-
Notifications
You must be signed in to change notification settings - Fork 141
/
internet_identity.did
715 lines (620 loc) · 25.9 KB
/
internet_identity.did
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
type UserNumber = nat64;
type PublicKey = blob;
type CredentialId = blob;
type DeviceKey = PublicKey;
type UserKey = PublicKey;
type SessionKey = PublicKey;
type FrontendHostname = text;
type Timestamp = nat64;
type HeaderField = record {
text;
text;
};
type HttpRequest = record {
method: text;
url: text;
headers: vec HeaderField;
body: blob;
certificate_version: opt nat16;
};
type HttpResponse = record {
status_code: nat16;
headers: vec HeaderField;
body: blob;
upgrade : opt bool;
streaming_strategy: opt StreamingStrategy;
};
type StreamingCallbackHttpResponse = record {
body: blob;
token: opt Token;
};
type Token = record {};
type StreamingStrategy = variant {
Callback: record {
callback: func (Token) -> (StreamingCallbackHttpResponse) query;
token: Token;
};
};
type Purpose = variant {
recovery;
authentication;
};
type KeyType = variant {
unknown;
platform;
cross_platform;
seed_phrase;
browser_storage_key;
};
// This describes whether a device is "protected" or not.
// When protected, a device can only be updated or removed if the
// user is authenticated with that very device.
type DeviceProtection = variant {
protected;
unprotected;
};
type Challenge = record {
png_base64: text;
challenge_key: ChallengeKey;
};
type DeviceData = record {
pubkey : DeviceKey;
alias : text;
credential_id : opt CredentialId;
purpose: Purpose;
key_type: KeyType;
protection: DeviceProtection;
origin: opt text;
// Metadata map for additional device information.
//
// Note: some fields above will be moved to the metadata map in the future.
// All field names of `DeviceData` (such as 'alias', 'origin, etc.) are
// reserved and cannot be written.
// In addition, the keys "usage" and "authenticator_attachment" are reserved as well.
metadata: opt MetadataMap;
};
// The same as `DeviceData` but with the `last_usage` field.
// This field cannot be written, hence the separate type.
type DeviceWithUsage = record {
pubkey : DeviceKey;
alias : text;
credential_id : opt CredentialId;
purpose: Purpose;
key_type: KeyType;
protection: DeviceProtection;
origin: opt text;
last_usage: opt Timestamp;
metadata: opt MetadataMap;
};
// Map with some variants for the value type.
// Note, due to the Candid mapping this must be a tuple type thus we cannot name the fields `key` and `value`.
type MetadataMap = vec record {
text;
variant { map : MetadataMap; string : text; bytes : vec nat8 };
};
type RegisterResponse = variant {
// A new user was successfully registered.
registered: record {
user_number: UserNumber;
};
// No more registrations are possible in this instance of the II service canister.
canister_full;
// The challenge was not successful.
bad_challenge;
};
type AddTentativeDeviceResponse = variant {
// The device was tentatively added.
added_tentatively: record {
verification_code: text;
// Expiration date, in nanos since the epoch
device_registration_timeout: Timestamp;
};
// Device registration mode is off, either due to timeout or because it was never enabled.
device_registration_mode_off;
// There is another device already added tentatively
another_device_tentatively_added;
};
type VerifyTentativeDeviceResponse = variant {
// The device was successfully verified.
verified;
// Wrong verification code entered. Retry with correct code.
wrong_code: record {
retries_left: nat8
};
// Device registration mode is off, either due to timeout or because it was never enabled.
device_registration_mode_off;
// There is no tentative device to be verified.
no_device_to_verify;
};
type Delegation = record {
pubkey: PublicKey;
expiration: Timestamp;
targets: opt vec principal;
};
type SignedDelegation = record {
delegation: Delegation;
signature: blob;
};
type GetDelegationResponse = variant {
// The signed delegation was successfully retrieved.
signed_delegation: SignedDelegation;
// The signature is not ready. Maybe retry by calling `prepare_delegation`
no_such_delegation
};
type InternetIdentityStats = record {
users_registered: nat64;
storage_layout_version: nat8;
assigned_user_number_range: record {
nat64;
nat64;
};
archive_info: ArchiveInfo;
canister_creation_cycles_cost: nat64;
// Map from event aggregation to a sorted list of top 100 sub-keys to their weights.
