EQTY LabDocs

Compute program CID

Computes the JCS CIDs of a Governance Program manifest and each of its controls, and stores them in the blob store. Returns the CID that program versions, assessments, and certifications pin, and each control's CID, which agent assessment declarations and reviews cite. The caller needs manage_programs in the organization. The manifest's organization must be the caller's own, so a stored manifest never claims an owner that did not author it. Beyond that only the shape is checked here. Whether the requirements are complete is governance's rule, and anything that later relies on a manifest re-reads it by CID rather than trusting this call. The manifest must match the schema exactly: a missing or unknown field, or an unknown certification rule, configuration field, profile section or condition, is refused before the manifest is read.

posthttps://<host>/gov/v1/cid/program
bash
curl --request POST \
  --url 'https://<host>/gov/v1/cid/program' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{"certification":{"rule":"all_controls_satisfied","validFor":"P1Y"},"controls":[{"appliesWhen":{"any":[{"field":"context.mode","in":"[\"personal\", \"special_category\"]"}]},"citations":[{"title":"Agent security standard, section 3","url":"https://example.com/standards/agents#section-3"}],"controlCode":"AGT-1","expectedEvidence":"[\"The model card for the agent'\''s model\"]","guidance":"string","judges":{"configuration":["app"],"profile":["purpose"]},"notApplicable":{"condition":"string","permitted":true},"requirement":"string","title":"string"}],"organization":"urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21","program":{"description":"string","id":"urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d","name":"Agent Baseline","slug":"agent-baseline","version":"1.0.0"},"scope":{"configuration":"AgentConfigurationV1","requiredCoverage":["app"]},"type":"GovernanceProgramManifestV1"}'
javascript
const response = await fetch("https://<host>/gov/v1/cid/program", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "certification": {
      "rule": "all_controls_satisfied",
      "validFor": "P1Y"
    },
    "controls": [
      {
        "appliesWhen": {
          "any": [
            {
              "field": "context.mode",
              "in": "[\"personal\", \"special_category\"]"
            }
          ]
        },
        "citations": [
          {
            "title": "Agent security standard, section 3",
            "url": "https://example.com/standards/agents#section-3"
          }
        ],
        "controlCode": "AGT-1",
        "expectedEvidence": "[\"The model card for the agent's model\"]",
        "guidance": "string",
        "judges": {
          "configuration": [
            "app"
          ],
          "profile": [
            "purpose"
          ]
        },
        "notApplicable": {
          "condition": "string",
          "permitted": true
        },
        "requirement": "string",
        "title": "string"
      }
    ],
    "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
    "program": {
      "description": "string",
      "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
      "name": "Agent Baseline",
      "slug": "agent-baseline",
      "version": "1.0.0"
    },
    "scope": {
      "configuration": "AgentConfigurationV1",
      "requiredCoverage": [
        "app"
      ]
    },
    "type": "GovernanceProgramManifestV1"
  })
});

const data = await response.json();
typescript
interface CidProgramResponse {
  controls: Record<string, unknown>;
  program: string;
}

const response = await fetch("https://<host>/gov/v1/cid/program", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "certification": {
      "rule": "all_controls_satisfied",
      "validFor": "P1Y"
    },
    "controls": [
      {
        "appliesWhen": {
          "any": [
            {
              "field": "context.mode",
              "in": "[\"personal\", \"special_category\"]"
            }
          ]
        },
        "citations": [
          {
            "title": "Agent security standard, section 3",
            "url": "https://example.com/standards/agents#section-3"
          }
        ],
        "controlCode": "AGT-1",
        "expectedEvidence": "[\"The model card for the agent's model\"]",
        "guidance": "string",
        "judges": {
          "configuration": [
            "app"
          ],
          "profile": [
            "purpose"
          ]
        },
        "notApplicable": {
          "condition": "string",
          "permitted": true
        },
        "requirement": "string",
        "title": "string"
      }
    ],
    "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
    "program": {
      "description": "string",
      "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
      "name": "Agent Baseline",
      "slug": "agent-baseline",
      "version": "1.0.0"
    },
    "scope": {
      "configuration": "AgentConfigurationV1",
      "requiredCoverage": [
        "app"
      ]
    },
    "type": "GovernanceProgramManifestV1"
  })
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);

