{
  "$comment": "Normative FTID-HMAC-SHA256-V1 test vector for POST /v1/assessments. The secret exists only to reproduce the test.",
  "status": "NORMATIVE",
  "protocol": "FTID-HMAC-SHA256-V1",
  "algorithm": "HMAC-SHA-256",
  "assumed_received_at": "2026-09-04T12:00:00Z",
  "secret_encoding": "hex",
  "canonical_string_format": "protocol\\nkey_id\\nmethod\\npath\\ntimestamp\\nsigned_id_name:signed_id_value\\nattempt_id_name:attempt_id_value\\ncontent_type\\ncontent_encoding\\nsha256_hex(body_bytes)",
  "rules": [
    "the test secret is the 32-byte sequence 00..1f, not the hexadecimal text in UTF-8",
    "the body is encoded as UTF-8 and hashed over its exact bytes, without parsing or reserializing",
    "the string uses LF between exactly ten lines and has no trailing LF",
    "key_id and request_id use canonical lowercase UUIDv7",
    "the canonical Content-Type is application/json and the canonical Content-Encoding is empty",
    "the MAC is 64 lowercase hexadecimal characters"
  ],
  "input": {
    "secret_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
    "key_id": "01996f2a-1111-7000-8000-000000000001",
    "method": "POST",
    "path": "/v1/assessments",
    "timestamp": 1788523200,
    "signed_id": {
      "name": "external_event_id",
      "value": "login_20260904_000001"
    },
    "attempt_id": {
      "name": "request_id",
      "value": "01a06c4a-3e00-7000-8000-000000000002"
    },
    "content_type": "application/json",
    "content_encoding": "",
    "body_utf8": "{\"schema_version\":\"event-assessment-request.v1\",\"external_event_id\":\"login_20260904_000001\",\"idempotency_key\":\"idem_login_20260904_000001\",\"occurred_at\":\"2026-09-04T12:00:00Z\",\"subject_ref\":\"subject_123\",\"account_ref\":\"account_456\",\"event_context_token\":\"ect_login_20260904_000001\",\"journey\":\"LOGIN\",\"action\":\"LOGIN_ATTEMPT\",\"journey_context\":{},\"deadline_ms\":null}"
  },
  "intermediate": {
    "sha256_hex_body": "f7cdd806f169384d0cc3bf5f63654999d5b78aa68045da4ddce075b09953bd44",
    "canonical_string": "FTID-HMAC-SHA256-V1\n01996f2a-1111-7000-8000-000000000001\nPOST\n/v1/assessments\n1788523200\nexternal_event_id:login_20260904_000001\nrequest_id:01a06c4a-3e00-7000-8000-000000000002\napplication/json\n\nf7cdd806f169384d0cc3bf5f63654999d5b78aa68045da4ddce075b09953bd44"
  },
  "expected_mac": "df9016da863e7fc4949f1845fb9457d1e3f165d427d1c8efd47af44eff86851b",
  "headers": {
    "Content-Type": "application/json",
    "X-FTID-External-Event-Id": "login_20260904_000001",
    "X-FTID-Request-Id": "01a06c4a-3e00-7000-8000-000000000002",
    "X-FTID-Signature": "v1=01996f2a-1111-7000-8000-000000000001:df9016da863e7fc4949f1845fb9457d1e3f165d427d1c8efd47af44eff86851b",
    "X-FTID-Timestamp": "1788523200"
  }
}