// Example: {"prepare_delegation_count 24h ic0.app": [{"https://dapp.com", 100}, {"https://dapp2.com", 50}]}
event_aggregations: vec record {text; vec record {text; nat64}};
};
// Configuration parameters related to the archive.
type ArchiveConfig = record {
// The allowed module hash of the archive canister.
// Changing this parameter does _not_ deploy the archive, but enable archive deployments with the
// corresponding wasm module.
module_hash : blob;
// Buffered archive entries limit. If reached, II will stop accepting new anchor operations
// until the buffered operations are acknowledged by the archive.
entries_buffer_limit: nat64;
// The maximum number of entries to be transferred to the archive per call.
entries_fetch_limit: nat16;
// Polling interval to fetch new entries from II (in nanoseconds).
// Changes to this parameter will only take effect after an archive deployment.
polling_interval_ns: nat64;
};
// Information about the archive.
type ArchiveInfo = record {
// Canister id of the archive or empty if no archive has been deployed yet.
archive_canister : opt principal;
// Configuration parameters related to the II archive.
archive_config: opt ArchiveConfig;
};
// Rate limit configuration.
// Currently only used for `register`.
type RateLimitConfig = record {
// Time it takes (in ns) for a rate limiting token to be replenished.
time_per_token_ns : nat64;
// How many tokens are at most generated (to accommodate peaks).
max_tokens: nat64;
};
// Captcha configuration
// Default:
// - max_unsolved_captchas: 500
// - captcha_trigger: Static, CaptchaEnabled
type CaptchaConfig = record {
// Maximum number of unsolved captchas.
max_unsolved_captchas : nat64;
// Configuration for when captcha protection should kick in.
captcha_trigger: variant {
// Based on the rate of registrations compared to some reference time frame and allowing some leeway.
Dynamic: record {
// Percentage of increased registration rate observed in the current rate sampling interval (compared to
// reference rate) at which II will enable captcha for new registrations.
threshold_pct: nat16;
// Length of the interval in seconds used to sample the current rate of registrations.
current_rate_sampling_interval_s: nat64;
// Length of the interval in seconds used to sample the reference rate of registrations.
reference_rate_sampling_interval_s: nat64;
};
// Statically enable / disable captcha
Static: variant {
CaptchaEnabled;
CaptchaDisabled;
}
};
};
// Init arguments of II which can be supplied on install and upgrade.
// Setting a value to null keeps the previous value.
type InternetIdentityInit = record {
// Set lowest and highest anchor
assigned_user_number_range : opt record {
nat64;
nat64;
};
// Configuration parameters related to the II archive.
// Note: some parameters changes (like the polling interval) will only take effect after an archive deployment.
// See ArchiveConfig for details.
archive_config: opt ArchiveConfig;
// Set the amounts of cycles sent with the create canister message.
// This is configurable because in the staging environment cycles are required.
// The canister creation cost on mainnet is currently 100'000'000'000 cycles. If this value is higher thant the
// canister creation cost, the newly created canister will keep extra cycles.
canister_creation_cycles_cost : opt nat64;
// Rate limit for the `register` call.
register_rate_limit : opt RateLimitConfig;
// Configuration of the captcha in the registration flow.
captcha_config: opt CaptchaConfig;
// Configuration for Related Origins Requests
related_origins: opt vec text;
};
type ChallengeKey = text;
type ChallengeResult = record {
key : ChallengeKey;
chars : text;
};
type CaptchaResult = ChallengeResult;
// Extra information about registration status for new devices
type DeviceRegistrationInfo = record {
// If present, the user has tentatively added a new device. This
// new device needs to be verified (see relevant endpoint) before
// 'expiration'.
