0fe1828f5b
POST /v1/identity/verify: an AERE Identity presentation judged by the published command line -> VALID / PARTIAL / INVALID with every row, the claims shown and the subject when no row failed, and the command that reproduces the verdict. POST /v1/compliance/check: your policy judged on a presentation -> COMPLIANT / NOT_COMPLIANT with the reasons and, with record, the decision as an AIP-23 envelope without personal data. In Go the presentation, keys, lists and policy travel as json.RawMessage: a map or float64 would change numbers above 2^53 and the canonical text the signatures cover. The .NET negative control now builds clean for each planted defect (an incremental build could run the tests against the previous planted library). A negative control for the JavaScript and Python routes is added. Tests: JavaScript 13, Python 14, Go ok, Java 10/10 (and the Java 8 API gate); negative controls Go 9/9, Java 10/10, .NET 12/12, JavaScript and Python 4/4.
2.8 KiB
aere-cloud (Go)
The official Go client for the Aere Cloud API on Aere Network (chain 2800). Zero dependencies beyond the Go standard library. Same routes and semantics as the JS, Python and Java clients 1.5.0.
JSON routes return the server's JSON as json.RawMessage, so you decode it into the types you already use. The two
routes that return files (the audit export and the check of a kept export) return typed results, with the SHA-256
computed locally from the bytes received.
Use
import aerecloud "git.aere.network/aere-network/aere-cloud-sdk/go"
c, err := aerecloud.New(os.Getenv("AERE_KEY"))
head, err := c.DataHead(ctx) // {"block":...,"chainId":2800,...}
n, err := c.BlockNumber(ctx)
// quantum-readiness scan of a domain's TLS edge: free, no key is sent unless you attest the report
report, err := c.Readiness(ctx, "example.com", false, false)
// the audit log of a day as a file; Verified is true only if the sha256 of the bytes you received equals the digest
day, err := c.AuditExport(ctx, "2026-09-24", "jsonl")
// a kept export still matches the day we hold, or the tombstone a deleted day left behind
k, err := c.AuditVerifyKept(ctx, "2026-05-01", keptBytes)
// Trust API (1.6.0): any AERE Proof Protocol (AIP-23) envelope -> VALID / INVALID / PARTIAL; chain 0 = the one the envelope declares.
// Pass the envelope's bytes as received (os.ReadFile): a Go map would sort the keys and change the statement's hash.
verdict, err := c.Verify(ctx, json.RawMessage(envelopeBytes), 2800)
// identity and compliance (1.7.0): the presentation, keys, lists and policy travel as their JSON bytes (numbers above 2^53 stay exact)
id, err := c.IdentityVerify(ctx, aerecloud.IdentityVerifyRequest{Presentation: presBytes, Audience: "https://your.app/verifier", Nonce: nonce,
TrustedIssuers: []json.RawMessage{json.RawMessage(`"aere-id:..."`)}, StatusLists: []json.RawMessage{listBytes}})
ok, err := c.ComplianceCheck(ctx, aerecloud.ComplianceCheckRequest{Presentation: presBytes, Policy: policyBytes, Audience: "https://your.app/verifier", Nonce: nonce, Record: true})
// verify a webhook delivery (constant-time HMAC-SHA256 over the exact bytes received)
ok := aerecloud.VerifyWebhook(rawBody, r.Header.Get("x-aere-signature"), secret)
Non-2xx answers come back as *aerecloud.Error with Status, Body and Path. The client does not follow
redirects: a 3xx is returned as an answer, so your API key is never sent to a host you did not name.
Tests
go test ./... # offline, against a local httptest server
node control-negativ.mjs # breaks six guards in a copy of the package; each one's test must fail
Measured 2026-09-25: 7 tests green; the negative control 6 of 6 red, the untouched package green.