signature_profile_invalid

Signature doesn't follow the profile

HTTP 401

The signature headers don't follow the gap-v2 profile: one signature labelled sa in Signature-Input and Signature; covering @method and @target-uri, then content-digest and idempotency-key on POST and PATCH (on GET and HEAD, idempotency-key exactly when it is sent), then x-sa-environment; with the parameters created, nonce, keyid, alg (ed25519 or ecdsa-p256-sha256) and tag="gap-v2", in that order; a 64-byte signature; an Idempotency-Key of 1 to 255 visible ASCII characters (! to ~, no spaces); X-SA-Environment of TEST or PRODUCTION; and no Authorization header beside them. Nothing about the credential was checked.

The problem body

Sent as application/problem+json, with the request id in request_id and the X-Request-Id header. Branch on code: the error and detail sentences can change, and some operations add members of their own.

Example problem

{
  "error": "Signature doesn't follow the profile",
  "code": "signature_profile_invalid",
  "type": "https://secondappraisal.com/developers/errors/signature_profile_invalid",
  "title": "Signature doesn't follow the profile",
  "status": 401,
  "detail": "Signature doesn't follow the profile",
  "instance": "/api/gap/v1/referrals",
  "request_id": "req_4f9a2c7e1b8d4a6f9c3e2b1a7d5f8e0c"
}

Operations that can send it

POST /api/gap/v1/referrals · HTTP 401 · Create a referral
GET /api/gap/v1/referrals · HTTP 401 · List referrals
GET /api/gap/v1/referrals/{id} · HTTP 401 · Retrieve a referral
PATCH /api/gap/v1/referrals/{id} · HTTP 401 · Update or cancel a referral
POST /api/gap/v1/referrals/bulk · HTTP 401 · Create referrals in bulk
POST /api/gap/v1/referrals/{id}/simulate · HTTP 401 · Simulate a sandbox referral's next stepAt launchIt opens with the referral sandbox.
POST /api/gap/v1/referrals/{id}/attest · HTTP 401 · Attest a warm handoffAt launchIt opens with the referral sandbox.
GET /api/gap/v1/analytics · HTTP 401 · Savings and spend analytics
POST /api/gap/v1/plans/enrollments · HTTP 401 · Enroll one vehicle
GET /api/gap/v1/plans/enrollments · HTTP 401 · List your roster
GET /api/gap/v1/plans/enrollments/{id} · HTTP 401 · Retrieve one enrollment
PATCH /api/gap/v1/plans/enrollments/{id} · HTTP 401 · Cancel, swap the VIN, or edit contact details
POST /api/gap/v1/plans/enrollments/bulk · HTTP 401 · Enroll up to 500 vehicles
POST /api/gap/v1/plans/roster-sync · HTTP 401 · Reconcile your full roster
POST /api/gap/v1/plans/loss-notices · HTTP 401 · Tell us a member vehicle was declared a total loss
GET /api/gap/v1/plans/redemptions · HTTP 401 · Member consultations drawn against your roster
GET /api/gap/v1/plans/statements · HTTP 401 · Your monthly membership statements
GET /api/gap/v1/events · HTTP 401 · List your eventsAt launchIt opens with the partner security platform.
GET /api/gap/v1/me · HTTP 401 · The key making this call
POST /api/gap/v1/credentials/{id}/verify · HTTP 401 · Activate a signed credentialAt launchIt opens when signed credentials open.
POST /api/gap/v1/signature-check · HTTP 401 · Check a signature (test credentials)Planned: not served yet.
POST /api/gap/v1/review-status/lookup · HTTP 401 · Look up review status by VIN, claim number or referenceAt launchIt opens with review records.
GET /api/gap/v1/referrals/{id}/review-record · HTTP 401 · Retrieve a referral's review recordAt launchIt opens with review records.