AgentSubkeyRecord

PQSafe AgentPay API Reference v0.1.0

---

PQSafe AgentPay API Reference / AgentSubkeyRecord

Interface: AgentSubkeyRecord

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:125

Agent subkey record: scoped to a single agent identity. Signs envelopes on behalf of the agent; bounded by agentMaxAmount.

Extends

• KeyRecord

Properties

agentAllowedCurrencies

agentAllowedCurrencies: string[]

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:139

ISO 4217 currencies this subkey is permitted to sign. Empty = all currencies.

---

agentAllowedRails

agentAllowedRails: string[]

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:141

Rails this subkey is permitted to sign. Empty = all rails.

---

agentId

agentId: string

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:129

Agent identifier this subkey is scoped to.

---

agentMaxAmount

agentMaxAmount: number

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:137

Maximum amount this subkey can authorize per envelope. Enforced by the hosted issuer service during envelope creation. Verifiers MUST reject envelopes where amount > agentMaxAmount for agent subkeys.

---

createdAt

createdAt: string

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:60

ISO timestamp: when this key was generated.

Inherited from

KeyRecord.createdAt

---

keyId

keyId: string

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:54

Unique key ID (UUID v4). Used in certificates and audit logs.

Inherited from

KeyRecord.keyId

---

parentSpendKeyId

parentSpendKeyId: string

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:131

Parent spend key ID that derived this subkey.

---

publicKey

publicKey: string

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:58

Hex-encoded public key bytes.

Inherited from

KeyRecord.publicKey

---

revoked

revoked: boolean

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:66

Whether this key has been explicitly revoked (epoch advance or root revocation).

Inherited from

KeyRecord.revoked

---

revokedAt?

optional revokedAt?: string

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:68

ISO timestamp of revocation (if revoked = true).

Inherited from

KeyRecord.revokedAt

---

type

type: "agent"

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:126

---

validFrom

validFrom: string

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:62

ISO timestamp: not valid before this time.

Inherited from

KeyRecord.validFrom

---

validUntil

validUntil: string

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:64

ISO timestamp: not valid after this time.

Inherited from

KeyRecord.validUntil

---

variant

variant: "ml-dsa-44"

Defined in: pqsafe/agent-pay/src/sprint2/issuer.ts:127

ML-DSA variant for this key.

Overrides

KeyRecord.variant