id: cbd554ed295849deba5947b9c178544c
parent_id: 
item_type: 1
item_id: efb6d30501f34e1f85f3a4549fda6b9c
item_updated_time: 1786726740391
title_diff: "[{\"diffs\":[[1,\"Clypeum KLMS REST API Flow\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":26}]"
body_diff: "[{\"diffs\":[[1,\"# KLMS REST API Flow\\\n\\\n## Authentication\\\n1. **POST** `{iam_base_url}/{iam_realm}/protocol/openid-connect/token`\\\n   - Form body: `grant_type=password&username=&password=&client_id=ccs`\\\n   - mTLS with client cert (PEM: cert + encrypted key from .p12, passphrase entered at runtime)\\\n   - Returns: `{ access_token, refresh_token, expires_in, ... }`\\\n   - Token sent via `x-clylypeum-token` header on subsequent requests\\\n\\\n## Background Token Refresh\\\n- Background thread polls every 30s\\\n- When token is near expiry, refreshes via `grant_type=refresh_token&refresh_token=<token>`\\\n- On refresh failure, falls back to full re-authentication\\\n- `SharedCcsClient` uses `Arc<Mutex<CcsClientInner>>` for thread-safe token access\\\n\\\n## CCS API Endpoints\\\nBase URL: `{klms.url}` = `https://dev.clypeum.secops.link/ford-fnv4-keyfob/ccs/v1`\\\n\\\n### GET /version\\\n- Returns: `HashMap<String, String>` with version info\\\n- Auth: `x-clypeum-token` header\\\n\\\n### GET /cryptoContainerTypes\\\n- Returns: `HashMap<String, Value>` keyed by type ID (e.g. `0x001d`, `0x0900`)\\\n- Each entry: `{ Chip, Name, Description }`\\\n\\\n### POST /seeds\\\n- Returns: `{ seed: \\\"<hex string>\\\", seedUUID: \\\"<uuid>\\\" }`\\\n- Seed is a hex string, decoded to Vec<u8> on our side\\\n- Used to derive AES key for inner-layer payload encryption\\\n\\\n### POST /cryptoContainers\\\n- Form body: `typeID`, `seedUUID`, `productSerial`, `extra` (JSON string)\\\n- **Extra JSON structure** for production container:\\\n  ```json\\\n  {\\\n    \\\"transaction_id\\\": \\\"txn-XXXX\\\",\\\n    \\\"station_id\\\": \\\"station-01\\\",\\\n    \\\"fob\\\": {\\\n      \\\"oef\\\": \\\"B252\\\",\\\n      \\\"uid\\\": \\\"<7-byte chip UID hex>\\\",\\\n      \\\"key_version\\\": \\\"0.0.0\\\"\\\n    },\\\n    \\\"scp03\\\": {\\\n      \\\"host_challenge\\\": \\\"<8 bytes hex, random per session>\\\",\\\n      \\\"card_challenge\\\": \\\"<8 bytes hex from INIT UPDATE response>\\\",\\\n      \\\"sequence_counter\\\": \\\"<3 bytes hex from INIT UPDATE>\\\",\\\n      \\\"card_cryptogram\\\": \\\"<8 bytes hex, computed during SCP03 handshake>\\\"\\\n    },\\\n    \\\"keyBundleType\\\": \\\"dev\\\"\\\n  }\\\n  ```\\\n- Response: `200` with `application/octet-stream` body (container binary)\\\n- Container UUID in header `containeruuid` (lowercase)\\\n\\\n### PUT /cryptoContainers/{uuid}\\\n- Report usage/programming status\\\n\\\n### DELETE /seeds/{uuid}\\\n- Delete seed\\\n\\\n## TLS / mTLS Notes\\\n- Server cert: validated via Clypeum Root CA PEM\\\n- **Known issue**: `danger_accept_invalid_certs(true)` currently used for dev — root CA `Clypeum_Root_CA.pem` returns `BadSignature`. Need correct CA chain.\\\n- Client cert: extracted from .p12 file (same cert as Windows cert store thumbprint in PS scripts)\\\n- Key: encrypted with PBKDF2-HMAC-SHA1 (OpenSSL PKCS#12 default), decrypted at runtime with passphrase\\\n- `reqwest::Identity::from_pem(combined_cert_key_pem)` for mTLS\\\n\\\n## Key Files\\\n- `crates/kf-dev-station/src/klms_config.rs`: TOML config parsing\\\n- `crates/kf-dev-station/src/klms_client.rs`: HTTP client, auth, all CCS endpoints\\\n- `crates/kf-dev-station/src/container_parser.rs`: Container binary format parser\\\n- `data/klms-config.toml`: Explicit cert/key/CA paths, IAM settings\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":2974}]"
metadata_diff: {"new":{"id":"efb6d30501f34e1f85f3a4549fda6b9c","parent_id":"beb251c3b3f9490285e6cb68942a5145","latitude":"0.00000000","longitude":"0.00000000","altitude":"0.0000","author":"","source_url":"","is_todo":0,"todo_due":0,"todo_completed":0,"source":"joplin-desktop","source_application":"net.cozic.joplin-desktop","application_data":"","order":1786528777201,"markup_language":1,"is_shared":0,"share_id":"","conflict_original_id":"","master_key_id":"","user_data":"","deleted_time":0},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-14T17:00:00.654Z
created_time: 2026-08-14T17:00:00.654Z
is_locked: 0
type_: 13