# `BoundedAuthorityProtocol.V2.DecodedProof`
[🔗](https://github.com/baselabs/bounded_authority_protocol/blob/v1.0.0/lib/bounded_authority_protocol/v2/decoded_proof.ex#L1)

Closed bounded decoded proof with explicitly unevaluated verification.

Returned by `BoundedAuthorityProtocol.V2.decode_proof/2` for diagnosis only; it is never a verified value.

## Fields

* `version` - the contract-major, always `2`.
* `proof_id` - the `jti` claim: non-empty StringOrURI of at most `identifier_bytes` (512) UTF-8
  bytes.
* `method` - the `htm` claim, byte-for-byte as signed.
* `target_uri` - the `htu` claim; decode refuses a value that is not already in normal form.
* `issued_at` - the `iat` claim, integer Unix time in seconds.
* `nonce` - the `nonce` claim, or `nil` when absent. Redacted by `inspect/2`.
* `invocation_id` - the `ba_inv` claim, a lowercase RFC 4122 UUID.
* `operation` - the `ba_op` claim, the operation name.
* `grant_hash` - the decoded `ath` claim: the raw 32-byte SHA-256 of the grant compact the proof
  names.
* `request_hash` - the decoded `ba_req` claim: the raw 32-byte request digest.
* `holder_public_key` - the holder's raw 32-byte Ed25519 public key, decoded from the header JWK.
* `holder_thumbprint` - the raw 32-byte RFC 7638 thumbprint of the header JWK.
* `verification` - always `:not_evaluated`: no signature, key or expected context was checked.

# `t`

```elixir
@type t() :: %BoundedAuthorityProtocol.V2.DecodedProof{
  grant_hash: binary(),
  holder_public_key: binary(),
  holder_thumbprint: binary(),
  invocation_id: binary(),
  issued_at: integer(),
  method: binary(),
  nonce: nil | binary(),
  operation: binary(),
  proof_id: binary(),
  request_hash: binary(),
  target_uri: binary(),
  verification: :not_evaluated,
  version: 2
}
```

An unverified decoded proof.

---

*Consult [api-reference.md](api-reference.md) for complete listing*