manifest-catalog.json

{
  "$comment": "Maps each owned REST/API spec to its owning Gradle module and the product buckets it targets. specPath is a bare filename (flat single-folder repo). 'targets' lists the products whose documentation include the spec; when omitted the spec is included in all of [idk,edk,vdx]. It also supplies the default product-availability badge. 'division' is the spec's origin/authoring layer (label only, not a folder). 'targets' does not by itself gate runtime serving: the live /openapi console advertises the specs whose declared paths are actually mounted in a build (route-table introspection), so the catalog is consumed mainly by documentation aggregation and codegen. 'unbound' specs have no runtime owner and appear in documentation only.",
  "specs": [
    { "division": "idk", "domain": "kms",                "specPath": "kms-openapi.yml",                "ownerModule": "lib-crypto-kms-rest-api",            "targets": ["idk","edk","vdx"] },
    { "division": "idk", "domain": "did",                "specPath": "did-openapi.yml",                "ownerModule": "lib-did-rest-manager-api",           "targets": ["idk","edk","vdx"] },
    { "division": "idk", "domain": "did-hosting",        "specPath": "did-hosting-openapi.yml",        "ownerModule": "services-did-hosting-rest",          "targets": ["idk","edk","vdx"] },
    { "division": "idk", "domain": "oid4vp-dcql",        "specPath": "dcql-openapi.yml",               "ownerModule": "lib-openid-oid4vp-dcql-store-rest",  "targets": ["idk"] },
    { "division": "idk", "domain": "oid4vp-universal",   "specPath": "oid4vp-universal-openapi.yml",   "ownerModule": "lib-openid-oid4vp-verifier-rest",    "targets": ["idk"], "note": "EDK/VDX include these backend session endpoints via oid4vp-verifier-openapi.yaml ($ref), so the universal session spec is listed standalone only under IDK (mirrors oid4vci-issuer-session)." },
    { "division": "idk", "domain": "oid4vci-issuer-session", "specPath": "oid4vci-issuer-session-openapi.yml", "ownerModule": "services-oid4vci-issuer-rest",  "targets": ["idk"], "note": "EDK/VDX include these backend endpoints via oid4vci-issuer-openapi.yaml ($ref), so the session spec is listed standalone only under IDK." },
    { "division": "idk", "domain": "statuslist-hosting", "specPath": "statuslist-hosting-openapi.yml", "ownerModule": "services-statuslist-rest",           "targets": ["idk","edk","vdx"] },

    { "division": "edk", "domain": "semantic-model-authoring", "specPath": "semantic-model-authoring-openapi.yml", "ownerModule": "lib-semantic-model-authoring-rest", "targets": ["edk","vdx"], "licensedFeatures": ["semantic-attribute-binding"] },
    { "division": "edk", "domain": "statuslist-management",    "specPath": "statuslist-management-openapi.yml",    "ownerModule": "lib-statuslist-management-rest",    "targets": ["edk","vdx"] },
    { "division": "edk", "domain": "eidas-signature",         "specPath": "eidas-signature-openapi.yaml",         "ownerModule": "lib-eidas-signature-rest-api",      "targets": ["edk","vdx"] },
    { "division": "edk", "domain": "identity-auth",           "specPath": "identity-auth-openapi.yaml",           "ownerModule": "lib-identity-auth-rest",            "targets": ["edk","vdx"] },
    { "division": "edk", "domain": "platform-admin",          "specPath": "platform-admin-openapi.yaml",          "ownerModule": "services-application-rest",         "targets": ["edk","vdx"], "licensedFeatures": ["self-signup","federation"], "additionalOwnerModules": ["services-tenant-rest","services-oauth2-as-rest","service-tenant-owner-bootstrap"], "note": "Platform and tenant control surface (PlatformAdmin + Tenants/TenantSignup + TenantFederation + OwnerBootstrap). Served across multiple REST adapters; the broadest owner is recorded in ownerModule, the rest in additionalOwnerModules." },
    { "division": "edk", "domain": "platform-setup",          "specPath": "platform-setup-openapi.yaml",          "ownerModule": "vdx-service-setup-rest",            "targets": ["edk","vdx"], "additionalOwnerModules": ["lib-application-admin-service","lib-crypto-kms-rest-api"], "note": "Anonymous first-run setup surface under /api/platform/setup/v1. Delegates signed license request generation to KMS and license verify/install to application-admin services; the route disappears after the durable bootstrap gate closes." },
