Pca

Designing PIC-X: Exposing Configuration through .well-known/pic-x-configuration 2026-08-01

When PIC-X starts, it exposes its public configuration at:

http://127.0.0.1:5556/pic-x/.well-known/pic-x-configuration

The document exposes public endpoints and supported protocol capabilities. Internal Exchange Profiles are not exposed.

PIC-X Discovery Document

{
  "issuer": "http://127.0.0.1:5556/pic-x",
  "profile": "https://pic-protocol.org/0.1",

  "token_endpoint": "http://127.0.0.1:5556/pic-x/token",
  "revocation_endpoint": "http://127.0.0.1:5556/pic-x/revoke",
  "jwks_uri": "http://127.0.0.1:5556/pic-x/keys",

  "attestation_endpoint": "http://127.0.0.1:5556/pic-x/attestations",
  "trust_anchors_endpoint": "http://127.0.0.1:5556/pic-x/trust-anchors",

  "grant_types_supported": [
    "urn:ietf:params:oauth:grant-type:token-exchange"
  ],

  "subject_token_types_supported": [
    "urn:ietf:params:oauth:token-type:jwt",
    "https://pic-protocol.org/0.1/token-types/pca-envelope"
  ],

  "issued_token_types_supported": [
    "https://pic-protocol.org/0.1/token-types/pca-envelope"
  ],

  "token_endpoint_auth_methods_supported": [
    "none"
  ],

  "pca": {
    "signing_alg_values_supported": [
      "ES256"
    ],
    "lineage_modes_supported": [
      "centralized",
      "snapshot-based-subchain"
    ]
  }
}

1. Issuer and Protocol Profile

{
  "issuer": "http://127.0.0.1:5556/pic-x",
  "profile": "https://pic-protocol.org/0.1"
}

issuer identifies the PIC-X deployment.