- delegates[].[].created_atstring (date-time)
- delegates[].[].expires_atstring (date-time)required
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/blinds/delegates" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_listDelegates')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_listDelegates",
    "arguments": {}
  }
}

Delegate variables to an agent

POST/v1/blinds/delegates

blinds:writeIdempotency-Key requiredblinds_createDelegate

Requires blinds:write and a UUID Idempotency-Key. Tenant comes only from the verified Genesis selection.

Parameters

Idempotency-Keyheader · string (uuid)required
Client UUID for this logical mutation. Reuse it after an uncertain outcome; the gateway never substitutes one.

Request body application/json

namestringrequired
delegated_variablesstring[]required
max_depthinteger
default 1
ttl_secondsintegerrequired

Responses

201Delegation
Response fields
- delegate_idstring (uuid)required
- parent_idstring | null (uuid)
- namestringrequired
- issuer_didstringrequired
- delegated_variablesstring[]required
- max_depthinteger
- current_depthinteger
- ttl_secondsinteger
- created_atstring (date-time)
- expires_atstring (date-time)required
400Refusal; error.code and x-request-id identify it
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
409Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/blinds/delegates" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "string",
    "delegated_variables": [],
    "ttl_seconds": 1
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('blinds_createDelegate', {
  body: {
    name: 'string',
    delegated_variables: [],
    ttl_seconds: 1,
  },
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_createDelegate",
    "arguments": {
      "body": {
        "name": "string",
        "delegated_variables": [],
        "ttl_seconds": 1
      },
      "idempotency_key": "<a stable key per change>"
    }
  }
}

Revoke a delegation

DELETE/v1/blinds/delegates/{delegate_id}

blinds:writeIdempotency-Key requiredblinds_revokeDelegate

Requires blinds:write and a UUID Idempotency-Key. Tenant comes only from the verified Genesis selection.

Parameters

delegate_idpath · string (uuid)required
Idempotency-Keyheader · string (uuid)required
Client UUID for this logical mutation. Reuse it after an uncertain outcome; the gateway never substitutes one.

Responses

200Revoked
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
404Refusal; error.code and x-request-id identify it
409Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl -X DELETE "https://os.one.ml/api/v1/blinds/delegates/$DELEGATE_ID" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('blinds_revokeDelegate', {
  delegate_id: '<delegate_id>',
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_revokeDelegate",
    "arguments": {
      "delegate_id": "<delegate_id>",
      "idempotency_key": "<a stable key per change>"
    }
  }
}

Oauth

List active OAuth connections

GET/v1/blinds/oauth/connections

blinds:readblinds_listOAuthConnections

Requires blinds:read (or blinds:write). Tenant comes only from the verified Genesis selection. Metadata only (provider, scopes, variable, created, active); tokens never leave Blinds. Connecting a provider is not admitted on Genesis.

Responses

200Active connections
Response fields
- connectionsobject[]required
- connections[].[].connection_idstring (uuid)required
- connections[].[].providerstringrequired
- connections[].[].variable_namestringrequired
- connections[].[].scopesstring[]required
- connections[].[].activebooleanrequired
- connections[].[].created_atstring (date-time)required
- totalintegerrequired
401Refusal; error.code and x-request-id identify it
403Refusal; error.code and x-request-id identify it
503Refusal; error.code and x-request-id identify it
504Refusal; error.code and x-request-id identify it
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/blinds/oauth/connections" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_listOAuthConnections')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_listOAuthConnections",
    "arguments": {}
  }
}

Owner enrollment

Original human owner enrollment: attach

POST/v1/blinds/owner-enrollment/attach

blinds:writeSigned-in sessionblinds_ownerAttach

A person's own signed-in One account session only. Gateway authenticates with Auth session; Blinds freshly authorizes IAM owner and generation. No agent, M2M, OBO, scope conversion, automatic retry, or arbitrary signing payload. Preserve the original operation and locators on explicit recovery.

