Publish a signed entry

Prerequisites

An operator must supply the registry URL, supported authentication audience/profile, publisher trust configuration, and a principal with publish_entry. A publisher also needs its controlled Ed25519 key and a valid entry DID/payload schema. A session token and a publisher signature serve different purposes.

Prepare the entry

Build the required wire fields using a canonical EntryType.
Validate the payload against itemSchemaUri, then call compute_item_data_hash for itemDataHash.
Compute canonical_signing_bytes and sign with the controlled publisher key. The key controller must match the publisher.
Validate the completed typed entry and save it as signed-entry.json. Do not use the public fixture key or submit an empty signature.

The test vectors let you compare canonical bytes and signatures before connecting a real signer. See the protocol library for source-level APIs.

Authenticate

Request a SIWS challenge using the operator's configured audience. Have your supported wallet sign the returned challenge, preserving its nonce, audience, origin, root, chain, and expiry. Submit that challenge and signed response to verify. Never invent a wallet signature or silently replace the challenge fields.

Inspect session to confirm principal and granted capabilities. SIWS availability depends on enabled configuration; reserved OpenAgent/Arsenal profile names are not implemented adapters.

Submit once, retry safely

With MARS_REGISTRY_URL, MARS_SESSION_TOKEN, and MARS_IDEMPOTENCY_KEY set by your authenticated client, run:

curl --fail-with-body --silent --show-error   "$MARS_REGISTRY_URL/v1/entries"   -H "Authorization: Bearer $MARS_SESSION_TOKEN"   -H "Idempotency-Key: $MARS_IDEMPOTENCY_KEY"   -H 'Content-Type: application/json'   --data-binary @signed-entry.json

Reuse the same key for the same mutation and payload after an uncertain network result. A new logical mutation gets a new key. Do not change the payload while reusing a key. Check the returned record and resolve it again; a registry commit is not proof of live chain anchoring.

Source authority

This page describes the checked-in implementation, not the availability of a public registry.

mars-server/src/api/mod.rs
mars-server/src/contracts.rs
docs/api/openapi.v1.json
mars-protocol/src/signature.rs
mars-server/src/auth/handlers.rs
mars-server/src/middleware/auth.rs