    { "division": "edk", "domain": "platform-bootstrap",      "specPath": "platform-bootstrap-openapi.yaml",      "ownerModule": "services-application-rest",         "targets": ["edk","vdx"], "additionalOwnerModules": ["lib-application-admin-service"], "note": "Browser-safe platform runtime bootstrap surface under /api/platform/bootstrap/v1. Exposes platform/auth/API wiring and capability flags only; business-authored credential designs, DCQL queries, issuer/verifier artifacts, operational records, and secrets remain in their dedicated APIs." },
    { "division": "edk", "domain": "application-bff-oauth-client", "specPath": "application-bff-oauth-client-openapi.yaml", "ownerModule": "services-application-rest", "targets": ["edk","vdx"], "additionalOwnerModules": ["lib-application-bff-oauth-client-service"], "note": "Workload-protected thin OAuth-client facade under /api/platform/internal/v1/bff/oauth-client. It holds BFF OAuth client state and is not an authorization-server session authority." },
    { "division": "edk", "domain": "platform-config",         "specPath": "platform-config-openapi.yaml",         "ownerModule": "services-tenant-rest",              "targets": ["edk","vdx"], "additionalOwnerModules": ["lib-platform-config-core","vdx-data-store-service-rest"], "note": "Service-instance configuration API for AS token/grant/feature settings, OAuth2 client registry management, and OID4VCI issuer/OID4VP verifier runtime configuration under /api/platform/config/v1." },
    { "division": "edk", "domain": "audit",                   "specPath": "audit-openapi.yml",                   "ownerModule": "vdx-lib-audit-server",              "targets": ["edk","vdx"], "additionalOwnerModules": ["vdx-lib-audit-persistence"], "note": "Dedicated audit query surface under /api/audit/v1. It exposes read-only audit records independently from platform-admin so deployments can authorize audit access with dedicated roles." },
    { "division": "edk", "domain": "trust-domain",            "specPath": "trust-domain-openapi.yaml",            "ownerModule": "lib-trust-domain-rest",             "targets": ["edk","vdx"], "additionalOwnerModules": ["lib-trust-domain-public","lib-trust-domain-service","lib-trust-domain-persistence-postgresql","lib-trust-domain-persistence-mysql","lib-trust-domain-persistence-sqlite"], "note": "Tenant-scoped trust-domain, trust-anchor, binding, and anchor-resolution API under /api/platform/admin/v1/trust. Used by EDK and VDX trust-establishment flows for X.509, ETSI, DID, OpenID Federation, issuer validation, verifier validation, and credential-specific trust domains." },
    { "division": "edk", "domain": "wallet-unit",             "specPath": "wallet-unit-openapi.yml",              "ownerModule": "vdx-service-wallet-unit-rest",       "targets": ["edk","vdx"], "additionalOwnerModules": ["lib-wallet-unit","lib-wallet-public","lib-statuslist-public","lib-statuslist-management-rest","lib-eidas-signature-rest-api"], "note": "Optional Wallet Unit backend under /api/wallet-unit/v1 for lifecycle, activation evidence, TS03 WIA/KA attestation, Wallet Provider/Solution trust evidence, status-list subjects, and policy-gated wallet-key signing. It does not enforce OID4VCI PAR/token/credential requests and does not implement reset, notification, or conformance reporting workflows." },
    { "division": "vdx", "domain": "theme",                   "specPath": "theme-openapi.yml",                    "ownerModule": "vdx-conf-theme-rest",                "targets": ["edk","vdx"], "additionalOwnerModules": ["vdx-conf-theme-public","vdx-conf-theme-impl","edk-theme-compose"], "note": "Tenant branding and theming API under /api/theme/v1: public theme/CSS/feature resolution, tenant and per-application brand administration, application registry, features and design element bindings, definitions, tokens, stylesheets, and palette/seed/cache operations." },
