{
  "openapi": "3.1.0",
  "info": {
    "title": "zettabit services and optional domain checks",
    "version": "1.1.0",
    "description": "Private quotes for business communications. Amounts are issued by the merchant. Payment requires actual buyer approval. No provider changes or messages are authorized by a request or payment."
  },
  "servers": [
    {
      "url": "https://zettabit.ai"
    }
  ],
  "paths": {
    "/api/quote/challenge": {
      "post": {
        "operationId": "quoteChallenge",
        "summary": "Get a one-use challenge for a service quote",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ServiceChallenge"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Challenge"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": []
      }
    },
    "/api/quote/request": {
      "post": {
        "operationId": "requestQuote",
        "summary": "Request a private service quote without a domain check",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ServiceRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/QuoteStatus"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": []
      }
    },
    "/api/checkout/status": {
      "post": {
        "operationId": "quoteStatus",
        "summary": "Read a private quote and reconcile an uncertain payment",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PrivateAccess"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/QuoteStatus"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": [
          {
            "QuoteCapability": []
          },
          {}
        ],
        "description": "Supply the private capability as Authorization: Bearer or in body.token. If both are present they must match. No client-supplied amount, currency or merchant is accepted."
      }
    },
    "/api/checkout/paypal": {
      "post": {
        "operationId": "beginPayment",
        "summary": "Create PayPal approval for an issued quote",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PrivateAccess"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Approval"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": [
          {
            "QuoteCapability": []
          },
          {}
        ],
        "description": "Supply the private capability as Authorization: Bearer or in body.token. If both are present they must match. No client-supplied amount, currency or merchant is accepted."
      }
    },
    "/api/checkout/complete": {
      "post": {
        "operationId": "confirmPayment",
        "summary": "Verify approval and confirm the exact quoted payment",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CompletePayment"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/QuoteStatus"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": [
          {
            "QuoteCapability": []
          },
          {}
        ],
        "description": "Supply the private capability as Authorization: Bearer or in body.token. If both are present they must match. No client-supplied amount, currency or merchant is accepted."
      }
    },
    "/api/challenge": {
      "post": {
        "operationId": "checkChallenge",
        "summary": "Get a one-use public-read challenge",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CheckScope"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Challenge"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": []
      }
    },
    "/api/authorize": {
      "post": {
        "operationId": "authorizeRead",
        "summary": "Bind the solved challenge to the exact read scope",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CheckAuthorization"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReadGrant"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": []
      }
    },
    "/api/check/start": {
      "post": {
        "operationId": "startCheck",
        "summary": "Start one bounded read independent of the browser connection",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CheckStart"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CheckJob"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": []
      }
    },
    "/api/check/status": {
      "post": {
        "operationId": "checkStatus",
        "summary": "Resume the same check after a refresh",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PrivateAccess"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CheckJob"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": [
          {
            "CheckCapability": []
          },
          {}
        ],
        "description": "Send the private check capability as Authorization: Bearer or body.token. This is not domain ownership or provider-change authority. Completed reports expire from server memory after ten minutes."
      }
    },
    "/api/check/cancel": {
      "post": {
        "operationId": "cancelCheck",
        "summary": "Cancel this exact check",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "description": "Send the API origin exactly. Browser requests set it automatically."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PrivateAccess"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Canonical state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CheckJob"
                }
              }
            }
          },
          "401": {
            "description": "Invalid private access",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Wrong origin or scope",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "422": {
            "description": "Invalid request or unavailable state",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit; observe Retry-After",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": [
          {
            "CheckCapability": []
          },
          {}
        ],
        "description": "Send the private check capability as Authorization: Bearer or body.token. This is not domain ownership or provider-change authority. Completed reports expire from server memory after ten minutes."
