{
  "service": "regarde clearing gate",
  "clearinghouse": "did:regarde:clearinghouse:demo",
  "endpoints": {
    "POST /v0/grant": "the SUBJECT grants, with an assertion signed by their own key",
    "POST /v0/revoke": "the SUBJECT withdraws, signed by the same key; names the processors to notify",
    "POST /v0/gateway": "a deployer relays an authenticated player's chosen scope (token-gated); returns the desk's outcome, receipt and counter",
    "POST /v0/ask": "a venue routes a federation request; returns a decision and a signed receipt",
    "POST /v0/withdraw": "withdraw a grant; returns a signed receipt naming the processors to notify",
    "POST /v0/enroll": "deployer-asserted grants (token-gated legacy path; refused once a subject holds a key)",
    "POST /v0/submission": "private content-addressed media intake; deployer token and live capability required",
    "POST /v0/media": "read a submitted hash within its live capability and stored category",
    "GET /v0/head": "the chain's current length and head",
    "GET /.well-known/jwks.json": "the public key receipts verify against"
  },
  "standing_limits": [
    "Receipts sign under a demo key. Key custody is not implemented; these are demo artifacts, not evidence of an issuer.",
    "One venue, one clearinghouse instance. Multi-venue routing is funded, not built.",
    "Withdrawal propagation is a signed instruction, not an enforcement: the receipt names the processors and proves the subject asked. Nothing here reaches out to them.",
    "A subject who signs a grant binds their key on first use. From then on only that key can change their grants — not the deployer, not the enrollment token, not us. What trust-on-first-use does NOT establish is who held the key at binding time; that is identity proofing and it is not solved here.",
    "The deployer-asserted /v0/enroll path remains for subjects who hold no key, and is refused for any subject who does."
  ]
}