    { "division": "vdx", "domain": "wallet-entitlement",      "specPath": "wallet-entitlement-openapi.yml",       "ownerModule": "vdx-service-wallet-entitlement-rest", "targets": ["edk","vdx"], "additionalOwnerModules": ["vdx-service-wallet-entitlement-public","vdx-service-wallet-entitlement-impl"], "note": "Wallet feature entitlement admin and signed manifest API under /api/wallet-entitlement/v1 for tenant/org-unit/group/person feature resolution, license-ceiling intersection, and wallet-side manifest fetch." },
    { "division": "edk", "domain": "oid4vp-verifier",         "specPath": "oid4vp-verifier-openapi.yaml",         "ownerModule": "services-oid4vp-verifier-rest",     "targets": ["edk","vdx"] },
    { "division": "edk", "domain": "oid4vci-issuer",          "specPath": "oid4vci-issuer-openapi.yaml",          "ownerModule": "services-oid4vci-issuer-rest",      "targets": ["edk","vdx"] },
    { "division": "edk", "domain": "credential-design",       "specPath": "credential-design-openapi.yml",        "ownerModule": "lib-data-store-credential-design-rest", "targets": ["edk","vdx"] },
    { "division": "edk", "domain": "asset",                   "specPath": "asset-openapi.yml",                     "ownerModule": "lib-data-store-asset-rest",          "targets": ["edk","vdx"], "note": "Tenant asset library under /api/assets/v1 (namespace-scoped upload/list/get/delete with SHA-256 content addressing and per-tenant dedup) plus the public unversioned hosting mount /public/assets/{tenantId}/{namespace}/{asset}." },

    { "division": "vdx", "domain": "party-manager",     "specPath": "party-manager-openapi.yml",     "ownerModule": "data-store-party-api",     "targets": ["edk","vdx"] },
    { "division": "vdx", "domain": "license-portal",    "specPath": "license-portal-openapi.yaml",   "ownerModule": "vdx-service-license-portal", "targets": ["vdx"], "note": "Authenticated license issuer portal API under /api/license-portal/v1 for partners, customers, deployments, imported customer license requests, issuance, protected setup bundles, and license revocation." },
    { "division": "vdx", "domain": "identity-manager",  "specPath": "identity-manager-openapi.yaml",  "ownerModule": "vdx-data-store-identity-rest", "targets": ["vdx"], "note": "Identity and identity identifier management surface under /api/identity/v1." },
    { "division": "vdx", "domain": "resource-manager",  "specPath": "resource-manager-openapi.yml",  "ownerModule": "data-store-resource-api",  "targets": ["vdx"] },
    { "division": "vdx", "domain": "user-manager",      "specPath": "user-manager-openapi.yml",      "ownerModule": "data-store-user-api",      "targets": ["vdx"] },
    { "division": "vdx", "domain": "software-manager",  "specPath": "software-manager-openapi.yml",  "ownerModule": "data-store-service-api",   "targets": ["vdx"], "note": "Software and instance manager surface (generic ServiceInstances + typed AuthorizationServers/Oid4vciIssuers/Oid4vpVerifiers). Served by the VDX service-rest adapters (ServiceInstanceHttpAdapter, AuthorizationServerHttpAdapter, Oid4vciIssuerHttpAdapter, Oid4vpVerifierAdminHttpAdapter) under one base path /api/services/v1. Models are codegen'd by data-store-service-api from this single spec." },
    { "division": "vdx", "domain": "forms",             "specPath": "forms-openapi.yml",             "ownerModule": "data-store-forms-rest",    "targets": ["vdx"] },
    { "division": "vdx", "domain": "semantic-binding",  "specPath": "semantic-binding-openapi.yml",  "ownerModule": "data-store-semantic-binding-rest",    "targets": ["vdx"], "licensedFeatures": ["semantic-attribute-binding"] },
    { "division": "vdx", "domain": "semantic-vocabulary","specPath": "semantic-vocabulary-openapi.yml","ownerModule": "data-store-semantic-vocabulary-rest","targets": ["vdx"] },
    { "division": "vdx", "domain": "invitation",        "specPath": "invitation-openapi.yml",        "ownerModule": "service-invitation-rest",  "additionalOwnerModules": ["service-issuance-redemption-rest"], "targets": ["vdx"], "note": "One spec covering invitation management (authenticated, served by service-invitation-rest) plus the public recipient-facing redemption + IDV callback (served by service-issuance-redemption-rest). Both adapters mount under /api/invitation/v1." },
    { "division": "vdx", "domain": "email",             "specPath": "email-openapi.yaml",            "ownerModule": "service-email-rest",       "targets": ["vdx"] },