const data: CidProgramResponse = await response.json();
python
import requests

response = requests.post(
    "https://<host>/gov/v1/cid/program",
    headers={
        "Authorization": "Bearer <token>",
        "Content-Type": "application/json",
    },
    json={
        "certification": {
            "rule": "all_controls_satisfied",
            "validFor": "P1Y",
        },
        "controls": [
            {
                "appliesWhen": {
                    "any": [
                        {
                            "field": "context.mode",
                            "in": "[\"personal\", \"special_category\"]",
                        },
                    ],
                },
                "citations": [
                    {
                        "title": "Agent security standard, section 3",
                        "url": "https://example.com/standards/agents#section-3",
                    },
                ],
                "controlCode": "AGT-1",
                "expectedEvidence": "[\"The model card for the agent's model\"]",
                "guidance": "string",
                "judges": {
                    "configuration": [
                        "app",
                    ],
                    "profile": [
                        "purpose",
                    ],
                },
                "notApplicable": {
                    "condition": "string",
                    "permitted": True,
                },
                "requirement": "string",
                "title": "string",
            },
        ],
        "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
        "program": {
            "description": "string",
            "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
            "name": "Agent Baseline",
            "slug": "agent-baseline",
            "version": "1.0.0",
        },
        "scope": {
            "configuration": "AgentConfigurationV1",
            "requiredCoverage": [
                "app",
            ],
        },
        "type": "GovernanceProgramManifestV1",
    },
)
response.raise_for_status()
print(response.json())
go
package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{
	  "certification": {
	    "rule": "all_controls_satisfied",
	    "validFor": "P1Y"
	  },
	  "controls": [
	    {
	      "appliesWhen": {
	        "any": [
	          {
	            "field": "context.mode",
	            "in": "[\"personal\", \"special_category\"]"
	          }
	        ]
	      },
	      "citations": [
	        {
	          "title": "Agent security standard, section 3",
	          "url": "https://example.com/standards/agents#section-3"
	        }
	      ],
	      "controlCode": "AGT-1",
	      "expectedEvidence": "[\"The model card for the agent's model\"]",
	      "guidance": "string",
	      "judges": {
	        "configuration": [
	          "app"
	        ],
	        "profile": [
	          "purpose"
	        ]
	      },
	      "notApplicable": {
	        "condition": "string",
	        "permitted": true
	      },
	      "requirement": "string",
	      "title": "string"
	    }
	  ],
	  "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
	  "program": {
	    "description": "string",
	    "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
	    "name": "Agent Baseline",
	    "slug": "agent-baseline",
	    "version": "1.0.0"
	  },
	  "scope": {
	    "configuration": "AgentConfigurationV1",
	    "requiredCoverage": [
	      "app"
	    ]
	  },
	  "type": "GovernanceProgramManifestV1"
	}`)
	req, err := http.NewRequest(http.MethodPost, "https://<host>/gov/v1/cid/program", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer <token>")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Status, string(data))
}
java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://<host>/gov/v1/cid/program"))
            .header("Authorization", "Bearer <token>")
            .header("Content-Type", "application/json")
            .method("POST", HttpRequest.BodyPublishers.ofString("""
                {
                  "certification": {
                    "rule": "all_controls_satisfied",
                    "validFor": "P1Y"
                  },
                  "controls": [
                    {
                      "appliesWhen": {
                        "any": [
                          {
                            "field": "context.mode",
                            "in": "[\\"personal\\", \\"special_category\\"]"
                          }
                        ]
                      },
                      "citations": [
                        {
                          "title": "Agent security standard, section 3",
                          "url": "https://example.com/standards/agents#section-3"
                        }
                      ],
                      "controlCode": "AGT-1",
                      "expectedEvidence": "[\\"The model card for the agent's model\\"]",
                      "guidance": "string",
                      "judges": {
                        "configuration": [
                          "app"
                        ],
                        "profile": [
                          "purpose"
                        ]
                      },
                      "notApplicable": {
                        "condition": "string",
                        "permitted": true
                      },
                      "requirement": "string",
                      "title": "string"
                    }
                  ],
                  "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
                  "program": {
                    "description": "string",
                    "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
                    "name": "Agent Baseline",
                    "slug": "agent-baseline",
                    "version": "1.0.0"
                  },
                  "scope": {
                    "configuration": "AgentConfigurationV1",
                    "requiredCoverage": [
                      "app"
                    ]
                  },
                  "type": "GovernanceProgramManifestV1"
                }
                """))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}
csharp
using System.Net.Http.Headers;
using System.Text;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://<host>/gov/v1/cid/program");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
request.Content = new StringContent("""
    {
      "certification": {
        "rule": "all_controls_satisfied",
        "validFor": "P1Y"
      },
      "controls": [
        {
          "appliesWhen": {
            "any": [
              {
                "field": "context.mode",
                "in": "[\"personal\", \"special_category\"]"
              }
            ]
          },
          "citations": [
            {
              "title": "Agent security standard, section 3",
              "url": "https://example.com/standards/agents#section-3"
            }
          ],
          "controlCode": "AGT-1",
          "expectedEvidence": "[\"The model card for the agent's model\"]",
          "guidance": "string",
          "judges": {
            "configuration": [
              "app"
            ],
            "profile": [
              "purpose"
            ]
          },
          "notApplicable": {
            "condition": "string",
            "permitted": true
          },
          "requirement": "string",
          "title": "string"
        }
      ],
      "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
      "program": {
        "description": "string",
        "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
        "name": "Agent Baseline",
        "slug": "agent-baseline",
        "version": "1.0.0"
      },
      "scope": {
        "configuration": "AgentConfigurationV1",
        "requiredCoverage": [
          "app"
        ]
      },
      "type": "GovernanceProgramManifestV1"
    }
    """, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");
php
<?php

