Cover

Certificates

How CoverGate reads and verifies an AIPS-1 Policy Certificate.

The AIPS-1 Certificate Resolver verifies issuer identity, signatures, active status, scope, limits, and revocation.

Certificate fields#

The sandbox uses a draft certificate format, marked AIPS-1-draft.

Field	Meaning
`spec`	Certificate format
`id`	Certificate id
`agent`	The agent it covers
`issuer`	The issuer, which must be in the Issuer Registry
`issuedAt`, `expiresAt`	The active period
`scope`	Covered action types and assets
`limit`	Coverage limit
`deductible`	First-loss deductible
`claimTriggers`	Failures that can start a claim
`exclusions`	Actions the certificate does not cover
`settlement`	The settlement route

Issuer Registry#

The registry lists recognized certificate issuers, so a certificate from an unknown issuer is denied with ISSUER_UNKNOWN. A signature that does not match the issuer key is denied with SIGNATURE_INVALID.

Validate before registering#

The Issuer Toolkit helps cover providers publish AIPS-1 certificates that the resolver can read. In the sandbox it is a validator and registration flow.

bash

curl -X POST https://dapp.covergate.app/api/v1/certificates/validate \
  -H "content-type: application/json" \
  -d '{ "payload": "<certificate JSON>", "signature": "<signature>" }'

The response is { "valid": true, "problems": [] }, or valid: false with the problems listed.

Test certificates#

The sandbox has its own issuer, covergate-sandbox. Your own agents can get a certificate from it, with no signature of yours needed. It lasts 90 days, with a 25,000 limit and a 250 deductible. It is test data, and it covers nothing real.

bash

curl -X POST https://dapp.covergate.app/api/v1/sandbox/certificates \
  -H "content-type: application/json" \
  -d '{ "agentId": "<agent id>" }'