# `BoundedAuthorityProtocol.V1.SigningInput`
[🔗](https://github.com/baselabs/bounded_authority_protocol/blob/v1.0.0/lib/bounded_authority_protocol/v1/signing_input.ex#L1)

Closed deterministic standard-JWS signing input.

Sign `message` with the matching private key outside this library, then pass the signing input and
the raw signature to the major's `assemble_compact/3` (for example `BoundedAuthorityProtocol.V1.assemble_compact/3`).

## Fields

* `kind` - which compact this input builds (`:grant`, `:proof`, `:local_loopback_http_proof`,
  `:boundary_anchor`, `:key_transition`, `:role_attestation` or `:content_assertion`).
* `protected_segment` - the base64url-encoded JCS protected header. Redacted by `inspect/2`.
* `payload_segment` - the base64url-encoded JCS payload. Redacted by `inspect/2`.
* `message` - the exact RFC 7515 signing input `protected_segment <> "." <> payload_segment`.
  Redacted by `inspect/2`.

# `t`

```elixir
@type t() :: %BoundedAuthorityProtocol.V1.SigningInput{
  kind:
    :grant
    | :proof
    | :local_loopback_http_proof
    | :boundary_anchor
    | :key_transition
    | :role_attestation
    | :content_assertion,
  message: binary(),
  payload_segment: binary(),
  protected_segment: binary()
}
```

The exact bytes a signer signs.

---

*Consult [api-reference.md](api-reference.md) for complete listing*