Check your signature

POST/v1/diagnostics/signature

The signature self-check: runs your call through Anis’s full checks and reports exactly what Anis saw — the method, address, path and query it signed over, the key it found and the permissions in force. It changes nothing. Sends exactly {}.

Permissiondiagnostics:use

AuthenticationSigned change

Staff-set limits it counts towardAll requests

.NET SDKanis.Diagnostics.CheckSignatureAsync()

The right first call when a signature will not verify.

Request

Signed with your key, with a one-time nonce and a digest of the body.

Headers: Signature-Input, Signature, Content-Digest, Nonce, X-Anis-Date. The SDKs set all of them for you.

Body: Exactly the two bytes {} — nothing else.

Responses

Status	Meaning	Body
200	Success.	SignatureDiagnostic
401	Refused: not authenticated.	Problem
403	Refused: not allowed.	Problem
409	Refused: conflicts with the current state.	Problem
422	Refused: the request breaks a rule.	Problem
429	Refused: a limit was reached.	Problem

Every answer is signed by Anis; the SDKs check it before you see it.

Refusals

Every refusal is a signed problem. Branch on its code; each links to what it means and what to do.

Error	Code	Status
Invalid credentials	`invalid_credentials`	401
Insufficient scope	`insufficient_scope`	403
Source address not allowed	`source_ip_not_allowed`	403
Rate limited	`rate_limited`	429
Replay detected	`replay_detected`	409
Validation failed	`validation_failed`	422
Internal error	`internal_error`	500
Request timeout	`request_timeout`	504

Types

SignatureDiagnostic

Field	Type	Notes
`routeId`always present	string	The route Anis matched your call to.
`method`always present	string	The method, as Anis saw it.
`authority`always present	string	The host (and port, if not the default), as Anis saw it — lower-cased.
`path`always present	string	The path, as Anis saw it.
`canonicalQuery`always present	string	The query, as Anis saw it, without its leading `?`.
`requestKind`always present	string	How Anis expects this route to be signed. Values: `safeRead`, `bodylessNonceMutation`, `orderMutation`, `enrollmentToken`, `public`
`requiredScope`always present	string	The permission this route needs.
`coveredComponents`always present	list of string	The signed components this route requires, in order.
`keyId`always present	UUID	The key id Anis found your signature under.
`partnerId`always present	UUID	The partner that key belongs to.
`applicationId`always present	UUID	The application that key belongs to.
`policyVersion`always present	integer	The version of your application’s permissions that applied. It goes up each time Anis staff change them.
`effectiveScopes`always present	list of string	The permissions in force for this call.
`receivedAt`always present	string (date-time)	When Anis received the call.