Every REST request and WebSocket upgrade carries PRE-ACCESS-KEY, PRE-ACCESS-TIMESTAMP, and PRE-ACCESS-SIGNATURE. The signature is a Keyed BLAKE2b-256 over the seven-line canonical string defined by the contracts.
- Use current UTC time in RFC3339 format with milliseconds. The default allowed clock skew is five minutes.
- Sign the exact request URI that is sent, including the path and query string.
- Hash the exact request body bytes. Do not reserialize the body after calculating its digest.
- For a WebSocket upgrade, use
GET, an empty idempotency-key line, and the digest of an empty body. - Compute a new signature for every request or upgrade; never cache signatures.
Correlation-Idis optional on supported command endpoints. When supplied, it must be a lowercase UUIDv7.