Request body application/json

schemaVersion1required
requestIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
edReservationIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
enrollmentIntentIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

Responses

200Confirmed public metadata only
Response fields
- schemaVersion1required
- requestIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- edReservationIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- enrollmentIntentIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- state"attached"required
- creationobjectrequired
- creation.intent_idstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- creation.operation_idstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- creation.creation_receipt_idstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- creation.agent_idstringrequired
  min length 1 · max length 128
- creation.canonical_didstringrequired
  min length 1 · max length 256
- creation.registered_public_keystringrequired
  min length 1 · max length 128
- creation.ownerobjectrequired
- creation.owner.issuer"https://auth.life.one"required
- creation.owner.original_ownerstringrequired
  min length 1 · max length 36
- creation.owner.organization_generationintegerrequired
  min 1
- creation.owner.scopeobjectrequired
- creation.owner.scope.platform_id"blinds"required
- creation.owner.scope.organization_idstringrequired
  min length 1 · max length 34
- creation.owner.scope.workspace_idstring | nullrequired
- creation.owner.scope.project_idstring | nullrequired
- creation.owner.scope.environment_id"sandbox" | "live"required
400Sanitized refusal or unconfirmed outcome; no automatic replay
401Sanitized refusal or unconfirmed outcome; no automatic replay
409Sanitized refusal or unconfirmed outcome; no automatic replay
503Sanitized refusal or unconfirmed outcome; no automatic replay
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/blinds/owner-enrollment/attach" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "schemaVersion": 1,
    "requestId": "00000000-0000-4000-8000-000000000000",
    "edReservationId": "00000000-0000-4000-8000-000000000000",
    "enrollmentIntentId": "00000000-0000-4000-8000-000000000000"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_ownerAttach', {
  body: {
    schemaVersion: 1,
    requestId: '00000000-0000-4000-8000-000000000000',
    edReservationId: '00000000-0000-4000-8000-000000000000',
    enrollmentIntentId: '00000000-0000-4000-8000-000000000000',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_ownerAttach",
    "arguments": {
      "body": {
        "schemaVersion": 1,
        "requestId": "00000000-0000-4000-8000-000000000000",
        "edReservationId": "00000000-0000-4000-8000-000000000000",
        "enrollmentIntentId": "00000000-0000-4000-8000-000000000000"
      }
    }
  }
}

Original human owner enrollment: p256-ensure

POST/v1/blinds/owner-enrollment/p256-ensure

blinds:writeSigned-in sessionblinds_ownerP256Ensure

Request body application/json

schemaVersion1required
requestIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
edReservationIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
enrollmentIntentIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

Responses

200Confirmed public metadata only
Response fields
- schemaVersion1required
- requestIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- edReservationIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- enrollmentIntentIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- state"ready"required
- dpopPublicJwkobjectrequired
- dpopPublicJwk.kty"EC"required
- dpopPublicJwk.crv"P-256"required
- dpopPublicJwk.xstringrequired
  min length 1 · max length 43
- dpopPublicJwk.ystringrequired
  min length 1 · max length 43
- senderJktstringrequired
  min length 1 · max length 43
400Sanitized refusal or unconfirmed outcome; no automatic replay
401Sanitized refusal or unconfirmed outcome; no automatic replay
409Sanitized refusal or unconfirmed outcome; no automatic replay
503Sanitized refusal or unconfirmed outcome; no automatic replay
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/blinds/owner-enrollment/p256-ensure" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "schemaVersion": 1,
    "requestId": "00000000-0000-4000-8000-000000000000",
    "edReservationId": "00000000-0000-4000-8000-000000000000",
    "enrollmentIntentId": "00000000-0000-4000-8000-000000000000"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_ownerP256Ensure', {
  body: {
    schemaVersion: 1,
    requestId: '00000000-0000-4000-8000-000000000000',
    edReservationId: '00000000-0000-4000-8000-000000000000',
    enrollmentIntentId: '00000000-0000-4000-8000-000000000000',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_ownerP256Ensure",
    "arguments": {
      "body": {
        "schemaVersion": 1,
        "requestId": "00000000-0000-4000-8000-000000000000",
        "edReservationId": "00000000-0000-4000-8000-000000000000",
        "enrollmentIntentId": "00000000-0000-4000-8000-000000000000"
      }
    }
  }
}