    { "division": "vdx", "domain": "oid4vp-dcql",        "specPath": "dcql-vdx-openapi.yml",           "ownerModule": "data-store-oid4vp-dcql-binding-rest", "targets": ["vdx"], "note": "Verify ownerModule project name (vdx/data/store/oid4vp-dcql-binding/rest)." }
  ],
  "unbound": [
    { "division": "idk", "domain": "blob-store",   "specPath": "blob-store-openapi.yml",       "ownerModule": null, "targets": ["idk","edk","vdx"], "note": "API-design-first canonical BlobStore surface under /api/blob-store/v1, aligned with the IDK BlobService contract. Runtime REST ownership remains unconfirmed until the adapter is implemented." },
    { "division": "idk", "domain": "vault",        "specPath": "vault-openapi.yml",            "ownerModule": null, "targets": ["idk","edk","vdx"], "note": "API-design-first canonical generic vault surface under /api/vault/v1, aligned with the IDK VaultService contract. Runtime REST ownership remains unconfirmed until the adapter is implemented." },
    { "division": "edk", "domain": "oid4vp-dcql",     "specPath": "dcql-edk-openapi.yml",            "ownerModule": null, "targets": ["edk"], "note": "EDK DCQL authoring/versioning layer ($ref-extends the idk dcql base). Runtime owner of authoring/versioning endpoints unconfirmed; documentation-only until wired." },
    { "division": "vdx", "domain": "connector",       "specPath": "connector-openapi.yml",           "ownerModule": null, "targets": ["vdx"], "note": "Greenfield API-design-first Connector Registry API under /api/connector/v1. Part of the platform service settings plan, intentionally separate from platform-config until runtime ownership is implemented." },
    { "division": "vdx", "domain": "connector-integration", "specPath": "connector-integration-openapi.yml", "ownerModule": null, "targets": ["vdx"], "note": "Curated external connector integration profile derived from the v1 Connector Registry API for third-party connector builders, SDK consumers, and low-code importers." },
    { "division": "edk", "domain": "oid4vci-issuance-template",  "specPath": "oid4vci-issuance-template-openapi.yml",  "ownerModule": null, "targets": ["edk","vdx"], "note": "Tenant-scoped reusable OID4VCI issuance templates under /api/oid4vci/v1 that store stable credential-offer settings and execute against the existing issuer-session credential-offer path. Bundled by admin-api-client codegen; runtime owner module unconfirmed until wired." },
    { "division": "edk", "domain": "oid4vp-verification-template", "specPath": "oid4vp-verification-template-openapi.yml", "ownerModule": null, "targets": ["edk","vdx"], "note": "Tenant-scoped reusable OID4VP verification templates under /api/oid4vp/v1 that store stable authorization-request settings and execute against the universal verifier-session create-authorization-request path. Bundled by admin-api-client codegen; runtime owner module unconfirmed until wired." }
  ],
  "componentBundles": [
    "common-components.yml",
    "blob-store-components.yml",
    "vault-components.yml",
    "kms-components.yml",
    "did-components.yml",
    "did-hosting-components.yml",
    "dcql-components.yml",
    "oid4vp-universal-components.yml",
    "oid4vci-issuer-session-components.yml",
    "statuslist-hosting-components.yml",
    "semantic-model-authoring-components.yml",
    "statuslist-management-components.yml",
    "eidas-signature-components.yml",
    "identity-auth-components.yml",
    "platform-admin-components.yml",
    "platform-bootstrap-components.yml",
    "platform-config-components.yml",
    "audit-components.yml",
    "trust-domain-components.yml",
    "wallet-unit-components.yml",
    "theme-components.yml",
    "wallet-entitlement-components.yml",
    "oid4vci-issuer-components.yml",
    "credential-design-components.yml",
    "asset-components.yml",
    "party-manager-components.yml",
    "identity-manager-components.yml",
    "connector-components.yml",
    "software-manager-components.yml",
    "resource-manager-components.yml",
    "user-manager-components.yml",
    "forms-components.yml",
    "semantic-binding-components.yml",
    "semantic-vocabulary-components.yml",
    "invitation-components.yml",
    "email-components.yml"
  ]
}