{"openapi":"3.1.0","info":{"title":"Flashy ID — public verification surface","version":"0.3.0","description":"Delegated authority across organizational boundaries. This document describes only what is implemented; planned operations live on flashyid.com/spec with a version marker, never here."},"servers":[{"url":"https://flashyid.com"}],"paths":{"/.well-known/jwks.json":{"get":{"operationId":"getJwks","summary":"Public signing keys","description":"One active kid, RS256. Unauthenticated. Cache for an hour; stale-while-revalidate for a day. Fail closed on an unknown kid — never fall back to another key.","responses":{"200":{"description":"The JWKS document","content":{"application/json":{"schema":{"type":"object","properties":{"keys":{"type":"array","items":{"type":"object"}}},"required":["keys"]}}}},"503":{"description":"Keys not configured or upstream unreachable — fail closed"}}}}}}