{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/coincover/main/json-schema/coincover-key-generate-response-schema.json",
  "title": "KeyGenerateResponse",
  "x-generated": "2026-10-09",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_original/coincover-retail-openapi-openapi.json#/components/schemas/KeyGenerateResponse",
  "type": "object",
  "properties": {
    "key_id": {
      "type": "string",
      "format": "uuid",
      "description": "Unique identifier for the generated key (UUID)"
    },
    "public_key": {
      "type": "string",
      "description": "Public key in hexadecimal format"
    },
    "signature": {
      "type": "string",
      "description": "Base64 ECDSA P-256 DER signature. When sign_with is omitted, this signs the bare public_key hex; otherwise it signs signed_payload. Verify it against CoinCover's published JWKS, not with public_key."
    },
    "signed_payload": {
      "type": "string",
      "description": "RFC 8785 JCS-canonical JSON string signed by the enclave. Present only when sign_with was supplied. Verify its exact UTF-8 bytes without re-stringifying."
    },
    "signed_fields": {
      "type": "array",
      "description": "Validated context fields included in signed_payload, in request order. Does not include public_key. Present only when sign_with was supplied.",
      "items": {
        "type": "string",
        "enum": [
          "external_customer_id",
          "external_package_id",
          "pulled_by_id",
          "pulled_by_type",
          "user_id",
          "key_id",
          "key_fingerprint"
        ]
      }
    }
  },
  "required": [
    "key_id",
    "public_key",
    "signature"
  ]
}