Designing PIC-X: Exposing Configuration through .well-known/pic-x-configuration

nicola.gallo@nitroagility.com (Nicola Gallo) — Sat, 01 Aug 2026 11:00:00 +0200

Designing PIC-X. Exposing Configuration through .well-known/pic-x-configuration.

When PIC-X starts, it exposes its public configuration at:

http://127.0.0.1:5556/pic-x/.well-known/pic-x-configuration

The document exposes public endpoints and supported protocol capabilities. Internal Exchange Profiles are not exposed.

PIC-X Discovery Document

{
 "issuer": "http://127.0.0.1:5556/pic-x",
 "profile": "https://pic-protocol.org/0.1",

 "token_endpoint": "http://127.0.0.1:5556/pic-x/token",
 "revocation_endpoint": "http://127.0.0.1:5556/pic-x/revoke",
 "jwks_uri": "http://127.0.0.1:5556/pic-x/keys",

 "attestation_endpoint": "http://127.0.0.1:5556/pic-x/attestations",
 "trust_anchors_endpoint": "http://127.0.0.1:5556/pic-x/trust-anchors",

 "grant_types_supported": [
 "urn:ietf:params:oauth:grant-type:token-exchange"
 ],

 "subject_token_types_supported": [
 "urn:ietf:params:oauth:token-type:jwt",
 "https://pic-protocol.org/0.1/token-types/pca-envelope"
 ],

 "issued_token_types_supported": [
 "https://pic-protocol.org/0.1/token-types/pca-envelope"
 ],

 "token_endpoint_auth_methods_supported": [
 "none"
 ],

 "pca": {
 "signing_alg_values_supported": [
 "ES256"
 ],
 "lineage_modes_supported": [
 "centralized",
 "snapshot-based-subchain"
 ]
 }
}

1. Issuer and Protocol Profile

{
 "issuer": "http://127.0.0.1:5556/pic-x",
 "profile": "https://pic-protocol.org/0.1"
}

issuer identifies the PIC-X deployment.

Pca on

Designing PIC-X: Exposing Configuration through .well-known/pic-x-configuration

PIC-X Discovery Document

1. Issuer and Protocol Profile