tentative_device : opt DeviceData;
// The timestamp at which the anchor will turn off registration mode
// (and the tentative device will be forgotten, if any, and if not verified)
expiration: Timestamp;
};
// Information about the anchor
type IdentityAnchorInfo = record {
// All devices that can authenticate to this anchor
devices : vec DeviceWithUsage;
// Device registration status used when adding devices, see DeviceRegistrationInfo
device_registration: opt DeviceRegistrationInfo;
};
type AnchorCredentials = record {
credentials : vec WebAuthnCredential;
recovery_credentials : vec WebAuthnCredential;
recovery_phrases: vec PublicKey;
};
type WebAuthnCredential = record {
credential_id : CredentialId;
pubkey: PublicKey;
};
type DeployArchiveResult = variant {
// The archive was deployed successfully and the supplied wasm module has been installed. The principal of the archive
// canister is returned.
success: principal;
// Initial archive creation is already in progress.
creation_in_progress;
// Archive deployment failed. An error description is returned.
failed: text;
};
type BufferedArchiveEntry = record {
anchor_number: UserNumber;
timestamp: Timestamp;
sequence_number: nat64;
entry: blob;
};
// API V2 specific types
// WARNING: These type are experimental and may change in the future.
type IdentityNumber = nat64;
// Map with some variants for the value type.
// Note, due to the Candid mapping this must be a tuple type thus we cannot name the fields `key` and `value`.
type MetadataMapV2 = vec record {
text;
variant { Map : MetadataMapV2; String : text; Bytes : vec nat8 };
};
// Authentication method using WebAuthn signatures
// See https://www.w3.org/TR/webauthn-2/
// This is a separate type because WebAuthn requires to also store
// the credential id (in addition to the public key).
type WebAuthn = record {
credential_id: CredentialId;
pubkey: PublicKey;
};
// Authentication method using generic signatures
// See https://internetcomputer.org/docs/current/references/ic-interface-spec/#signatures for
// supported signature schemes.
type PublicKeyAuthn = record {
pubkey: PublicKey;
};
// The authentication methods currently supported by II.
type AuthnMethod = variant {
WebAuthn: WebAuthn;
PubKey: PublicKeyAuthn;
};
// This describes whether an authentication method is "protected" or not.
// When protected, a authentication method can only be updated or removed if the
// user is authenticated with that very authentication method.
type AuthnMethodProtection = variant {
Protected;
Unprotected;
};
type AuthnMethodPurpose = variant {
Recovery;
Authentication;
};
type AuthnMethodSecuritySettings = record {
protection: AuthnMethodProtection;
purpose: AuthnMethodPurpose;
};
type AuthnMethodData = record {
authn_method: AuthnMethod;
security_settings: AuthnMethodSecuritySettings;
// contains the following fields of the DeviceWithUsage type:
// - alias
// - origin
// - authenticator_attachment: data taken from key_type and reduced to "platform", "cross_platform" or absent on migration
// - usage: data taken from key_type and reduced to "recovery_phrase", "browser_storage_key" or absent on migration
// Note: for compatibility reasons with the v1 API, the entries above (if present)
// must be of the `String` variant. This restriction may be lifted in the future.
metadata: MetadataMapV2;
last_authentication: opt Timestamp;
};
// Extra information about registration status for new authentication methods
type AuthnMethodRegistrationInfo = record {
// If present, the user has registered a new authentication method. This
// new authentication needs to be verified before 'expiration' in order to
// be added to the identity.
authn_method : opt AuthnMethodData;
// The timestamp at which the identity will turn off registration mode
// (and the authentication method will be forgotten, if any, and if not verified)
expiration: Timestamp;
};
type AuthnMethodConfirmationCode = record {
confirmation_code: text;
expiration: Timestamp;
};
type AuthnMethodRegisterError = variant {
// Authentication method registration mode is off, either due to timeout or because it was never enabled.
RegistrationModeOff;
// There is another authentication method already registered that needs to be confirmed first.
