{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://autoagentprotocol.org/v3.1/schemas/poppy-browser-session-request.schema.json",
  "title": "PoppyBrowserSessionRequest",
  "description": "PAP 0.3 browser form POST. The browser supplies its __Host- join cookie. code is single-use, at least 128 random bits, expires within 60 seconds and is read only from the own browser endpoint page. proof is a Session-key DPoP JWS with nonce=code, htm=POST, htu=endpoint and no ath. Runtime verification is mandatory.",
  "type": "object",
  "required": [
    "code",
    "proof"
  ],
  "properties": {
    "code": {
      "type": "string",
      "minLength": 1
    },
    "proof": {
      "type": "string",
      "minLength": 1,
      "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$",
      "description": "Compact signed JWS. Structural validation is not signature verification."
    },
    "assertion": false,
    "return_to": false,
    "session_id": false
  },
  "additionalProperties": true
}