Home / Trusted LTANS Platform / Microservice ownership MOBILE-ID · TRUSTED LTANS Microservice ownership Assign state and data ownership across services and identify dependencies and reconciliation controls.
VI–EN terminology
Nine logical groups, explicit ownership Archive Service Evidence Service Verification Service Renewal Service Policy Service Storage Service Trust Adapter Service Audit & Reporting Webhook Delivery Service Jobs and cross-service coordination API, adapter and Core boundaries Next steps Nine logical groups, explicit ownership Each group owns its domain decisions and data. API resources, request DTOs and job states are separate and do not determine deployment process counts.
Group Responsibility Objects/resources Request DTO Archive Service Intake, record location and export/transfer coordination. ArchiveObject, TransferPackage, Export resource ArchiveRequest, ExportRequest, TransferRequest Evidence Service Generate and publish immutable evidence revisions. EvidenceRecord, ArchiveTimeStamp history — Verification Service Evaluate context-bound inputs and retain step reports. VerificationReportVerificationRequestRenewal Service Renewal decisions and previous/next revision tracking. Renewal resource, Renewal decision RenewalRequestPolicy Service Versioned profiles, retention and holds. Policy, Profile, LegalHold, RetentionDecision HoldRequestStorage Service Storage access, custody and lifecycle effects. CustodyProfile, DispositionRecord DispositionRequestTrust Adapter Service Collect and check trust inputs. TrustContext, Trust source profile — Audit & Reporting Decision logs, projections and usage reconciliation. AuditRecord, UsageReport — Webhook Delivery Service Endpoint registration and outbound event delivery. Webhook, Delivery attempt (internal target) Webhook (schema reused for request/resource)
Target logical interactions; not an executed trace. Download SVG diagram Archive Service Intake, record location and export/transfer coordination.
Scope Content Logical store Record store and package inventory Objects / resources ArchiveObject, TransferPackage, Export resource Request DTO ArchiveRequest, ExportRequest, TransferRequest Shared structures Acknowledgement, Job, ResourceResult Target produced events ArchiveRequested, ArchiveAccepted, ArchiveRejected, ExportRequested, ExportCompleted, TransferStarted, TransferCompleted
Archive Service Boundary Group-specific design Dependencies Policy resolves profiles; Storage confirms custody; Evidence runs after intake. Consumed events / coordination ArchiveAccepted/EvidenceGenerated are proposed coordination inputs; concrete consumers need approval. Partial failure and recovery Metadata committed but outbox undelivered: reconcile outbox; never create a new record for the same command. Authorization and audit Enforce tenant/object rights at deposit, read, export and transfer acknowledgement.
Evidence Service Generate and publish immutable evidence revisions.
Scope Content Logical store Evidence revision store Objects / resources EvidenceRecord, ArchiveTimeStamp history Request DTO — Shared structures DigestTarget produced events EvidenceGenerationRequested, EvidenceGenerated, EvidenceGenerationFailed
API Application scope Documentation GET /v1/archives/{archiveId}/evidence evidence:read Evidence API GET /v1/archives/{archiveId}/evidence/{evidenceVersion} evidence:read Evidence API
Evidence Service Boundary Group-specific design Dependencies Storage supplies exact bytes; Trust Adapter validated tokens; Policy pins syntax. Consumed events / coordination EvidenceGenerationRequested is a proposed input; channel names do not establish deployed topology. Partial failure and recovery Token received but storage failed: retain TSA transaction identity and validate before publishing. Authorization and audit Only the owner publishes revisions; evidence-read permission does not imply content access.
Verification Service Evaluate context-bound inputs and retain step reports.
Scope Content Logical store Verification report store Objects / resources VerificationReportRequest DTO VerificationRequestShared structures Job, Problem Target produced events VerificationRequested, VerificationCompleted
API Application scope Documentation POST /v1/archives/{archiveId}/verification verification:write Verification API GET /v1/verifications/{verificationId} verification:read Verification API
Verification Service Boundary Group-specific design Dependencies Evidence supplies revision; Storage authorized bytes; Trust supplies context. Consumed events / coordination VerificationRequested is a proposed orchestration input; the report is the conclusion source. Partial failure and recovery Missing status data: report the unsupported step; separate execution errors from INDETERMINATE. Authorization and audit Authorize verification, content access and report reading separately within each tenant.
Renewal Service Renewal decisions and previous/next revision tracking.
Scope Content Logical store Renewal decision/schedule store Objects / resources Renewal resource, Renewal decision Request DTO RenewalRequestShared structures Job, Digest Target produced events RenewalDue, RenewalStarted, RenewalCompleted, RenewalFailed
API Application scope Documentation POST /v1/renewals renewals:write Renewal API GET /v1/renewals/{renewalId} renewals:read Renewal API
Renewal & Crypto-Agility Boundary Group-specific design Dependencies Policy supplies risk decisions; Evidence pins history; Storage ensures required reread access. Consumed events / coordination RenewalDue triggers assessment, not automatic approval. Partial failure and recovery Concurrent jobs on one source: recheck revision before publishing; byte-access loss blocks HASH_TREE and retains the old schedule. Authorization and audit Separate assessment, approval and execution under the profile; retain required approvalId.
