Prove you hold the key

POST/v1/enrollments/{invitationId}/proof

Sends the proof of possession. Once accepted, the key waits for Anis staff to record its fingerprint and confirm it.

PermissionNone

AuthenticationEnrolment token

Staff-set limits it counts towardNone

.NET SDKenrollment.ProveAsync(submitted, key)

A proof that does not verify, or comes more than about 30 minutes after the key submission, is not refused: the answer says proofState: "failed". Check for "accepted".
After five failed proofs, further proofs are refused as rate_limited until Anis staff restart the enrolment.

Parameters

Name	In	Type	Notes
`invitationId`required	`path`	UUID	A UUID, lower-case with hyphens.

Authorised with Authorization: Enrollment <token>; not signed.

Headers: Accept-Language (optional). The SDKs set all of them for you.

Body: EnrollmentProofRequest, as JSON.

Field	Type	Notes
`keyId`required	UUID	The key id from the key submission.
`challengeGeneration`required	integer	The challenge generation you are answering.
`signature`required	string	ECDSA P-256/SHA-256 over the proof message, 64 bytes (not DER), base64url without padding.

Status	Meaning	Body
200	Success.	EnrollmentStatus
401	Refused: not authenticated.	Problem
404	Refused: not found, or not yours.	Problem
409	Refused: conflicts with the current state.	Problem
422	Refused: the request breaks a rule.	Problem
429	Refused: a limit was reached.	Problem
503	No decision: a dependency was unavailable.	Problem

Every answer is signed by Anis; the SDKs check it before you see it.

Every refusal is a signed problem. Branch on its code; each links to what it means and what to do.

Field	Type	Notes
`keyId`required	UUID	The key id from the key submission.
`challengeGeneration`required	integer	The challenge generation you are answering.
`signature`required	string	ECDSA P-256/SHA-256 over the proof message, 64 bytes (not DER), base64url without padding.

Field	Type	Notes
`keyId`	UUID	Your key id.
`challengeGeneration`	integer	The current challenge generation.
`proofState`	string	`pending`, `accepted` or `failed` — a proof that did not verify or came too late. After five failed proofs, ask Anis staff to restart the enrolment.
`approvalState`	string	`pending` while Anis staff have not confirmed the key, `approved` once it is active, `notApplicable` otherwise.
`state`	string	`pendingProof`, `pendingApproval`, `active` — the key signs requests — or `unavailable` (revoked, expired or replaced).
`expiresAt`	string (date-time)	When the current step expires.