Connection Token

Signed grant representing an approved pairing between two agents. Includes scopes, obligations, and the Cedar policy hash.

$id: https://arp.spec/schema/connection-token/v0.1.jsonDOWNLOAD JSON

FIELDS

pattern: ^conn_[A-Za-z0-9_-]{4,}$

Principal DID who authored the token

pattern: ^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$

Agent DID the token runs under

pattern: ^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$

Counterparty agent DID

pattern: ^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$

Free-text purpose label

One or more compiled Cedar policy strings

Catalog version pinned at pairing time (e.g. "v1")

Absolute expiry (ISO 8601)

Map of signer label → signature (base64url). Both connection parties must sign.

EXAMPLE PAYLOAD

{
  "connection_id": "…",
  "issuer": "…",
  "subject": "…",
  "audience": "…",
  "purpose": "…",
  "cedar_policies": [],
  "scope_catalog_version": "…",
  "expires": "…",
  "sigs": {}
}

Examples are generated from schema metadata (examples array if present, otherwise a synthesised skeleton from the required fields). Always re-validate against the schema before shipping payloads.