{
  "$id": "https://schema.nfh.global/AckSignature/v2.0",
  "x-iri": "https://schema.nfh.global/AckSignature/v2.0",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Beckn HTTP Ack Signature",
  "description": "A digitally signed authentication credential transmitted in the HTTP `Signature` response header on every synchronous Beckn response, proving that the responding NP received and authenticated the specific inbound request.\n\nThe responding actor produces this by signing a four-line canonical signing string with its Ed25519 private key:\n\n    (created): {unix_timestamp}\n    (expires): {unix_timestamp}\n    digest: BLAKE2b-512={base64_response_body_hash}\n    request-signature: {incoming_request_raw_base64_signature}\n\nThe fourth line (`request-signature`) contains the raw Base64 Ed25519 signature value extracted verbatim from the `signature=\"...\"` field of the incoming request's `Authorization` header. This binds the Ack cryptographically to the specific signed request that triggered it.\n\nThe `headers` attribute MUST be `\"(created) (expires) digest request-signature\"`. The `keyId` identifies the responding NP. The algorithm MUST be `ed25519`. The body digest covers the response body using BLAKE2b-512.\n\nUsed for: all synchronous HTTP responses across all Beckn endpoints. For request signing, see Signature. For PN solicited callback signing, see CallbackSignature. See NFH-004 Authentication and Trust §5 for the full response signing procedure.",
  "type": "string",
  "pattern": "^Signature keyId=\"[^\"]+\",algorithm=\"ed25519\",created=\"\\d+\",expires=\"\\d+\",headers=\"\\(created\\) \\(expires\\) digest request-signature\",signature=\"[A-Za-z0-9+/]+=*\"$",
  "example": "Signature keyId=\"example.ns/gro.example/bpp-key-001|ed25519\",algorithm=\"ed25519\",created=\"1714000060\",expires=\"1714000660\",headers=\"(created) (expires) digest request-signature\",signature=\"ACKSIGNATURE==\""
}