$ch = curl_init('https://<host>/gov/v1/cid/program');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer <token>',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => <<<'JSON'
    {
      "certification": {
        "rule": "all_controls_satisfied",
        "validFor": "P1Y"
      },
      "controls": [
        {
          "appliesWhen": {
            "any": [
              {
                "field": "context.mode",
                "in": "[\"personal\", \"special_category\"]"
              }
            ]
          },
          "citations": [
            {
              "title": "Agent security standard, section 3",
              "url": "https://example.com/standards/agents#section-3"
            }
          ],
          "controlCode": "AGT-1",
          "expectedEvidence": "[\"The model card for the agent's model\"]",
          "guidance": "string",
          "judges": {
            "configuration": [
              "app"
            ],
            "profile": [
              "purpose"
            ]
          },
          "notApplicable": {
            "condition": "string",
            "permitted": true
          },
          "requirement": "string",
          "title": "string"
        }
      ],
      "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
      "program": {
        "description": "string",
        "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
        "name": "Agent Baseline",
        "slug": "agent-baseline",
        "version": "1.0.0"
      },
      "scope": {
        "configuration": "AgentConfigurationV1",
        "requiredCoverage": [
          "app"
        ]
      },
      "type": "GovernanceProgramManifestV1"
    }
    JSON,
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;
ruby
require "net/http"

uri = URI("https://<host>/gov/v1/cid/program")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer <token>"
request["Content-Type"] = "application/json"
request.body = <<~'JSON'
  {
    "certification": {
      "rule": "all_controls_satisfied",
      "validFor": "P1Y"
    },
    "controls": [
      {
        "appliesWhen": {
          "any": [
            {
              "field": "context.mode",
              "in": "[\"personal\", \"special_category\"]"
            }
          ]
        },
        "citations": [
          {
            "title": "Agent security standard, section 3",
            "url": "https://example.com/standards/agents#section-3"
          }
        ],
        "controlCode": "AGT-1",
        "expectedEvidence": "[\"The model card for the agent's model\"]",
        "guidance": "string",
        "judges": {
          "configuration": [
            "app"
          ],
          "profile": [
            "purpose"
          ]
        },
        "notApplicable": {
          "condition": "string",
          "permitted": true
        },
        "requirement": "string",
        "title": "string"
      }
    ],
    "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
    "program": {
      "description": "string",
      "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
      "name": "Agent Baseline",
      "slug": "agent-baseline",
      "version": "1.0.0"
    },
    "scope": {
      "configuration": "AgentConfigurationV1",
      "requiredCoverage": [
        "app"
      ]
    },
    "type": "GovernanceProgramManifestV1"
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
puts "#{response.code} #{response.body}"
rust
// Cargo.toml dependencies: reqwest (features "json"), serde_json, tokio (features "full")
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let response = reqwest::Client::new()
        .post("https://<host>/gov/v1/cid/program")
        .header("Authorization", "Bearer <token>")
        .json(&json!({
            "certification": {
                "rule": "all_controls_satisfied",
                "validFor": "P1Y"
            },
            "controls": [
                {
                    "appliesWhen": {
                        "any": [
                            {
                                "field": "context.mode",
                                "in": "[\"personal\", \"special_category\"]"
                            }
                        ]
                    },
                    "citations": [
                        {
                            "title": "Agent security standard, section 3",
                            "url": "https://example.com/standards/agents#section-3"
                        }
                    ],
                    "controlCode": "AGT-1",
                    "expectedEvidence": "[\"The model card for the agent's model\"]",
                    "guidance": "string",
                    "judges": {
                        "configuration": [
                            "app"
                        ],
                        "profile": [
                            "purpose"
                        ]
                    },
                    "notApplicable": {
                        "condition": "string",
                        "permitted": true
                    },
                    "requirement": "string",
                    "title": "string"
                }
            ],
            "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
            "program": {
                "description": "string",
                "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
                "name": "Agent Baseline",
                "slug": "agent-baseline",
                "version": "1.0.0"
            },
            "scope": {
                "configuration": "AgentConfigurationV1",
                "requiredCoverage": [
                    "app"
                ]
            },
            "type": "GovernanceProgramManifestV1"
        }))
        .send()
        .await?;

    println!("{} {}", response.status(), response.text().await?);
    Ok(())
}

Authorizations

  • BearerAuth · HTTP bearer (JWT)