      }
    },
    "/api/capabilities": {
      "get": {
        "operationId": "capabilities",
        "summary": "Read the runtime capabilities before taking an action",
        "responses": {
          "200": {
            "description": "Current capability flags"
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "QuoteCapability": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "opaque 43-character quote capability"
      },
      "CheckCapability": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "opaque 43-character check capability"
      }
    },
    "schemas": {
      "Service": {
        "type": "string",
        "enum": [
          "mail",
          "phone",
          "forms",
          "workflows"
        ]
      },
      "Proof": {
        "type": "object",
        "required": [
          "id",
          "nonce"
        ],
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "nonce": {
            "type": "integer",
            "minimum": 0,
            "maximum": 2147483647
          }
        }
      },
      "Challenge": {
        "type": "object",
        "required": [
          "id",
          "salt",
          "difficulty",
          "expiresInSeconds"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "salt": {
            "type": "string"
          },
          "difficulty": {
            "type": "integer"
          },
          "expiresInSeconds": {
            "type": "integer"
          }
        }
      },
      "Contact": {
        "type": "object",
        "required": [
          "name",
          "email"
        ],
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "email": {
            "type": "string",
            "format": "email",
            "maxLength": 254
          },
          "note": {
            "type": "string",
            "maxLength": 1200
          }
        }
      },
      "QuoteStatus": {
        "type": "object",
        "required": [
          "schema",
          "id",
          "state",
          "request",
          "paymentEnabled",
          "quote",
          "receipt"
        ],
        "properties": {
          "schema": {
            "const": "zettabit.checkout.v1"
          },
          "id": {
            "type": "string"
          },
          "state": {
            "enum": [
              "draft",
              "requested",
              "quoted",
              "creating",
              "approval",
              "capturing",
              "paid",
              "uncertain"
            ]
          },
          "request": {
            "type": "object"
          },
          "quote": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/IssuedQuote"
              },
              {
                "type": "null"
              }
            ]
          },
          "paymentEnabled": {
            "type": "boolean"
          },
          "receipt": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/SettlementReceipt"
              },
              {
                "type": "null"
              }
            ]
          }
        }
      },
      "Error": {
        "type": "object",
        "required": [
          "error"
        ],
        "properties": {
          "error": {
            "type": "string"
          }
        }
      },
      "ServiceChallenge": {
        "type": "object",
        "required": [
          "service"
        ],
        "additionalProperties": false,
        "properties": {
          "service": {
            "$ref": "#/components/schemas/Service"
          },
          "domain": {
            "type": [
              "string",
              "null"
            ],
            "maxLength": 253
          },
          "website": {
            "type": "string",
            "maxLength": 0
          }
        }
      },
      "ServiceRequest": {
        "type": "object",
        "required": [
          "service",
          "token",
          "contact",
          "proof"
        ],
        "additionalProperties": false,
        "properties": {
          "service": {
            "$ref": "#/components/schemas/Service"
          },
          "domain": {
            "type": [
              "string",
              "null"
            ],
            "maxLength": 253
          },
          "token": {
            "type": "string",
            "pattern": "^[A-Za-z0-9_-]{43}$",
            "description": "Private quote capability. Generate 32 random bytes and encode as base64url without padding. Keep it private."
          },
          "contact": {
            "$ref": "#/components/schemas/Contact"
          },
          "proof": {
            "$ref": "#/components/schemas/Proof"
          },
          "website": {
            "type": "string",
            "maxLength": 0
          }
        }
      },
      "PrivateAccess": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "token": {
            "type": "string",
            "pattern": "^[A-Za-z0-9_-]{43}$",
            "description": "Private quote capability. Generate 32 random bytes and encode as base64url without padding. Keep it private."
          }
        }
      },
      "CompletePayment": {
        "type": "object",
        "required": [
          "orderId"
        ],
        "additionalProperties": false,
        "properties": {
          "token": {
            "type": "string",
            "pattern": "^[A-Za-z0-9_-]{43}$",
            "description": "Private quote capability. Generate 32 random bytes and encode as base64url without padding. Keep it private."
          },
          "orderId": {
            "type": "string",
            "pattern": "^[A-Z0-9]{10,32}$"
          }
        }
      },
      "Approval": {
        "type": "object",
        "required": [
          "approvalUrl"
        ],
        "properties": {
          "approvalUrl": {
            "type": "string",
            "format": "uri",
            "description": "PayPal approval URL for the exact server quote. The customer must approve this payment."
          }
        }
      },
      "Money": {
        "type": "string",
        "pattern": "^(0|[1-9][0-9]*)\\.[0-9]{2}$",
        "description": "Decimal amount in the quote currency, with exactly two fractional digits. This is a string, not a floating-point number."
      },
      "IssuedQuote": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "number",
          "scope",
          "currency",
          "subtotal",
          "tax",
          "total",
          "expiresAt",
          "billing"
        ],
        "properties": {
          "number": {
            "type": "string",
            "description": "Merchant quote reference; matches QuoteStatus.id."
          },
          "scope": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1200,
            "description": "The merchant-approved work and agreed commercial terms."
          },
          "currency": {
            "type": "string",
            "enum": [
              "CAD",
              "USD"
            ]
          },
          "subtotal": {
            "$ref": "#/components/schemas/Money",
            "description": "Amount before the included tax."