Policy Service Versioned profiles, retention and holds.
Scope Content Logical store Policy and applied-snapshot store Objects / resources Policy, Profile, LegalHold, RetentionDecision Request DTO HoldRequestShared structures ResourceResultTarget produced events No dedicated published event in the current 19-event contract.
Policy Governance Boundary Group-specific design Dependencies Identity identifies approvers; Archive pins applied snapshots; Storage receives hold constraints. Consumed events / coordination No dedicated policy/hold event is published among the 19; internal coordination remains to be agreed. Partial failure and recovery Invalid configuration: retain old applied snapshots, stop new activation; rollback retains before/after decisions. Authorization and audit Separate author, approve and activate; policy-read APIs confer no write authority.
Storage Service Storage access, custody and lifecycle effects.
Scope Content Logical store Custody configuration and per-copy outcomes Objects / resources CustodyProfile, DispositionRecord Request DTO DispositionRequestShared structures JobTarget produced events DispositionRequested, DispositionApproved, DispositionCompleted
API Application scope Documentation POST /v1/archives/{archiveId}/dispositions disposition:write Archive API
Data Custody Boundary Group-specific design Dependencies Archive identifies objects; Policy supplies hold/retention; deployment KMS governs keys. Consumed events / coordination DispositionRequested/Approved are contracted events; rights and guards still apply before effects. Partial failure and recovery Partial disposition: retain per-copy checkpoints; a new hold blocks residual work without false completion. Authorization and audit Storage and key custodians have different rights; audit reads, exports and effects.
Trust Adapter Service Collect and check trust inputs.
Scope Content Logical store Versioned trust-input store Objects / resources TrustContext, Trust source profile Request DTO — Shared structures DigestTarget produced events No dedicated published event in the current 19-event contract.
No public administration API is exposed for this group in the current contract.
Trust Infrastructure Boundary Group-specific design Dependencies Depends on approved CA/TSA and OCSP/CRL sources; current responses cannot replace history. Consumed events / coordination No public source-change channel is defined; do not invent events. Partial failure and recovery Timeout: retain reconcilable dependency failure; fallback still checks imprint, policy and certificates. Authorization and audit Separate trust-source administration and key use; network policy constrains source URLs.
Audit & Reporting Decision logs, projections and usage reconciliation.
Scope Content Logical store Audit and projection stores Objects / resources AuditRecord, UsageReport Request DTO — Shared structures — Target produced events No dedicated published event in the current 19-event contract.
Management Reporting Boundary Group-specific design Dependencies Inputs are business decisions/jobs; reports are scoped rebuildable projections. Consumed events / coordination Consumers and metering basis require deployment agreement; replay must not increase totals. Partial failure and recovery Lagging projection: expose watermark/unreconciled scope; correct closed periods through revisions. Authorization and audit audit:read differs from billing:read; exclude cross-tenant data and tokens.
Webhook Delivery Service Endpoint registration and outbound event delivery.
Scope Content Logical store Endpoint, attempt and delivery-state store Objects / resources Webhook, Delivery attempt (internal target) Request DTO Webhook (schema reused for request/resource) Shared structures ProblemTarget produced events No dedicated published event in the current 19-event contract.
API Application scope Documentation POST /v1/webhooks webhooks:write Webhooks GET /v1/webhooks/{webhookId} webhooks:read Webhooks DELETE /v1/webhooks/{webhookId} webhooks:write Webhooks
Webhooks Boundary Group-specific design Dependencies Uses authorized events, endpoint configuration and signing keys; delivery is separate from business completion. Consumed events / coordination Webhook events select outbound delivery; this does not define internal subscriptions. Partial failure and recovery Destination fails: retain attempts/retry schedule; replay retains eventId with a new delivery attempt; consumers deduplicate. Authorization and audit Check HTTPS/SSRF/allowlist at registration and connection; exclude secrets from logs/UI.
Jobs and cross-service coordination GET /v1/jobs/{jobId} tracks execution; SUCCEEDED only means processing completed. Verification can still conclude INDETERMINATE.
Use a transactional outbox and context-aware deduplicating inbox. Concrete consumers require deployment configuration, not inference from the producer.
Event catalog · Asynchronous Jobs API, adapter and Core boundaries WSO2 GatewayGateway controls LTANS API ServicesBusiness grants / Jobs Core LTANS AdapterProtocol / profile / ID mapping Core LTANSProfile-driven engine
Keycloak issues tokens/identity rather than executing archive work on every request. Nine service groups include Webhook Delivery; adapter/infrastructure do not change the group count. Deployment determines topology.
Job resource
Transactions and events