For developers
Signed context
A fixed JWT envelope, an arbitrary JSON Schema for data, and strict binding validation.
Updated: August 7, 2026
01
Minimum JWT
jsonKanyman docs
{
"schema": "kanyman.external-context.v1",
"integration_id": "ext_...",
"subject": "usr_f81c39",
"page": { "path": "/projects/301", "locale": "en" },
"entities": [{ "type": "project", "ref": "prj_71bd2a" }],
"event": { "code": "DELIVERY_FAILED", "request_id": "req_b73a" },
"data": { "delivery_ready": false },
"iss": "your-product-support",
"aud": "kanyman:web-chat",
"iat": 1786093200,
"exp": 1786093500,
"jti": "ctx_01J..."
}02
What Kanyman validates
- An RS256 or ES256 signature using the registered PEM/JWKS.
- Exact matches for issuer, audience, integration_id, Origin, and Web Chat binding.
- A lifetime of no more than five minutes and valid iat/exp values.
- A one-time jti; reuse is allowed only as an idempotent retry for the same session creation.
- Token and payload size.
- The fixed envelope and compliance of data with the registered Draft 2020-12 JSON Schema.
03
Field visibility
jsonKanyman docs
{
"type": "string",
"title": "Provider",
"x-kenyman-visibility": "both",
"x-kenyman-sensitive": false
}x-kenyman-visibility accepts agent, operator, both, or hidden. A field with x-kenyman-sensitive: true is not sent to either the agent or operator regardless of visibility.
04
Storage
Kanyman stores an encrypted snapshot, the subject digest, and jti. The original JWT is not stored. By default, snapshots are deleted after 30 days and tool audit records after 90 days.