          },
          "tax": {
            "$ref": "#/components/schemas/Money",
            "description": "Tax already included in total."
          },
          "total": {
            "$ref": "#/components/schemas/Money",
            "not": {
              "const": "0.00"
            },
            "description": "Exact approved payment amount, including tax. Never replace it with a client-supplied amount."
          },
          "expiresAt": {
            "type": "string",
            "format": "date-time",
            "description": "Quote expiry as an RFC 3339 timestamp with timezone."
          },
          "billing": {
            "const": "one-time",
            "description": "This checkout does not create a subscription."
          }
        }
      },
      "SettlementReceipt": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "number",
          "status",
          "captureId"
        ],
        "properties": {
          "number": {
            "type": "string"
          },
          "status": {
            "const": "paid"
          },
          "captureId": {
            "type": "string",
            "description": "Independently verified final PayPal capture reference; never infer it from a return URL."
          }
        }
      },
      "CheckScope": {
        "type": "object",
        "required": [
          "domain",
          "scopeVersion"
        ],
        "additionalProperties": false,
        "properties": {
          "domain": {
            "type": "string",
            "maxLength": 253
          },
          "selector": {
            "type": "string",
            "maxLength": 63
          },
          "formPath": {
            "type": "string",
            "maxLength": 120
          },
          "transport": {
            "type": "boolean"
          },
          "scopeVersion": {
            "const": "public-read-v3"
          },
          "website": {
            "type": "string",
            "maxLength": 0
          }
        }
      },
      "CheckAuthorization": {
        "type": "object",
        "required": [
          "domain",
          "scopeVersion",
          "proof"
        ],
        "additionalProperties": false,
        "properties": {
          "domain": {
            "type": "string",
            "maxLength": 253
          },
          "selector": {
            "type": "string",
            "maxLength": 63
          },
          "formPath": {
            "type": "string",
            "maxLength": 120
          },
          "transport": {
            "type": "boolean"
          },
          "scopeVersion": {
            "const": "public-read-v3"
          },
          "website": {
            "type": "string",
            "maxLength": 0
          },
          "proof": {
            "$ref": "#/components/schemas/Proof"
          }
        }
      },
      "ReadGrant": {
        "type": "object",
        "properties": {
          "ticket": {
            "type": "string"
          },
          "scope": {
            "type": "object"
          },
          "scopeSha256": {
            "type": "string"
          },
          "expiresInSeconds": {
            "type": "integer"
          }
        }
      },
      "CheckStart": {
        "type": "object",
        "required": [
          "ticket",
          "scopeSha256",
          "token"
        ],
        "additionalProperties": false,
        "properties": {
          "ticket": {
            "type": "string"
          },
          "scopeSha256": {
            "type": "string"
          },
          "token": {
            "type": "string",
            "pattern": "^[A-Za-z0-9_-]{43}$",
            "description": "Private quote capability. Generate 32 random bytes and encode as base64url without padding. Keep it private."
          }
        }
      },
      "CheckJob": {
        "type": "object",
        "properties": {
          "schema": {
            "const": "zettabit.check-job.v1"
          },
          "id": {
            "type": "string"
          },
          "state": {
            "enum": [
              "running",
              "complete",
              "failed",
              "cancelled"
            ]
          },
          "scope": {
            "type": "object"
          },
          "progress": {
            "type": "object"
          },
          "report": {
            "type": "object"
          },
          "error": {
            "type": "string"
          },
          "expiresAt": {
            "type": "string",
            "format": "date-time"
          }
        }
      }
    }
  },
  "x-check-limits": {
    "concurrentReads": 2,
    "globalStartsPerTenMinutes": 16,
    "maximumReadSeconds": 20,
    "completedReportRetentionSeconds": 600,
    "publicDnsAndHttpsOnly": true,
    "privateAddressesBlocked": true,
    "writesToProviders": false
  },
  "x-protection": {
    "algorithm": "SHA-256",
    "input": "salt + \":\" + decimal_nonce",
    "success": "The first difficulty bits of the digest are zero.",
    "scope": "Client address, service and optional domain; one use; expires after 60 seconds.",
    "recovery": "If a request response is lost, inspect quoteStatus with the same capability before creating anything else."
  },
  "x-private-link": "https://zettabit.ai/checkout/#q={capability}",
  "x-native-platforms": {
    "acp": "not-enrolled",
    "ucp": "not-enrolled",
    "browserCheckout": "supported-after-merchant-hosting-activation"
  }
}