{"profiles":["iec-62443-3-2:2020","iec-62443-4-1:2018","iec-62443-4-2:2019","iso-iec-27001:2022"],"providers":["aws","azure","gcp","other","on-prem"],"workloads":["iot","vm","appliance","workstation","mobile"],"enrollmentPaths":[{"id":"qr","label":"Scan a QR code","type":"invite","grade":1,"method":"Open","endpoint":"https://enroll.intrikata.com/register/{region}/{tenant}","detail":"Scan the registrar’s private QR code on a phone or computer. Claim the invite to submit an application for review."},{"id":"browser","label":"Open an invite link","type":"invite","grade":1,"method":"Open","endpoint":"https://enroll.intrikata.com/register/{region}/{tenant}","detail":"Open the private link from your registrar and claim it in your browser. Use the device certificate later to activate."},{"id":"json","label":"HTTPS JSON","type":"invite","grade":1,"method":"POST","endpoint":"https://enroll.intrikata.com/v1/{region}/{tenant}/registration","body":"{ \"token\": \"<invitation token>\" }","detail":"Submit the invitation token from an automation client. Review and mTLS activation follow the claim."},{"id":"mtls","label":"Device certificate","type":"invite","grade":2,"method":"POST","endpoint":"https://trust.leapautomata.com/v1/{region}/{tenant}/registration","body":"{ \"token\": \"<invitation token>\" }","detail":"Send the token from the enrolled device over mTLS with the client certificate named by the registrar."},{"id":"es256","label":"P-256 enrollment proof","type":"invite","grade":3,"method":"POST","endpoint":"https://trust.leapautomata.com/v1/{region}/{tenant}/registration","body":"{ \"token\": \"<invitation token>\", \"proof\": \"<base64url ES256 signature>\" }","detail":"Present the device certificate and sign the invitation challenge with the P-256 key pinned by the registrar."},{"id":"bip340","label":"Zero-knowledge enrollment","type":"invite","grade":3,"method":"POST","endpoint":"https://trust.leapautomata.com/v1/{region}/{tenant}/registration","body":"{ \"token\": \"<invitation token>\", \"proof\": \"<128 hex characters>\" }","detail":"Present the device certificate and prove possession of the secret behind the registrar-pinned BIP340 commitment."},{"id":"manual","label":"Registrar submission","type":"operator","method":"POST","endpoint":"https://trust.leapautomata.com/v1/{region}/{tenant}/applications","detail":"Submit a device application from the operator console. Available for legacy tenants without managed device groups."},{"id":"peer-mtls","label":"Direct mTLS endorsement","type":"peer","method":"POST","endpoint":"https://trust.leapautomata.com/v1/{region}/{tenant}/peer-endorsements","detail":"Use a reviewer grant and an active same-zone validator. The devices bind the proof to their direct mTLS session."},{"id":"peer-relay","label":"Signed relay endorsement","type":"peer","method":"POST","endpoint":"https://trust.leapautomata.com/v1/{region}/{tenant}/peer-endorsements","detail":"Use a reviewer grant and a signed candidate proof when direct pairing is unavailable. A reviewer still approves admission."},{"id":"peer-admit","label":"Attested mTLS admission","type":"peer","method":"POST","endpoint":"https://trust.leapautomata.com/v1/{region}/{tenant}/peer-endorsements","detail":"Use direct mTLS, an active same-zone validator, and a fresh appraisal from a configured trusted-module verifier under a reviewer grant."}],"invitationInfo":"https://enroll.intrikata.com/v1/{region}/{tenant}/invitation-info","contactEnrollment":{"available":true,"entry":"https://enroll.intrikata.com/","verification":"email code","mobileNumber":"phone lookup sends to the uniquely matched email on file","requiresMtls":true},"enrollmentProof":{"grade":3,"algorithm":"ES256","key":"registrar-pinned P-256 public JWK","encoding":"base64url raw r||s","message":["leapautomata-enrollment-v1","{region}","{tenant}","{certificateSha256}","{inviteSha256}"]},"zeroKnowledgeEnrollment":{"grade":3,"algorithm":"BIP340","commitment":"onboarding.zkCommitment (32-byte x-only public key in hex)","proof":"64-byte Schnorr proof in hex","requiresMtls":true,"groupPolicy":"requireZeroKnowledge","transcript":["leapautomata-enrollment-bip340-v1","https://trust.leapautomata.com","{region}","{tenant}","{certificateSha256}","{inviteSha256}"]},"transports":[{"name":"https-mtls","grade":2,"endpoint":"https://trust.leapautomata.com/v1/{region}/{tenant}/registration"},{"name":"https-json","grade":1,"endpoint":"https://enroll.intrikata.com/v1/{region}/{tenant}/registration"},{"name":"https-browser","grade":1,"endpoint":"https://enroll.intrikata.com/register/{region}/{tenant}"}],"activation":{"requiresReview":true,"requiresMtls":true},"scopeOnboarding":{"manifest":"https://trust.leapautomata.com/v1/{region}/{tenant}/scopes","reconcile":"https://trust.leapautomata.com/v1/{region}/{tenant}/scope-reconciliation","suspension":"https://trust.leapautomata.com/v1/{region}/{tenant}/scope-suspension","hierarchy":["domain","trust","product","service","device group"],"validation":{"method":"DNS TXT","requireBothDomainAndService":true,"checkEverySeconds":60,"leaseSeconds":120,"minimumDeviceGrade":2}},"continuousValidation":{"snapshot":"https://trust.leapautomata.com/v1/{region}/{tenant}/peers","events":"https://trust.leapautomata.com/v1/{region}/{tenant}/peer-events","validatePeer":"https://trust.leapautomata.com/v1/{region}/{tenant}/peer-validation?peer={certificateSha256}"},"peerOnboarding":{"grants":"https://trust.leapautomata.com/v1/{region}/{tenant}/peer-delegations","cancel":"https://trust.leapautomata.com/v1/{region}/{tenant}/peer-delegation-cancellations","submit":"https://trust.leapautomata.com/v1/{region}/{tenant}/peer-endorsements","modes":["endorse","admit"],"transports":{"mtls-p2p":["endorse","admit"],"signed-relay":["endorse"]},"candidateKeys":["P-256","RSA-PSS"],"admissionRequires":["reviewer grant","active same-zone validator","fresh trusted module appraisal","candidate proof"],"selfReportedBit":"audit only"}}