{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://openproofing.org/specifications/evidence-record.schema.json",
  "title": "Evidence record",
  "type": "object",
  "properties": {
    "version": {
      "description": "Format version of the record: `1.` followed by the minor version, such as `1.0`. A consumer of this specification accepts every `1.x` record. See section 9.",
      "type": "string",
      "pattern": "^1\\.(0|[1-9][0-9]*)$"
    },
    "id": {
      "description": "Identifier of this proofing, a random UUID. The device generates a new value for every record.",
      "type": "string",
      "format": "uuid"
    },
    "audience": {
      "description": "Registered identifier of the relying party the record was produced for.",
      "type": "string",
      "minLength": 1
    },
    "nonce": {
      "description": "The value the relying party issued when it started the proofing, returned unchanged so that the relying party can detect replay.",
      "type": "string",
      "minLength": 1
    },
    "issuedAt": {
      "description": "Time at which the device signed the record.",
      "type": "string",
      "format": "date-time"
    },
    "assurance": {
      "description": "The assurance level the relying party requested and whether the checks meet it.",
      "type": "object",
      "properties": {
        "target": {
          "description": "The identity assurance level the relying party requested: `IAL1` or `IAL2`.",
          "type": "string",
          "enum": [
            "IAL1",
            "IAL2"
          ]
        },
        "met": {
          "description": "`true` when the checks satisfy every step of NIST SP 800-63A-4 that the target level requires, otherwise `false`. The device computes this value; see section 6.",
          "type": "boolean"
        }
      },
      "required": [
        "target",
        "met"
      ],
      "additionalProperties": true
    },
    "checks": {
      "description": "One entry for each check that ran, as defined in section 4.2.",
      "type": "array",
      "items": {
        "$ref": "#/$defs/check"
      }
    },
    "attributes": {
      "description": "The attributes the relying party requested, as defined in section 4.6. Absent when it requested none.",
      "type": "object",
      "properties": {
        "givenName": {
          "description": "Given name or names.",
          "type": "object",
          "properties": {
            "value": {
              "description": "The value as the verifying checks read or confirmed it.",
              "type": "string",
              "minLength": 1
            },
            "verifiedBy": {
              "description": "The proofs whose checks in this record verified the value. Each MUST be a proof the table below allows for the attribute, with a check in `checks` whose outcome is `pass`.",
              "type": "array",
              "items": {
                "type": "string",
                "enum": [
                  "driversLicense",
                  "mdl",
                  "passportChip",
                  "chipClone",
                  "federalId",
                  "licenseRecord",
                  "passportRecord",
                  "ssn",
                  "bankAccount",
                  "liveness",
                  "faceMatch",
                  "phone",
                  "businessEntity"
                ]
              }
            }
          },
          "required": [
            "value",
            "verifiedBy"
          ],
          "additionalProperties": true
        },
        "familyName": {
          "description": "Family name.",
          "type": "object",
          "properties": {
            "value": {
              "description": "The value as the verifying checks read or confirmed it.",
              "type": "string",
              "minLength": 1
            },
            "verifiedBy": {
              "description": "The proofs whose checks in this record verified the value. Each MUST be a proof the table below allows for the attribute, with a check in `checks` whose outcome is `pass`.",
              "type": "array",
              "items": {
                "type": "string",
                "enum": [
                  "driversLicense",
                  "mdl",
                  "passportChip",
                  "chipClone",
                  "federalId",
                  "licenseRecord",
                  "passportRecord",
                  "ssn",
                  "bankAccount",
                  "liveness",
                  "faceMatch",
                  "phone",
                  "businessEntity"
                ]
              }
            }
          },
          "required": [
            "value",
            "verifiedBy"
          ],
          "additionalProperties": true
        },
        "birthDate": {
          "description": "Date of birth, as `YYYY-MM-DD`.",
          "type": "object",
          "properties": {
            "value": {
              "description": "The value as the verifying checks read or confirmed it.",
              "type": "string",
              "minLength": 1
            },
            "verifiedBy": {
              "description": "The proofs whose checks in this record verified the value. Each MUST be a proof the table below allows for the attribute, with a check in `checks` whose outcome is `pass`.",
              "type": "array",
              "items": {
                "type": "string",
                "enum": [
                  "driversLicense",
                  "mdl",
                  "passportChip",
                  "chipClone",
                  "federalId",
                  "licenseRecord",
                  "passportRecord",
                  "ssn",