RegistrationAlreadyInProgress;
// The metadata of the provided authentication method contains invalid entries.
InvalidMetadata: text;
};
type AuthnMethodConfirmationError = variant {
// Wrong confirmation code entered. Retry with correct code.
WrongCode: record {
retries_left: nat8
};
// Authentication method registration mode is off, either due to timeout or because it was never enabled.
RegistrationModeOff;
// There is no registered authentication method to be confirmed.
NoAuthnMethodToConfirm;
};
type IdentityAuthnInfo = record {
authn_methods: vec AuthnMethod;
recovery_authn_methods: vec AuthnMethod;
};
type IdentityInfo = record {
authn_methods: vec AuthnMethodData;
authn_method_registration: opt AuthnMethodRegistrationInfo;
// Authentication method independent metadata
metadata: MetadataMapV2;
};
type IdentityInfoError = variant {
// The principal is not authorized to call this method with the given arguments.
Unauthorized: principal;
// Internal canister error. See the error message for details.
InternalCanisterError: text;
};
type AuthnMethodAddError = variant {
InvalidMetadata: text;
};
type AuthnMethodReplaceError = variant {
InvalidMetadata: text;
// No authentication method found with the given public key.
AuthnMethodNotFound;
};
type AuthnMethodMetadataReplaceError = variant {
InvalidMetadata: text;
// No authentication method found with the given public key.
AuthnMethodNotFound;
};
type AuthnMethodSecuritySettingsReplaceError = variant {
// No authentication method found with the given public key.
AuthnMethodNotFound;
};
type IdentityMetadataReplaceError = variant {
// The principal is not authorized to call this method with the given arguments.
Unauthorized: principal;
// The identity including the new metadata exceeds the maximum allowed size.
StorageSpaceExceeded: record {space_available: nat64; space_required: nat64};
// Internal canister error. See the error message for details.
InternalCanisterError: text;
};
type PrepareIdAliasRequest = record {
// Origin of the issuer in the attribute sharing flow.
issuer : FrontendHostname;
// Origin of the relying party in the attribute sharing flow.
relying_party : FrontendHostname;
// Identity for which the IdAlias should be generated.
identity_number : IdentityNumber;
};
type PrepareIdAliasError = variant {
// The principal is not authorized to call this method with the given arguments.
Unauthorized: principal;
// Internal canister error. See the error message for details.
InternalCanisterError: text;
};
// The prepared id alias contains two (still unsigned) credentials in JWT format,
// certifying the id alias for the issuer resp. the relying party.
type PreparedIdAlias = record {
rp_id_alias_jwt : text;
issuer_id_alias_jwt : text;
canister_sig_pk_der : PublicKey;
};
// The request to retrieve the actual signed id alias credentials.
// The field values should be equal to the values of corresponding
// fields from the preceding `PrepareIdAliasRequest` and `PrepareIdAliasResponse`.
type GetIdAliasRequest = record {
rp_id_alias_jwt : text;
issuer : FrontendHostname;
issuer_id_alias_jwt : text;
relying_party : FrontendHostname;
identity_number : IdentityNumber;
};
type GetIdAliasError = variant {
// The principal is not authorized to call this method with the given arguments.
Unauthorized: principal;
// The credential(s) are not available: may be expired or not prepared yet (call prepare_id_alias to prepare).
NoSuchCredentials : text;
// Internal canister error. See the error message for details.
InternalCanisterError: text;
};
// The signed id alias credentials for each involved party.
type IdAliasCredentials = record {
rp_id_alias_credential : SignedIdAlias;
issuer_id_alias_credential : SignedIdAlias;
};
type SignedIdAlias = record {
credential_jws : text;
id_alias : principal;
id_dapp : principal;
};
type IdRegNextStepResult = record {
// The next step in the registration flow
next_step: RegistrationFlowNextStep;
};
type IdRegStartError = variant {
// The method was called anonymously, which is not supported.
InvalidCaller;
// Too many registrations. Please try again later.
