{
  "domain_policy_check_version": "aux-domain-policy-check-0.1.0",
  "policy_document_schema": "aux-certification-consumer-policy-0.1",
  "endpoint": "https://api.aux.prdictionedge.ai/v1/certifications/domain-policy-check",
  "policy_url_template": "https://{consumer_domain}/.well-known/aux-certification-policy.json",
  "request": {
    "certification": "signed AUX certification object",
    "consumer_domain": "public DNS domain only"
  },
  "required_policy_document": {
    "schema": "aux-certification-consumer-policy-0.1",
    "issuer": "https://consumer.example",
    "audience": "https://api.aux.prdictionedge.ai",
    "issued_at": "ISO-8601",
    "expires_at": "ISO-8601; no more than 30 days after issued_at",
    "policy": {
      "policy_id": "non-empty string",
      "allowed_profiles": [
        {
          "profile_id": "string",
          "versions": [
            "profile version strings"
          ]
        }
      ],
      "max_age_seconds": "integer from 1 through 604800",
      "required_requirement_ids": [
        "optional requirement ids that must be satisfied in the receipt"
      ],
      "expected_certification_id": "optional exact certification_id",
      "expected_proposal_hash": "optional exact 64-hex proposal hash",
      "expected_evidence_set_hash": "optional exact 64-hex evidence-set hash"
    }
  },
  "outcomes": [
    "ACCEPT",
    "REJECT",
    "INVALID_RECEIPT"
  ],
  "source_states": [
    "DOMAIN_POLICY_RESOLVED",
    "POLICY_SOURCE_NOT_CONFIGURED",
    "POLICY_SOURCE_TEMPORARILY_UNAVAILABLE",
    "POLICY_SOURCE_INVALID"
  ],
  "rule": "The caller supplies only the consumer domain and certification. AUX independently resolves the consumer-domain policy document over HTTPS, verifies exact issuer/audience/freshness binding, validates the embedded policy, verifies the certification, applies the resolved policy, and never executes the underlying action."
}