Request bodyrequired

application/json
  • certificationProgramCertificationrequired
    Show ProgramCertification
    • ruleProgramCertificationRulerequired

      One ofall_controls_satisfied

    • validForstring | null

      How long a certification lasts, as an ISO 8601 duration; absent when the program sets no expiry

  • controlsProgramControl[]required
    Show properties

    Array of ProgramControl

    • appliesWhenobject

      When a program control applies, from what the agent's operating profile declares. Nothing evaluates it yet; until something does, an owner claims a control not applicable by hand

      Show properties
      • anyProgramCondition[]required

        The control applies when any condition holds; sorted by field, each field at most once

        Show properties

        Array of ProgramCondition

        • fieldProfileFieldrequired

          A part of an agent's operating profile a condition can test, each with a fixed vocabulary

          One ofcontext.modecontext.actsForcontext.userssystems.accesssystems.datasystems.operations.impact

        • instring[]required

          Sorted, each at most once, each in the field's vocabulary

    • citationsProgramCitation[] | null

      Sources the requirement comes from, such as a framework's control

      Show properties

      Array of ProgramCitation

      • titlestringrequired
      • urlstringrequired
    • controlCodestringrequired
    • expectedEvidencestring[] | null

      What the agent's owner is expected to bring, for the reviewer to weigh; never a blocker

    • guidancestring | null
    • judgesobject

      What a program control judges beyond the declarations an owner brings. A configuration field it names becomes part of the control's evidence, so changing that field changes the evidence its reviews judged

      Show properties
      • configurationProgramConfigurationField[] | null

        Fields of the pinned AgentConfigurationV1; sorted, each at most once

      • profileProfileSection[] | null

        Sections of the agent's operating profile; sorted, each at most once

    • notApplicableProgramNotApplicableRulerequired
      Show ProgramNotApplicableRule
      • conditionstring | null
      • permittedbooleanrequired
    • requirementstringrequired
    • titlestringrequired
  • organizationstringrequired

    The owning organization's urn:uuid

  • programProgramManifestProgramrequired
    Show ProgramManifestProgram
    • descriptionstringrequired
    • idstringrequired

      The program version's urn:uuid in governance

    • namestringrequired
    • slugstringrequired

      Shared by every version of the program within its organization

    • versionstringrequired
  • scopeProgramScoperequired

    The part of an agent a certification under the program binds: the configuration fields an assessed agent's snapshot must have captured into its fingerprint

    Show ProgramScope
    • configurationProgramScopeConfigurationrequired

      The configuration schema whose fields a program's scope names

      One ofAgentConfigurationV1

    • requiredCoverageProgramConfigurationField[]required

      Sorted, each at most once

  • typestringrequired
Examplejson
{
  "certification": {
    "rule": "all_controls_satisfied",
    "validFor": "P1Y"
  },
  "controls": [
    {
      "appliesWhen": {
        "any": [
          {
            "field": "context.mode",
            "in": "[\"personal\", \"special_category\"]"
          }
        ]
      },
      "citations": [
        {
          "title": "Agent security standard, section 3",
          "url": "https://example.com/standards/agents#section-3"
        }
      ],
      "controlCode": "AGT-1",
      "expectedEvidence": "[\"The model card for the agent's model\"]",
      "guidance": "string",
      "judges": {
        "configuration": [
          "app"
        ],
        "profile": [
          "purpose"
        ]
      },
      "notApplicable": {
        "condition": "string",
        "permitted": true
      },
      "requirement": "string",
      "title": "string"
    }
  ],
  "organization": "urn:uuid:7b3f0c6e-2a51-4f0e-9d8e-3c1f5b0a9e21",
  "program": {
    "description": "string",
    "id": "urn:uuid:4f9a2d1c-8e7b-4c3a-b6d5-1e0f9a8b7c6d",
    "name": "Agent Baseline",
    "slug": "agent-baseline",
    "version": "1.0.0"
  },
  "scope": {
    "configuration": "AgentConfigurationV1",
    "requiredCoverage": [
      "app"
    ]
  },
  "type": "GovernanceProgramManifestV1"
}

Responses

200The CIDs of the Governance Program manifest and each control

application/json
  • controlsobjectrequired

    Control code -> the CID of that control's document

    Show properties

    Map of string

  • programstringrequired
Examplejson
{
  "controls": {
    "key": "string"
  },
  "program": "string"
}

400The manifest's type is not GovernanceProgramManifestV1, or its organization is not a lowercase urn:uuid

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

401Missing or invalid bearer token

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

403Caller lacks organization-level manage_programs, or the manifest names an organization other than the caller's

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

422A control is spelled other than its canonical form: an optional part sent empty, a list out of order or repeated, or a condition value outside its field's vocabulary

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

500Internal error recording the program

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

503Auth Service or blob storage unavailable

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}