Tenant-verifiable Ed25519-signed cockpit snapshot (OCF-06)

GET

/api/v1/cockpit/snapshot

• Production
• Local development

Build + sign the 7-panel cockpit snapshot bundle.

Returns the response via Response(content=bytes, media_type="application/json") — NOT a plain dict — because FastAPI’s default JSON serialiser does not guarantee key ordering. Byte-exact output is required so a consumer can re-canonicalise the response (excluding the signature field) and verify the signature against the embedded public key with zero ambiguity.

Flow:

1. :class:CockpitSnapshotService collects per-panel state.
2. The signable subset (everything except signature) is canonicalised with sort_keys=True, separators=(',', ':').
3. :class:SnapshotSigner signs the canonical bytes with the tenant’s CEO Ed25519 private key.
4. The final response bytes are re-canonicalised from the signable payload plus the signature so the returned JSON is deterministic (signature-verifiers replay step 2 client-side).

Raises: HTTPException 422: No active CEO certificate for the tenant.

Authorizations

• ApiKeyAuth

Responses

200

Successful Response