Original human owner enrollment: reserve

POST/v1/blinds/owner-enrollment/reserve

blinds:writeSigned-in sessionblinds_ownerReserve

Request body application/json

schemaVersion1required
requestIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
operationIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
organizationIdstringrequired
pattern ^o_[A-Za-z0-9_]{1,32}$
scopeobjectrequired
scope.scopeKind"organization" | "hierarchy"required
scope.projectIdstring | nullrequired
pattern ^pr_[A-Za-z0-9_]{1,32}$
scope.workspaceIdstring | nullrequired
pattern ^w_[A-Za-z0-9_]{1,32}$
scope.environment"sandbox" | "live"required
displayNamestringrequired
Trimmed label; maximum 64 UTF-8 bytes. min length 1 · max length 64
kind"agent:instance"required

Responses

200Confirmed public metadata only
Response fields
- schemaVersion1required
- requestIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- edReservationIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- operationIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- publicKeystringrequired
  min length 1 · max length 128
- state"key_ready" | "attached"required
- expiresAtMsintegerrequired
- originalOrganizationGenerationintegerrequired
  min 1
400Sanitized refusal or unconfirmed outcome; no automatic replay
401Sanitized refusal or unconfirmed outcome; no automatic replay
409Sanitized refusal or unconfirmed outcome; no automatic replay
503Sanitized refusal or unconfirmed outcome; no automatic replay
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/blinds/owner-enrollment/reserve" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "schemaVersion": 1,
    "requestId": "00000000-0000-4000-8000-000000000000",
    "operationId": "00000000-0000-4000-8000-000000000000",
    "organizationId": "string",
    "scope": {
      "scopeKind": "organization",
      "projectId": "string",
      "workspaceId": "string",
      "environment": "sandbox"
    },
    "displayName": "string",
    "kind": "agent:instance"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_ownerReserve', {
  body: {
    schemaVersion: 1,
    requestId: '00000000-0000-4000-8000-000000000000',
    operationId: '00000000-0000-4000-8000-000000000000',
    organizationId: 'string',
    scope: {
      scopeKind: 'organization',
      projectId: 'string',
      workspaceId: 'string',
      environment: 'sandbox',
    },
    displayName: 'string',
    kind: 'agent:instance',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_ownerReserve",
    "arguments": {
      "body": {
        "schemaVersion": 1,
        "requestId": "00000000-0000-4000-8000-000000000000",
        "operationId": "00000000-0000-4000-8000-000000000000",
        "organizationId": "string",
        "scope": {
          "scopeKind": "organization",
          "projectId": "string",
          "workspaceId": "string",
          "environment": "sandbox"
        },
        "displayName": "string",
        "kind": "agent:instance"
      }
    }
  }
}

Original human owner enrollment: sign

POST/v1/blinds/owner-enrollment/sign

blinds:writeSigned-in sessionblinds_ownerSign

Request body application/json

schemaVersion1required
requestIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
edReservationIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
enrollmentIntentIdstring (uuid)required
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

Responses

200Confirmed public metadata only
Response fields
- schemaVersion1required
- requestIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- edReservationIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- enrollmentIntentIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- operationIdstring (uuid)required
  pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
- signingPayloadSha256stringrequired
  pattern ^[0-9a-f]{64}$
- signatureMultibasestringrequired
  min length 1 · max length 256
400Sanitized refusal or unconfirmed outcome; no automatic replay
401Sanitized refusal or unconfirmed outcome; no automatic replay
409Sanitized refusal or unconfirmed outcome; no automatic replay
503Sanitized refusal or unconfirmed outcome; no automatic replay
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/blinds/owner-enrollment/sign" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "schemaVersion": 1,
    "requestId": "00000000-0000-4000-8000-000000000000",
    "edReservationId": "00000000-0000-4000-8000-000000000000",
    "enrollmentIntentId": "00000000-0000-4000-8000-000000000000"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('blinds_ownerSign', {
  body: {
    schemaVersion: 1,
    requestId: '00000000-0000-4000-8000-000000000000',
    edReservationId: '00000000-0000-4000-8000-000000000000',
    enrollmentIntentId: '00000000-0000-4000-8000-000000000000',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "blinds_ownerSign",
    "arguments": {
      "body": {
        "schemaVersion": 1,
        "requestId": "00000000-0000-4000-8000-000000000000",
        "edReservationId": "00000000-0000-4000-8000-000000000000",
        "enrollmentIntentId": "00000000-0000-4000-8000-000000000000"
      }
    }
  }
}

One Superintelligence, Inc. · Built from Genesis 0.1.12 and the live gateway on 2026-10-20. Support