How to use these fields
This release-matched technical reference indexes the JSON-visible fields in the reviewed typed models. Start with the operational guide and API conventions. A model is not a public mutation schema: request structs, response records, protected plans and internal receipts serve different purposes. Submit only the fields supported by the exact endpoint/client; unknown fields are rejected. Internal sequence, signature, receipt, owner and generation values cannot be edited to grant authority.
Optional means a Go JSON field can be omitted when empty; it does not waive an endpoint prerequisite. Values containing credentials/secrets must use the protected write-only form, never logs, query strings or support screenshots. Current account ownership, grants, feature/licence state and capability still apply.
Envelope
| JSON field |
Type |
Presence |
version |
int |
Encoded by this model |
kind |
string |
Encoded by this model |
key_id |
string |
Encoded by this model |
payload |
string |
Encoded by this model |
signature |
string |
Encoded by this model |
TrustKey
| JSON field |
Type |
Presence |
id |
string |
Encoded by this model |
public_key |
string |
Encoded by this model |
Claims
| JSON field |
Type |
Presence |
version |
int |
Encoded by this model |
license_id |
string |
Encoded by this model |
installation_id |
string |
Encoded by this model |
machine_binding |
string |
Encoded by this model |
sequence |
uint64 |
Encoded by this model |
not_before |
int64 |
Encoded by this model |
expires_at |
int64 |
Encoded by this model |
features |
[]Feature |
Encoded by this model |
ClockRecovery
| JSON field |
Type |
Presence |
version |
int |
Encoded by this model |
grant_id |
string |
Encoded by this model |
installation_id |
string |
Encoded by this model |
machine_binding |
string |
Encoded by this model |
challenge |
string |
Encoded by this model |
high_water |
int64 |
Encoded by this model |
reset_to |
int64 |
Encoded by this model |
not_before |
int64 |
Encoded by this model |
expires_at |
int64 |
Encoded by this model |
RecoveryRequest
| JSON field |
Type |
Presence |
version |
int |
Encoded by this model |
installation_id |
string |
Encoded by this model |
machine_binding |
string |
Encoded by this model |
challenge |
string |
Encoded by this model |
high_water |
int64 |
Encoded by this model |
observed_time |
int64 |
Encoded by this model |
Status
| JSON field |
Type |
Presence |
version |
int |
Encoded by this model |
state |
string |
Encoded by this model |
license_id |
string |
Optional when empty |
installation_id |
string |
Encoded by this model |
sequence |
uint64 |
Optional when empty |
not_before |
int64 |
Optional when empty |
expires_at |
int64 |
Optional when empty |
features |
[]Feature |
Encoded by this model |
always_available |
[]string |
Encoded by this model |
activation_configured |
bool |
Encoded by this model |
clock_recovery_required |
bool |
Encoded by this model |
observed_at |
int64 |
Encoded by this model |
Signature
| JSON field |
Type |
Presence |
key_id |
string |
Encoded by this model |
signature |
string |
Encoded by this model |
Envelope
| JSON field |
Type |
Presence |
signed |
json.RawMessage |
Encoded by this model |
signatures |
[]Signature |
Encoded by this model |
Key
| JSON field |
Type |
Presence |
key_id |
string |
Encoded by this model |
public_key |
string |
Encoded by this model |
Root
| JSON field |
Type |
Presence |
version |
int |
Encoded by this model |
product |
string |
Encoded by this model |
sequence |
uint64 |
Encoded by this model |
issued_at |
time.Time |
Encoded by this model |
expires_at |
time.Time |
Encoded by this model |
keys |
[]Key |
Encoded by this model |
threshold |
uint16 |
Encoded by this model |
Target
| JSON field |
Type |
Presence |
os |
string |
Encoded by this model |
version |
string |
Encoded by this model |
architecture |
string |
Encoded by this model |
Artifact
| JSON field |
Type |
Presence |
path |
string |
Encoded by this model |
bytes |
uint64 |
Encoded by this model |
sha256 |
string |
Encoded by this model |
mode |
uint32 |
Encoded by this model |
Release
| JSON field |
Type |
Presence |
version |
int |
Encoded by this model |
product |
string |
Encoded by this model |
release |
string |
Encoded by this model |
sequence |
uint64 |
Encoded by this model |
root_sequence |
uint64 |
Encoded by this model |
issued_at |
time.Time |
Encoded by this model |
expires_at |
time.Time |
Encoded by this model |
target |
Target |
Encoded by this model |
minimum_current_sequence |
uint64 |
Encoded by this model |
schema_sha256 |
string |
Encoded by this model |
package_sha256 |
string |
Encoded by this model |
package_bytes |
uint64 |
Encoded by this model |
artifacts |
[]Artifact |
Encoded by this model |
Verify the actual endpoint
Read a harmless authorized resource and validate the returned API/model version before automation. For a write, use current revision or ETag, the endpoint-specific secret/preview contract and a stable reviewed idempotency key. Follow the durable task to its final state and inspect service evidence. Missing/unqualified native behavior remains a release limitation; a field name does not prove a live service or complete recovery.