{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/daon/main/json-schema/daon-user-appkey-schema.json",
  "title": "UserAppkey",
  "description": "A user appkey which is registered to an app on a device.\n\n**NOTE** The device information is only available if the `DEVICE_INFO` extension is enabled in the appkey registration policy.",
  "x-generated": "2026-10-18",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/daon-trustx-openapi.yml#/components/schemas/UserAppkey",
  "type": "object",
  "properties": {
    "permittedOperations": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "createdDtm": {
      "type": "string",
      "format": "date-time"
    },
    "lastUpdatedDtm": {
      "type": "string",
      "format": "date-time"
    },
    "id": {
      "type": "string",
      "description": "Unique 26-character database user ID."
    },
    "storeId": {
      "type": "string",
      "description": "Unique 26-character database store ID."
    },
    "userId": {
      "type": "string",
      "description": "Unique 26-character database user ID."
    },
    "relyingPartyId": {
      "type": "string",
      "description": "The relying party ID."
    },
    "regPolicyName": {
      "type": "string",
      "description": "The relying party's registration policy name."
    },
    "appId": {
      "type": "string",
      "description": "The appId set in the appkey configuration. If the configured appId is nullthen this value is the same as the facetId."
    },
    "keyId": {
      "type": "string",
      "description": "The ID of the appkey credential generated by the client authenticator."
    },
    "aaid": {
      "type": "string",
      "description": "Identifies the type of appkey authenticator."
    },
    "deviceId": {
      "type": "string",
      "description": "Identifies the device on which the appkey was generated."
    },
    "status": {
      "type": "string",
      "description": "The appkey status: ACTIVE or DISABLED.",
      "enum": [
        "ACTIVE",
        "DISABLED"
      ]
    },
    "algorithm": {
      "type": "string",
      "description": "The appkey signing algorithm",
      "enum": [
        "Secp256r1EcdsaSha256Raw",
        "Secp256r1EcdsaSha256Der",
        "RsaSsaPssSha256Raw",
        "RsaSsaPssSha256Der",
        "Secp256k1EcdsaSha256Raw",
        "Secp256k1EcdsaSha256Der",
        "Sm2Sm3Raw",
        "RsaEmsaPkcs1Sha256Raw",
        "RsaEmsaPkcs1Sha256Der"
      ]
    },
    "publicKeyFormat": {
      "type": "string",
      "description": "The appkey public key format",
      "enum": [
        "EccX962Raw",
        "EccX962Der",
        "Rsa2048PssRaw",
        "Rsa2048PssDer",
        "X509Cert"
      ]
    },
    "attestationType": {
      "type": "string",
      "description": "The appkey attestation type",
      "enum": [
        "FULL_BASIC",
        "SURROGATE_BASIC",
        "DIRECT_ANONYMOUS"
      ]
    },
    "regCounter": {
      "type": "integer",
      "format": "int64",
      "description": "The appkey registration counter. How many registrations have been performed by the authenticator."
    },
    "signCounter": {
      "type": "integer",
      "format": "int64",
      "description": "The appkey signature counter. How many authentications have been performed by the authenticator."
    },
    "internalId": {
      "type": "string"
    },
    "publicKey": {
      "type": "string",
      "format": "byte",
      "description": "The public key associated with the authenticator. Used to verify authenticator assertions."
    },
    "privateInfo": {
      "$ref": "#/$defs/PrivateInfo",
      "description": "Contains private info which is encrypted at rest. In this case the device information."
    },
    "lastUsedDtm": {
      "type": "string",
      "format": "date-time",
      "description": "If the key has been used for authentication this field indicates the last time this occurred"
    }
  },
  "required": [
    "aaid",
    "algorithm",
    "appId",
    "attestationType",
    "deviceId",
    "id",
    "keyId",
    "privateInfo",
    "publicKey",
    "publicKeyFormat",
    "regCounter",
    "regPolicyName",
    "relyingPartyId",
    "signCounter",
    "status",
    "storeId",
    "userId"
  ],
  "$defs": {
    "DeviceInfo": {
      "type": "object",
      "description": "Information extracted from the device where the appkey resides",
      "properties": {
        "appId": {
          "type": "string",
          "description": "Identifies the device app which owns the appkey"
        },
        "deviceId": {
          "type": "string",
          "description": "Identifies the device on which the app resides\n\n**NOTE** This identifier is not trustworthy and is not used. The `appId` is used throughout the system as the proxy device ID because it is always available."
        },
        "make": {
          "type": "string",
          "description": "The device make"
        },
        "model": {
          "type": "string",
          "description": "The device model"
        },
        "osVersion": {
          "type": "string",
          "description": "The device OS version"
        },
        "osType": {
          "type": "string",
          "description": "The device OS type, for example `android`"
        },
        "sdkVersion": {
          "type": "string",
          "description": "The device client SDK version"
        },
        "name": {
          "type": "string",
          "description": "The device friendly name"
        },
        "notificationToken": {
          "type": "string",
          "description": "A push notification token provided by the device"
        },
        "healthCheckPassed": {
          "type": "boolean",
          "description": "Whether the device health check passed\nOnly available if the `HEALTH_CHECK` extension is enabled in the appkey registration policy"
        },
        "environmentCheckResult": {
          "type": "string",
          "description": "The device environment. Possibly values:\n- **Passed**: App cannot be debugged and is not running in an emulator.\n- **Emulator**: App is running in an emulator.\n- **Debugger**: App can be debugged.\nOnly available if the `ENVIRONMENT_CHECK` extension is enabled in the appkey registration policy"
        }
      }
    },
    "PrivateInfo": {
      "type": "object",
      "properties": {
        "deviceInfo": {
          "$ref": "#/$defs/DeviceInfo"
        }
      }
    }
  }
}