MOBILE-ID · TRUSTED LTANS
Provisioning and byte transport
Provisioning checklist, byte intake, result retrieval and accountability before integration.
Required provisioning record
Use this record for discovery/sandbox provisioning. Every row needs an accountable confirmer and test. Contract example.invalid values are placeholders, not service addresses.
| Group | Required values | Owner | Confirmation test |
|---|---|---|---|
| apiOrigin / apiVersion | Provisioned HTTPS WSO2 origin and actual REST version. | API operations | Call an authorized test; verify server certificate. |
| issuer / tokenEndpoint / JWKS | Issuer, token endpoint, validation method and key cache/rotation. | IAM / Keycloak | Reject wrong issuer/audience/expired tokens. |
| clientId / credentialMethod | Backend client, secret or assertion delivered securely. | Application owner + IAM | No secrets in frontend/logs; least privilege. |
| audience / scopes / organization | API audience, operation scopes and authoritative organization mapping. | IAM + LTANS API Services | Correct scope but wrong organization still denied. |
| profileId / policyId / syntax | Provisioned Core profile, versioned business policy and evidence syntax. | Service owner + policy administrator | Reject unassigned or inactive profiles. |
| custody / ingestChannel / downloadChannel | Byte custodian, read/decrypt grants, uploadId/dataReference and download channel. | Data owner + storage | Read exact bytes; test expiry and digest mismatch. |
| securityProfile / coreTransport | Standard/Enhanced at gateway; internal mTLS/signing under Core configuration. | Security + integration | Standard clients do not bypass Core requirements. |
| limits / callbacks / support | Size/rate, polling, webhooks, contacts and support channel. | Service owner + customer | Limits need approved sources; sample numbers are not SLAs. |
Three byte transport paths
| Custody | Before POST /v1/archives | After evidence/export |
|---|---|---|
| PROVIDER_MANAGED | Use provisioned ingest connector, receive uploadId and reconcile digest. | Download through authorized/time-limited channel; check manifest and digests. |
| CUSTOMER_MANAGED / BYOS | Place bytes in customer storage; grant durable read/decrypt and an allowed dataReference. | Content and evidence may have different custodians; test revocation/restoration. |
| HASH_ONLY | Owner retains bytes, externalObjectId and source mapping; no implicit upload. | The service cannot recover bytes from a digest; HASH_TREE needs original bytes. |
Secret-free example configuration
{
"classification": "PROVISIONING_TEMPLATE_NOT_LIVE",
"apiOrigin": "https://api.example.invalid",
"issuer": "https://identity.example.invalid",
"tokenEndpoint": "<assigned-token-endpoint>",
"audience": "<assigned-api-audience>",
"clientId": "<assigned-backend-client>",
"securityProfile": "STANDARD_REQUIRES_CONFIRMATION",
"coreTransport": "<confirmed-internal-profile>",
"custody": "CUSTOMER_MANAGED",
"credentialDelivery": "secure out-of-band"
}