RateLimitExceeded;
// A registration flow is already in progress.
AlreadyInProgress;
};
// The next step in the registration flow:
// - CheckCaptcha: supply the solution to the captcha using `check_captcha`
// - Finish: finish the registration using `identity_registration_finish`
type RegistrationFlowNextStep = variant {
// Supply the captcha solution using check_captcha
CheckCaptcha: record {
captcha_png_base64: text;
};
// Finish the registration using identity_registration_finish
Finish;
};
type CheckCaptchaArg = record {
solution : text;
};
type CheckCaptchaError = variant {
// The supplied solution was wrong. Try again with the new captcha.
WrongSolution: record {
new_captcha_png_base64: text;
};
// This call is unexpected, see next_step.
UnexpectedCall: record {
next_step: RegistrationFlowNextStep;
};
// No registration flow ongoing for the caller.
NoRegistrationFlow;
};
type IdRegFinishArg = record {
authn_method: AuthnMethodData;
};
type IdRegFinishResult = record {
identity_number: nat64;
};
type IdRegFinishError = variant {
// The configured maximum number of identities has been reached.
IdentityLimitReached;
// This call is unexpected, see next_step.
UnexpectedCall: record {
next_step: RegistrationFlowNextStep;
};
// No registration flow ongoing for the caller.
NoRegistrationFlow;
// The supplied authn_method is not valid.
InvalidAuthnMethod: text;
// Error while persisting the new identity.
StorageError: text;
};
service : (opt InternetIdentityInit) -> {
// Legacy identity management API
// ==============================
create_challenge : () -> (Challenge);
register : (DeviceData, ChallengeResult, opt principal) -> (RegisterResponse);
add : (UserNumber, DeviceData) -> ();
update : (UserNumber, DeviceKey, DeviceData) -> ();
// Atomically replace device matching the device key with the new device data
replace : (UserNumber, DeviceKey, DeviceData) -> ();
remove : (UserNumber, DeviceKey) -> ();
// Returns all devices of the user (authentication and recovery) but no information about device registrations.
// Note: Clears out the 'alias' fields on the devices. Use 'get_anchor_info' to obtain the full information.
// Deprecated: Use 'get_anchor_credentials' instead.
lookup : (UserNumber) -> (vec DeviceData) query;
get_anchor_credentials : (UserNumber) -> (AnchorCredentials) query;
get_anchor_info : (UserNumber) -> (IdentityAnchorInfo);
get_principal : (UserNumber, FrontendHostname) -> (principal) query;
enter_device_registration_mode : (UserNumber) -> (Timestamp);
exit_device_registration_mode : (UserNumber) -> ();
add_tentative_device : (UserNumber, DeviceData) -> (AddTentativeDeviceResponse);
verify_tentative_device : (UserNumber, verification_code: text) -> (VerifyTentativeDeviceResponse);
// V2 Identity Management API
// ==========================
// WARNING: The following methods are experimental and may ch 0ange in the future.
// Starts the identity registration flow to create a new identity.
identity_registration_start: () -> (variant {Ok: IdRegNextStepResult; Err: IdRegStartError;});
// Check the captcha challenge
// If successful, the registration can be finished with `identity_registration_finish`.
check_captcha: (CheckCaptchaArg) -> (variant {Ok: IdRegNextStepResult; Err: CheckCaptchaError;});
// Starts the identity registration flow to create a new identity.
identity_registration_finish: (IdRegFinishArg) -> (variant {Ok: IdRegFinishResult; Err: IdRegFinishError;});
// Returns information about the authentication methods of the identity with the given number.
// Only returns the minimal information required for authentication without exposing any metadata such as aliases.
identity_authn_info: (IdentityNumber) -> (variant {Ok: IdentityAuthnInfo; Err;}) query;
// Returns information about the identity with the given number.
// Requires authentication.
identity_info: (IdentityNumber) -> (variant {Ok: IdentityInfo; Err: IdentityInfoError;});
// Replaces the authentication method independent metadata map.
