{"service":"Castell · Open V2X PKI Testbed","tagline":"Built up. Taken down. Never fallen.","version":"0.28.1","release_date":"2026-10-11","operator":"SkyV2X","deployment":"prod","public_url":"https://pki.skyv2x.com","disclaimer":"ETSI/CCMS wire-aligned open testbed. Not a certified CCMS Trust Point. Best-effort.","spec_compliance":{"ts_102_940":"v2.1.1 architecture","ts_102_941":"v1.3.1 wire OER + v2.2.1 protocol semantics","ts_103_097":"v1.4.1 cert format COER + v2.2.1 MA profile (§7.2.6)","ts_103_759":"v2.2.1 + v2.1.1 misbehaviour reporting","ieee_1609_2":"2016/2022 security services"},"curves_supported":[{"name":"NIST P-256","asn1":"ecdsaNistP256","rfc":"RFC 6090 / FIPS 186-5"},{"name":"Brainpool P-256r1","asn1":"ecdsaBrainpoolP256r1","rfc":"RFC 5639"},{"name":"Brainpool P-384r1","asn1":"ecdsaBrainpoolP384r1","rfc":"RFC 5639"}],"authorization_modes":{"supported":["single"],"butterfly_supported":false},"trust_lists_state":{"ctl":{"issuer_hashedId8":"D5CC48BA56F87FCA","sequence":44,"next_update":1794015916,"sequences_available":[42,43,44]},"ectl":{"issuer_hashedId8":"B52CD033B4BA4AE4","sequence":132,"next_update":1797366055,"sequences_available":[132]}},"tlm_rotation":{"link_certificate_endpoint":"/gettlmlinkcertificate[/{hashedId8}]","link_certificate_present":false,"current_tlm_hashedid8":"B52CD033B4BA4AE4"},"trust_anchors":{"tlm":{"url":"/tlm","hashedId8":"B52CD033B4BA4AE4","sha256":"c81207507a923905ab6c4a4600d4394a0314725926ea26e9bc86fd090e0e61ff","hash_alg":"sha384","hash":"fd836c8c19f3ebb1421508b69e42403671212f26d7f25b69ea3756f94cf20aff7956de89629ef2c6b52cd033b4ba4ae4","role":"Trust List Manager"},"root_ca":{"url":"/trustanchor","hashedId8":"D5CC48BA56F87FCA","sha256":"9d4970b46f30eb5fb21dab31f14c5fc1de19898597689b46d5cc48ba56f87fca","role":"Root Certificate Authority"},"ma":{"url":"/ma","hashedId8":"7F86BAC4F35D6505","sha256":"3c1d5306ef3480f5b7906163f07c496f1a37d995ed9e5d347f86bac4f35d6505","role":"Misbehaviour Authority"}},"endpoints":{"trust_material":{"GET /trustanchor":"RCA cert (COER)","GET /tlm":"TLM cert (COER)","GET /ma":"MA cert (COER)","GET /cert/{name}":"Cert by name (root/tlm/ea/aa/ma/at{1..5})","GET /lookup/{hashedId8}":"Cert lookup by HashedId8"},"trust_lists":{"GET /getectl":"Full ECTL (alias of /getectl/{hashedId8})","GET /getectl/{hashedId8}":"Full ECTL signed by that TLM","GET /getdeltaectl/{hashedId8}":"Last delta ECTL","GET /getdeltaectl/{hashedId8}/{seq}":"Delta ECTL of that sequence; 404 if not archived","GET /ectl/federation":"Federated RCA list","GET /getctl/{hashedId8}":"Full RCA CTL","GET /getctl/{hashedId8}/{seq}":"Delta CTL of that sequence; 404 if not archived","GET /getcrl/{hashedId8}":"CRL signed by the RCA; no delta","GET /gettlmcertificate":"TLM cert (blind-bootstrap alias)","GET /gettlmcertificate/{hashedId8}":"TLM cert by HashedId8","GET /gettlmlinkcertificate":"TLM Link Certificate; 404 until the TLM rotates","GET /gettlmlinkcertificate/{hashedId8}":"TLM Link Cert by the old HashedId8"},"enrolment_authorization":{"POST /subscribers":"Apply as a subscriber (manufacturer | operator) → pending until approved","POST /subscribers/sandbox/token":"Sandbox subscriber token, no approval, Day-1 profile","GET /subscribers/me":"Subscriber record (Bearer token)","POST /subscribers/me/stations":"Register a station: public key, optional its_id, permissions and type","GET /subscribers/me/stations[/{its_id}]":"Station record: profile, blocked, ECs issued","POST /subscribers/me/stations/{its_id}/block | /unblock":"Blocklist the station's ECs for tickets and re-enrolment","PUT /subscribers/me/stations/{its_id}/key":"Rotate the station's canonical key","GET /subscribers/me/rejections":"Refusals for this fleet, aggregated, with their reason","POST /ec-request":"EnrolmentRequest","POST /at-request":"AuthorizationRequest","POST /v221/ec-request-decode":"Decode EC request wire, v2.2.1 (debug)","POST /v221/at-request-decode":"Decode AT request wire, v2.2.1 (debug)"},"misbehaviour":{"POST /mr":"Misbehaviour Report, testbed API (202 + JSON result)","POST /uploadMR-v1":"MR upload (alias of /SignedAndEncrypted)","POST /uploadMR-v1/SignedAndEncrypted":"ECIES(signedData); 200 empty on success","POST /uploadMR-v1/Signed":"signedData; 200 empty","POST /uploadMR-v1/Plain":"unsigned variant: 400","reporter_requirements":"AT with PSID 1618 and BitmapSsp (2 octets, bits 80h/40h); signer digest; generationTime within AT validity","versions":{"v2.2.1":"EtsiTs103759Mbr (Time64 + ThreeDLocation)","v2.1.1":"EtsiTs103759Data (legacy)"},"version_negotiation":"v2.2.1 first, then v2.1.1; /uploadMR-v1 rejects if neither decodes","reaction":"verified reports counted per offender; over threshold the AT is flagged as revocation candidate (manual, via CRL)"},"transparency":{"GET /conformance":"Subset chain audit"},"bench":{"GET /bench":"Workbench for C-ITS security objects","GET /bench/types":"Object types it decodes","POST /bench/decode":"Decode a security object","POST /bench/lint":"Check an object against the conformance catalogue","POST /bench/verify":"Verify a certificate chain against a trust anchor","GET /bench/samples[/{id}]":"Public reference objects"},"scms_ieee_1609_2_1":{"POST /scms/eca/enroll":"ECA enrollment (ScmsPdu)","POST /scms/aca/cert-request":"ACA cert request: EeRaCertRequest → one AT with linkage data, no cocoon expansion","POST /scms/decode":"Decode ScmsPdu OER → JSON (debug)","GET /scms/discovery":"SCMS discovery: interfaces and wire formats","GET /scms/bridge":"CCMS↔SCMS bridge mapping"}},"rate_limits":{"GET endpoints":"60/min/IP","POST /subscribers, POST /subscribers/sandbox/token":"10/min/IP","/subscribers/me/*":"60/min/IP","POST /ec-request":"10/min/IP","POST /at-request":"30/min/IP","POST /mr":"60/min/IP","/bench/*":"240/min/IP","/console/*":"120/min/IP","POST /console/api/login, /console/api/invites/{accept,preview}":"10/min/IP"}}