                  "bankAccount",
                  "liveness",
                  "faceMatch",
                  "phone",
                  "businessEntity"
                ]
              }
            }
          },
          "required": [
            "value",
            "verifiedBy"
          ],
          "additionalProperties": true
        },
        "address": {
          "description": "Residential address, on one line.",
          "type": "object",
          "properties": {
            "value": {
              "description": "The value as the verifying checks read or confirmed it.",
              "type": "string",
              "minLength": 1
            },
            "verifiedBy": {
              "description": "The proofs whose checks in this record verified the value. Each MUST be a proof the table below allows for the attribute, with a check in `checks` whose outcome is `pass`.",
              "type": "array",
              "items": {
                "type": "string",
                "enum": [
                  "driversLicense",
                  "mdl",
                  "passportChip",
                  "chipClone",
                  "federalId",
                  "licenseRecord",
                  "passportRecord",
                  "ssn",
                  "bankAccount",
                  "liveness",
                  "faceMatch",
                  "phone",
                  "businessEntity"
                ]
              }
            }
          },
          "required": [
            "value",
            "verifiedBy"
          ],
          "additionalProperties": true
        },
        "documentNumber": {
          "description": "Number of the identity document that was checked.",
          "type": "object",
          "properties": {
            "value": {
              "description": "The value as the verifying checks read or confirmed it.",
              "type": "string",
              "minLength": 1
            },
            "verifiedBy": {
              "description": "The proofs whose checks in this record verified the value. Each MUST be a proof the table below allows for the attribute, with a check in `checks` whose outcome is `pass`.",
              "type": "array",
              "items": {
                "type": "string",
                "enum": [
                  "driversLicense",
                  "mdl",
                  "passportChip",
                  "chipClone",
                  "federalId",
                  "licenseRecord",
                  "passportRecord",
                  "ssn",
                  "bankAccount",
                  "liveness",
                  "faceMatch",
                  "phone",
                  "businessEntity"
                ]
              }
            }
          },
          "required": [
            "value",
            "verifiedBy"
          ],
          "additionalProperties": true
        },
        "documentIssuer": {
          "description": "Issuer of that document: an ISO 3166-2 subdivision code such as `US-IL` for a state, or an ISO 3166-1 alpha-3 code for a country.",
          "type": "object",
          "properties": {
            "value": {
              "description": "The value as the verifying checks read or confirmed it.",
              "type": "string",
              "minLength": 1
            },
            "verifiedBy": {
              "description": "The proofs whose checks in this record verified the value. Each MUST be a proof the table below allows for the attribute, with a check in `checks` whose outcome is `pass`.",
              "type": "array",
              "items": {
                "type": "string",
                "enum": [
                  "driversLicense",
                  "mdl",
                  "passportChip",
                  "chipClone",
                  "federalId",
                  "licenseRecord",
                  "passportRecord",
                  "ssn",
                  "bankAccount",
                  "liveness",
                  "faceMatch",
                  "phone",
                  "businessEntity"
                ]
              }
            }
          },
          "required": [
            "value",
            "verifiedBy"
          ],
          "additionalProperties": true
        },
        "phoneNumber": {
          "description": "Phone number, in E.164 form.",
          "type": "object",
          "properties": {
            "value": {
              "description": "The value as the verifying checks read or confirmed it.",
              "type": "string",
              "minLength": 1
            },
            "verifiedBy": {
              "description": "The proofs whose checks in this record verified the value. Each MUST be a proof the table below allows for the attribute, with a check in `checks` whose outcome is `pass`.",
              "type": "array",
              "items": {
                "type": "string",
                "enum": [
                  "driversLicense",
                  "mdl",
                  "passportChip",
                  "chipClone",
                  "federalId",
                  "licenseRecord",
                  "passportRecord",
                  "ssn",
                  "bankAccount",
                  "liveness",
                  "faceMatch",
                  "phone",
                  "businessEntity"
                ]
              }
            }
          },
          "required": [
            "value",
            "verifiedBy"
          ],
          "additionalProperties": true
        }
      },
      "required": [],
      "additionalProperties": true
    },
    "recovery": {
      "description": "Present when the device issued the record from the recovery vault instead of from a new proofing. See section 8.5.",
