# `BoundedAuthorityProtocol.V1.EnvelopeFacts`
[🔗](https://github.com/baselabs/bounded_authority_protocol/blob/v1.0.0/lib/bounded_authority_protocol/v1/envelope_facts.ex#L1)

Closed value-bearing, redacted, non-authorizing verified envelope facts.

## Fields

* `version` - the contract-major, always `1`.
* `issuer` - the verified `iss` claim.
* `grant_id` - the verified `jti` claim.
* `issuer_key_fingerprint` - the raw 32-byte RFC 7638 thumbprint of the trusted issuer public key
  the caller supplied.
* `holder_thumbprint` - the raw 32-byte RFC 7638 thumbprint the grant confirms (`cnf.jkt`).
* `matched_audience` - the expected audience, which the grant's `aud` contains.
* `issued_at` - the grant `iat`, integer Unix time in seconds.
* `not_before` - the grant `nbf`, integer Unix time in seconds.
* `expires_at` - the grant `exp`, integer Unix time in seconds.
* `authorization` - always `:not_evaluated`: these facts are never an authorization decision.
* `proof_id` - the verified proof `jti`.
* `invocation_id` - the verified `ba_inv`; reserve it against replay yourself.
* `operation` - the verified operation name.
* `target_uri` - the verified normalized target URI.
* `grant_hash` - the raw 32-byte SHA-256 of the grant compact the proof is bound to.
* `request_hash` - the raw 32-byte request digest the proof is bound to.
* `proof_issued_at` - the proof `iat`, integer Unix time in seconds.

# `t`

```elixir
@type t() :: %BoundedAuthorityProtocol.V1.EnvelopeFacts{
  authorization: :not_evaluated,
  expires_at: integer(),
  grant_hash: binary(),
  grant_id: binary(),
  holder_thumbprint: binary(),
  invocation_id: binary(),
  issued_at: integer(),
  issuer: binary(),
  issuer_key_fingerprint: binary(),
  matched_audience: binary(),
  not_before: integer(),
  operation: binary(),
  proof_id: binary(),
  proof_issued_at: integer(),
  request_hash: binary(),
  target_uri: binary(),
  version: 1
}
```

Facts from a verified grant and proof.

---

*Consult [api-reference.md](api-reference.md) for complete listing*