// The existing metadata map will be overwritten.
// Requires authentication.
identity_metadata_replace: (IdentityNumber, MetadataMapV2) -> (variant {Ok; Err: IdentityMetadataReplaceError;});
// Adds a new authentication method to the identity.
// Requires authentication.
authn_method_add: (IdentityNumber, AuthnMethodData) -> (variant {Ok; Err: AuthnMethodAddError;});
// Atomically replaces the authentication method matching the supplied public key with the new authentication method
// provided.
// Requires authentication.
authn_method_replace: (IdentityNumber, PublicKey, AuthnMethodData) -> (variant {Ok; Err: AuthnMethodReplaceError;});
// Replaces the authentication method metadata map.
// The existing metadata map will be overwritten.
// Requires authentication.
authn_method_metadata_replace: (IdentityNumber, PublicKey, MetadataMapV2) -> (variant {Ok; Err: AuthnMethodMetadataReplaceError;});
// Replaces the authentication method security settings.
// The existing security settings will be overwritten.
// Requires authentication.
authn_method_security_settings_replace: (IdentityNumber, PublicKey, AuthnMethodSecuritySettings) -> (variant {Ok; Err: AuthnMethodSecuritySettingsReplaceError;});
// Removes the authentication method associated with the public key from the identity.
// Requires authentication.
authn_method_remove: (IdentityNumber, PublicKey) -> (variant {Ok; Err;});
// Enters the authentication method registration mode for the identity.
// In this mode, a new authentication method can be registered, which then needs to be
// confirmed before it can be used for authentication on this identity.
// The registration mode is automatically exited after the returned expiration timestamp.
// Requires authentication.
authn_method_registration_mode_enter : (IdentityNumber) -> (variant {Ok: record { expiration: Timestamp; }; Err;});
// Exits the authentication method registration mode for the identity.
// Requires authentication.
authn_method_registration_mode_exit : (IdentityNumber) -> (variant {Ok; Err;});
// Registers a new authentication method to the identity.
// This authentication method needs to be confirmed before it can be used for authentication on this identity.
authn_method_register: (IdentityNumber, AuthnMethodData) -> (variant {Ok: AuthnMethodConfirmationCode; Err: AuthnMethodRegisterError;});
// Confirms a previously registered authentication method.
// On successful confirmation, the authentication method is permanently added to the identity and can
// subsequently be used for authentication for that identity.
// Requires authentication.
authn_method_confirm: (IdentityNumber, confirmation_code: text) -> (variant {Ok; Err: AuthnMethodConfirmationError;});
// Authentication protocol
// =======================
prepare_delegation : (UserNumber, FrontendHostname, SessionKey, maxTimeToLive : opt nat64) -> (UserKey, Timestamp);
get_delegation: (UserNumber, FrontendHostname, SessionKey, Timestamp) -> (GetDelegationResponse) query;
// Attribute Sharing MVP API
// =========================
// The methods below are used to generate ID-alias credentials during attribute sharing flow.
prepare_id_alias : (PrepareIdAliasRequest) -> (variant {Ok: PreparedIdAlias; Err: PrepareIdAliasError;});
get_id_alias : (GetIdAliasRequest) -> (variant {Ok: IdAliasCredentials; Err: GetIdAliasError;}) query;
// HTTP Gateway protocol
// =====================
http_request: (request: HttpRequest) -> (HttpResponse) query;
http_request_update: (request: HttpRequest) -> (HttpResponse);
// Internal Methods
// ================
init_salt: () -> ();
stats : () -> (InternetIdentityStats) query;
config : () -> (InternetIdentityInit) query;
deploy_archive: (wasm: blob) -> (DeployArchiveResult);
// Returns a batch of entries _sorted by sequence number_ to be archived.
// This is an update call because the archive information _must_ be certified.
// Only callable by this IIs archive canister.
fetch_entries: () -> (vec BufferedArchiveEntry);
acknowledge_entries: (sequence_number: nat64) -> ();
}