Local/edge simulator of GFNet — control plane (gfnet-api) + GRAIN gateway/message fabric (gfnet-gateway). Synthetic data only, NOT production.
Issuer: https://api.gfnet.dev · Gateway keys: /.well-known/jwks.json · Health: /health
| Method | Path | Purpose |
|---|---|---|
| GET | /health | liveness + network + release identity |
| GET | /version | release identity {name, version, gitSha} |
| GET | /.well-known/jwks.json | GFNet gateway co-sign public keys |
| GET | /_idp/.well-known/jwks.json | mock-IdP token verification keys |
| POST | /oauth2/token | mint a JWT {sub, scopes?, participant?} |
| POST | /_dev/jwt | dev: mint a JWT (env-gated) |
| POST | /v1/entities | register an entity (issues a 6-char GRN) |
| GET | /v1/entities/:grn | fetch an entity |
| POST | /v1/signing-keys | register a participant ES256 key |
| POST | /v1/invites | create an invite |
| POST | /v1/invites/:id/accept | accept -> relationship + roles |
| POST | /v1/entitlements | grant an entitlement |
| GET | /v1/entitlements/check | hot-path scope check {subscriber, entity} |
| POST | /v1/services | register a service group + instance |
| GET | /v1/services/:group | discover a service |
| GET | /v1/catalogues | list catalogues |
| POST | /v1/services/:ref/invoke | GATEWAY: run a signed GRAIN request through the pipeline |
| GET | /v1/outbox | inspect routed + fanout outbox rows |
| GET | /v1/plans | list plans |
No PII on the network — GRNs only. Three-layer auth (JWT → FGA → entitlement, +plan cap on writes), fail-closed. Every network-visible mutation goes through the transactional outbox. JCS (RFC 8785) + ES256 for every GRAIN signature.