      "type": "object",
      "properties": {
        "proofedAt": {
          "description": "Time of the original proofing whose evidence the vault restored.",
          "type": "string",
          "format": "date-time"
        }
      },
      "required": [
        "proofedAt"
      ],
      "additionalProperties": true
    },
    "device": {
      "description": "The device that produced and signed the record.",
      "type": "object",
      "properties": {
        "platform": {
          "description": "The device platform: `ios` or `android`.",
          "type": "string",
          "enum": [
            "ios",
            "android"
          ]
        },
        "attestation": {
          "description": "Platform attestation binding the signing key to a genuine device running the unmodified app.",
          "type": "object",
          "properties": {
            "format": {
              "description": "`apple-app-attest` for Apple App Attest, `android-key-attestation` for Android Key Attestation.",
              "type": "string",
              "enum": [
                "apple-app-attest",
                "android-key-attestation"
              ]
            },
            "statement": {
              "description": "The App Attest attestation object or the Android key attestation certificate chain, base64url-encoded.",
              "type": "string",
              "minLength": 1
            }
          },
          "required": [
            "format",
            "statement"
          ],
          "additionalProperties": true
        },
        "keyId": {
          "description": "JWK Thumbprint (RFC 7638) of the signing key's public key, computed with SHA-256 and base64url-encoded.",
          "type": "string",
          "pattern": "^[A-Za-z0-9_-]{43}$"
        }
      },
      "required": [
        "platform",
        "attestation",
        "keyId"
      ],
      "additionalProperties": true
    }
  },
  "required": [
    "version",
    "id",
    "audience",
    "nonce",
    "issuedAt",
    "assurance",
    "checks",
    "device"
  ],
  "additionalProperties": true,
  "$defs": {
    "check": {
      "type": "object",
      "properties": {
        "proof": {
          "description": "Identifier of the proof that ran. Allowed values are listed in section 4.5.",
          "type": "string",
          "enum": [
            "driversLicense",
            "mdl",
            "passportChip",
            "chipClone",
            "federalId",
            "licenseRecord",
            "passportRecord",
            "ssn",
            "bankAccount",
            "liveness",
            "faceMatch",
            "phone",
            "businessEntity"
          ]
        },
        "step": {
          "description": "The step the proof belongs to. Allowed values are listed in section 4.4.",
          "type": "string",
          "enum": [
            "evidence",
            "attributes",
            "verification",
            "fraud",
            "other"
          ]
        },
        "outcome": {
          "description": "Result of the check. Allowed values are listed in section 4.3.",
          "type": "string",
          "enum": [
            "pass",
            "fail",
            "unavailable"
          ]
        },
        "source": {
          "description": "The specification, certificate or registry that produced the outcome, as text.",
          "type": "string",
          "minLength": 1
        },
        "checkedAt": {
          "description": "Time at which the outcome was produced.",
          "type": "string",
          "format": "date-time"
        },
        "registryResponse": {
          "description": "Present when a registry produced the outcome through the Foundation's router: the router's signed response, a JWS in the JWS Compact Serialization. Its payload carries `proof`, `outcome`, and the record's `nonce` and `audience` (as `nonce` and `aud`), which bind the response to this record.",
          "type": "string",
          "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$"
        }
      },
      "required": [
        "proof",
        "step",
        "outcome",
        "source",
        "checkedAt"
      ],
      "additionalProperties": true,
      "anyOf": [
        {
          "properties": {
            "step": {
              "const": "evidence"
            },
            "proof": {
              "enum": [
                "driversLicense",
                "mdl",
                "passportChip",
                "chipClone",
                "federalId"
              ]
            }
          }
        },
        {
          "properties": {
            "step": {
              "const": "attributes"
            },
            "proof": {
              "enum": [
                "licenseRecord",
                "passportRecord",
                "ssn",
                "bankAccount"
              ]
            }
          }
        },
        {
          "properties": {
            "step": {
              "const": "verification"
            },
            "proof": {
              "enum": [
                "liveness",
                "faceMatch"
              ]
            }
          }
        },
        {
          "properties": {
            "step": {
              "const": "fraud"
            },
            "proof": {
              "enum": [
                "phone"
              ]
            }
          }
        },
        {
          "properties": {
            "step": {
              "const": "other"
            },
            "proof": {
              "enum": [
                "businessEntity"
              ]
            }
          }
        }
      ]
    }
  }
}