Read over REST
Not released. This page describes planned behaviour as designed for edition 1.0-draft-1 of Open Personal Context. The specification is the normative reference, and what is described here may change before any release.
A service that does not speak MCP is intended to read the record over REST with the same guarantees: the same grant, the same levels, the same signed disclosure and the same receipt. Both bindings call the same counted read transaction (A5.2). No recipient endpoint is available yet, so the steps below describe the published contract, not a service you can call.
1. Find the provider
Fetch /.well-known/autonym from the provider's origin. It names the issuer, the authorisation
server, the JWKS URI of the provider's signing key set and the REST endpoint, which is null when
the surface is disabled (A3.3). The REST resource has its own protected-resource metadata, at
/.well-known/oauth-protected-resource/v1.
2. Register and ask for a grant
Register through a Client ID Metadata Document or RFC 7591 dynamic registration. A service that
authenticates with a key it registered, using private_key_jwt, is a service client (A2). Ask for
a read grant with the authorisation code flow, PKCE S256, the resource <origin>/v1 and scopes that
name each domain and ceiling and exactly one purpose, for example autonym:read:viewing:L1 autonym:purpose:recommendation. The person approves, lowers or declines. A service client's
grant lasts at most 72 hours.
3. Read
Send GET /v1/context?domains=viewing with Authorization: DPoP and a DPoP proof for that request.
Every access token is DPoP-bound, so a token presented as Bearer is refused. The response is a signed
disclosure: verify its detached signature against a key from the provider's key set (A5.4), check
that it names your client, the audience, your grant and the provider, and stop treating it as
current at its valid_until, which is at most five minutes after it was issued.
Each fresh response counts as one read and leaves a receipt in the person's log. GET /v1/grant
shows the grant you hold, and GET /v1/domains the granted keys that could currently be disclosed,
without counts.
See the REST reference for every route, header and limit.
Written against edition 1.0-draft-1: B4 REST binding