The contract, run in your browser.
The Test Mode reference contract as an interactive reference: four endpoints, a request signer that reproduces B5RequestSigner.cs, the five published decision records with their OCSF Authority evidence, the evidence digest rule and the webhook verifier. Nothing you type leaves the page.
Truth-in-labeling. This explorer renders the reference starter contract published in Developer Tools (OpenAPI 0.1.0-reference) and the signing and verification code shipped in the .NET quick start. The authoritative contract is generated and published from build-certified B5 endpoints; Test Mode base URLs, credentials and keys are issued per tenant. The signer, the digest and the verifier compute real values with WebCrypto against demo inputs — no request is sent to any B5 service.
API Explorer
Pick a tab. Each one is backed by a published artefact — the OpenAPI starter, B5RequestSigner.cs, the five authority samples, EVIDENCE-FORMAT.md, B5WebhookVerifier.cs — not by invented data.
Endpoints (Test Mode reference contract)
GET /health— Health: Confirm assigned Test Mode endpoint availability.POST /v1/trust/decisions— Evaluate trust: Evaluate action, resource, identity, entitlement, and context.GET /v1/evidence/{evidenceId}— Get evidence: Retrieve permitted evidence for an authorized caller.POST /v1/test/webhooks/simulate— Simulate webhook: Exercise signed-event delivery in Test Mode.
Signed request headers
X-B5-Tenant-Id— Your tenant identifier (issued).X-B5-Application-Id— The application identifier (issued).X-B5-Key-Id— The key identifier the signature was made with.X-B5-Timestamp— ISO-8601 UTC timestamp of the request (round-trip "O" format).X-B5-Nonce— 16 random bytes, lowercase hex. Replayed nonces are refused (409).X-B5-Content-SHA256— SHA-256 of the exact request body, lowercase hex.Authorization— B5-HMAC-SHA256 <base64 signature>
Published decision records
- Allowed — in scope (ALLOW_SCOPE_MATCH)
- Denied — account not in grant (DENY_SCOPE_ACCOUNT_NOT_IN_GRANT)
- Denied — daily amount exceeded (DENY_LIMIT_DAILY_AMOUNT_EXCEEDED)
- Denied — grant revoked in flight (DENY_GRANT_REVOKED_IN_FLIGHT)
- Shadow — would have differed (DENY_SCOPE_FIELD_NOT_IN_GRANT)
Packages
- B5SecurityKit — 77 types
- B5SecurityKit.Authorization — 12 types
- B5SecurityKit.AuthProviders — 20 types
- B5SecurityKit.Net — 32 types
- B5SecurityKit.NetCore — 4 types
- B5SecurityKit.NetCore.Middleware — 2 types
- B5SecurityKit.NetFramework.Mvc — 5 types
- B5SecurityKit.NetFramework.WebApi — 6 types
- B5SecurityKit.ServiceStack — 34 types
- B5SecurityKit.ServiceStack.Validators — 2 types
- B5SecurityKit.Xss — 4 types
The interactive explorer needs JavaScript. This index is the same catalog, as a list.
Where each tab comes from
Every value shown is read from a file you can download from this site. Change the file and the tab changes with it.
OpenAPI starter + Postman
The four operations, their purposes and response codes come from b5-reference-starter.yaml and the Test Mode Postman collection in Developer Tools.
B5RequestSigner.cs
The eight-line canonical string, the body digest and the Base64 HMAC are computed the way the reference signer in the .NET quick start computes them.
Five authority samples
The five schema-validated OCSF Authorization Decision records — one permit, three denials, one shadow evaluation — exactly as published for the authority extension.
b5-evidence/1
The canonicalisation rule, the required fields and the eight verifier checks are quoted from the published evidence format; the digest is computed here, offline.
B5WebhookVerifier.cs
Freshness window, four-line canonical string, HMAC and constant-time comparison, as the reference verifier does them.
The security pipeline
The stages every protected request passes, the [Protect] attribute family and the eleven B5SecurityKit namespaces with their type counts.
Then make the first real call
Test Mode is a sealed rehearsal room: placeholder credentials, a tenant-issued base URL, and every failure path — expired timestamp, replayed nonce, wrong audience, missing scope, duplicate webhook — exercised before staging.
Talk to a human.
Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.