ProjectSecret network.project-secret@1

Generated at from openvibe-contracts v0.177.0 and openvibe-sdk v0.44.0.

Version
1.0.0
Owner
network
Visibility
first-party
Status
active
Compatibility
backward
Decision
ADR-056
Schema
https://openvibe.network/contracts/network/project-secret.v1.json

network.project-secret@1 (ADR-056): one project secret as OpenVibe.Network shows it to the project's members and staff — its name, environment, version, a keyed fingerprint and its grants. Never the value: a secret is written once and used by name (sign or reveal through network.secret.use).

Fields

FieldTypeRequiredDescriptionConstraints
project_idstringyes
  • pattern ^prj_[0-9A-HJKMNP-TV-Z]{26}$
environmentenumyes
  • one of "sandbox", "production"
namestringyes
  • pattern ^[a-z][a-z0-9_-]{0,63}$
versionintegeryesOne more each time the value is set again.
  • minimum 1
fingerprintstringyesA keyed hash of the value: equal values have equal fingerprints, and it reveals nothing else.
  • pattern ^[0-9a-f]{12}$
grantshttps://openvibe.network/contracts/network/project-secret.v1.json#/$defs/grantyes
  • maxItems 20
created_atstringyes
  • format date-time
created_byhttps://openvibe.network/contracts/network/project-secret.v1.json#/$defs/subjectyes
updated_atstringyes
  • format date-time
updated_byhttps://openvibe.network/contracts/network/project-secret.v1.json#/$defs/subjectyes

Examples

From the contract's own test fixtures: valid ones validate, rejected ones must fail.

Valid: reveal-grant
{
  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
  "environment": "production",
  "name": "api_token",
  "version": 1,
  "fingerprint": "3fa9c1d0be72",
  "grants": [
    {
      "service": "watch",
      "purposes": [
        "reveal"
      ],
      "origins": [
        "https://api.example.com"
      ],
      "created_at": "2026-10-15T05:00:00Z",
      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
      "last_used_at": "2026-10-15T05:30:00Z"
    }
  ],
  "created_at": "2026-10-15T04:58:00Z",
  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
  "updated_at": "2026-10-15T05:10:00Z",
  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"
}
Valid: signing-key
{
  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
  "environment": "production",
  "name": "webhook-signing",
  "version": 2,
  "fingerprint": "3fa9c1d0be72",
  "grants": [
    {
      "service": "actor",
      "purposes": [
        "sign"
      ],
      "origins": [],
      "created_at": "2026-10-15T05:00:00Z",
      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
      "last_used_at": null
    }
  ],
  "created_at": "2026-10-15T04:58:00Z",
  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
  "updated_at": "2026-10-15T05:10:00Z",
  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"
}
Rejected: http-origin
{
  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
  "environment": "production",
  "name": "webhook-signing",
  "version": 2,
  "fingerprint": "3fa9c1d0be72",
  "grants": [
    {
      "service": "watch",
      "purposes": [
        "reveal"
      ],
      "origins": [
        "http://api.example.com"
      ],
      "created_at": "2026-10-15T05:00:00Z",
      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
      "last_used_at": null
    }
  ],
  "created_at": "2026-10-15T04:58:00Z",
  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
  "updated_at": "2026-10-15T05:10:00Z",
  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"
}
Rejected: upper-name
{
  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
  "environment": "production",
  "name": "Webhook",
  "version": 2,
  "fingerprint": "3fa9c1d0be72",
  "grants": [
    {
      "service": "actor",
      "purposes": [
        "sign"
      ],
      "origins": [],
      "created_at": "2026-10-15T05:00:00Z",
      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
      "last_used_at": null
    }
  ],
  "created_at": "2026-10-15T04:58:00Z",
  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
  "updated_at": "2026-10-15T05:10:00Z",
  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"
}
Rejected: with-value
{
  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
  "environment": "production",
  "name": "webhook-signing",
  "version": 2,
  "fingerprint": "3fa9c1d0be72",
  "grants": [
    {
      "service": "actor",
      "purposes": [
        "sign"
      ],
      "origins": [],
      "created_at": "2026-10-15T05:00:00Z",
      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
      "last_used_at": null
    }
  ],
  "created_at": "2026-10-15T04:58:00Z",
  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
  "updated_at": "2026-10-15T05:10:00Z",
  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
  "value": "hunter2"
}

Validate

const contracts = require('openvibe-contracts');
contracts.validate('network.project-secret@1', value);   // { valid, errors: [{ path, message }] }