{
  "service": "AnswerRail Edge Reverse Proxy",
  "release_version": "v1.1.0-parity-v20",
  "release_manifest_url": "https://answerrail.com/releases/v1.1.0-parity-v20/manifest.json",
  "golden_corpus_test_suite_url": "https://answerrail.com/tests/golden-corpus.test.ts",
  "user_agent": "AnswerRail-Edge-Proxy/1.1.0 (+https://answerrail.com/.well-known/answerrail-proxy.json; RFC9110)",
  "delegated_bot_header": "X-AnswerRail-For-Bot",
  "loop_guard_headers": [
    "X-AnswerRail-Subrequest: 1",
    "X-AnswerRail-Bypass: true",
    "X-AnswerRail-Origin-Fetch: 1"
  ],
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "kid": "ar_ed25519_2026_k1",
      "x": "W3Ce5nykyharINhDTj_EL5JtdEkz0_bcXrDsDN-vy3Y",
      "use": "sig",
      "alg": "EdDSA",
      "key_ops": [
        "verify"
      ],
      "ext": true
    }
  ],
  "request_signing": {
    "operation": "Operation A — Outbound Origin Subrequest Signing (signOutboundOriginRequest)",
    "standard": "RFC 9421 HTTP Message Signatures (Web Bot Auth)",
    "key_directory_url": "https://answerrail.com/.well-known/http-message-signatures-directory",
    "active_key_id": "ar_ed25519_2026_k1",
    "algorithm": "ed25519",
    "tag": "web-bot-auth",
    "covered_components": [
      "@method",
      "@authority",
      "@target-uri",
      "signature-agent",
      "x-answerrail-timestamp"
    ],
    "required_parameters": [
      "created",
      "expires",
      "nonce",
      "keyid",
      "alg",
      "tag"
    ],
    "signature_input_template": "sig1=(\"@method\" \"@authority\" \"@target-uri\" \"signature-agent\" \"x-answerrail-timestamp\");created=<unix_s>;expires=<created+300>;nonce=\"<16B_base64url>\";keyid=\"ar_ed25519_2026_k1\";alg=\"ed25519\";tag=\"web-bot-auth\"",
    "replay_protection": "Stateful verifier-side nonce replay rejection within [created, expires] window (checkAndRecordReplayNonce)",
    "headers": [
      "Signature-Agent",
      "Signature-Input",
      "Signature",
      "X-AnswerRail-Timestamp"
    ],
    "public_keys": [
      {
        "kty": "OKP",
        "crv": "Ed25519",
        "kid": "ar_ed25519_2026_k1",
        "x": "W3Ce5nykyharINhDTj_EL5JtdEkz0_bcXrDsDN-vy3Y",
        "use": "sig",
        "alg": "EdDSA",
        "key_ops": [
          "verify"
        ],
        "ext": true
      }
    ]
  },
  "response_provenance_signing": {
    "operation": "Operation B — Compiled Markdown Response Signing (generateProvenanceHeaders)",
    "standard": "RFC 9421 HTTP Message Signatures & RFC 9530 Content-Digest",
    "key_directory_url": "https://answerrail.com/.well-known/http-message-signatures-directory",
    "active_key_id": "ar_ed25519_2026_k1",
    "algorithm": "ed25519",
    "tag": "answerrail-response-provenance",
    "covered_components": [
      "content-digest",
      "@target-uri;req"
    ],
    "digest_header": "Content-Digest: sha-256=:<base64>:",
    "required_parameters": [
      "created",
      "expires",
      "nonce",
      "keyid",
      "alg",
      "tag"
    ],
    "signature_input_template": "sig1=(\"content-digest\" \"@target-uri\";req);created=<unix_s>;expires=<created+300>;nonce=\"<16B_base64url>\";keyid=\"ar_ed25519_2026_k1\";alg=\"ed25519\";tag=\"answerrail-response-provenance\"",
    "re_signed_on_cache_hit": true,
    "cache_hit_fail_closed": "Stale Signature-Input, Signature, and X-AnswerRail-Signature headers are deleted before mutating cache_age_seconds; if reSignFn fails or no key is present, Content-Digest and X-AnswerRail-Content-SHA256 are recomputed and unsigned headers are returned.",
    "headers": [
      "Content-Digest",
      "X-AnswerRail-Content-SHA256",
      "X-AnswerRail-Provenance",
      "Signature-Input",
      "Signature",
      "X-AnswerRail-Signature"
    ]
  },
  "canonical_cache_key_format": "https://cache.answerrail.internal/__ar_markdown_v1?target=<canonicalTarget>&lod=<compact|standard|deep>&mode=<twin|ast>[&schema=1]",
  "cache_key_notes": "Appends &schema=1 when schema=true or lod=deep. Outbound fetchOrigin omits caller Cookie, Authorization, and Accept-Language headers to prevent cross-session and cross-locale cache poisoning.",
  "fallback_header_contract": {
    "policy": "Fail-closed on incomplete/truncated Markdown representation; fail-open to unmodified raw origin HTML (or 502/504 if upstream origin is unreachable/5xx)",
    "headers": {
      "Cache-Control": "no-store, no-cache, must-revalidate",
      "X-AnswerRail-Cache": "BYPASS",
      "X-AnswerRail-Failsafe": "FAIL_CLOSED_ORIGIN_HTML",
      "X-AnswerRail-Fallback": "origin-html",
      "X-AnswerRail-Routing": "fail-closed-origin-truncated | fail-closed-currency-shortfall | fail-closed-faq-recall-shortfall | fail-closed-link-recall-shortfall"
    }
  },
  "cache_control_contract": {
    "compiled_proxy_markdown_responses": "computeDownstreamCacheControl honors origin no-store/no-cache/private (no-store, no-cache, must-revalidate + X-AnswerRail-Cache: BYPASS), caps origin s-maxage/max-age at public, max-age=min(14400, originTtl) (preserving must-revalidate), and defaults to public, max-age=3600, must-revalidate when origin omits max-age",
    "documentation_and_spec_routes": "public, max-age=60, must-revalidate",
    "parity_fallback_responses": "no-store, no-cache, must-revalidate (with X-AnswerRail-Cache: BYPASS)",
    "nextjs_middleware_responses": "private, no-cache, no-store, max-age=0, s-maxage=0, must-revalidate (with CDN-Cache-Control: no-store)",
    "robots_disallowed_responses": "private, no-store (with X-AnswerRail-Cache: BYPASS)"
  },
  "egress_network": {
    "provider": "Cloudflare Workers Anycast Network (ASN 13335)",
    "note": "Cloudflare Workers egress IPs are shared across Cloudflare tenants and cannot uniquely identify AnswerRail on their own. Origins and WAFs should authenticate AnswerRail subrequests cryptographically using the Ed25519 public keys published in keys / key_directory_url over the RFC 9421 Signature-Input and Signature headers (verifying created, expires, nonce, keyid, and alg=\"ed25519\")."
  },
  "footer": "AnswerRail Technical Documentation · Release v1.1.0-parity-v20 · Canonical Spec: https://answerrail.com/.well-known/answerrail-proxy.json"
}