Compliance Certificates

What a compliance certificate is

When a producer completes documentation for a production, Easy2257 issues a signed RS256 JWT: the compliance certificate. You store it next to the content. A federal inspector or a payment-network auditor can verify it offline against the public JWKS, with no call to Easy2257 and no dependency on our uptime.

Payload

{
  "iss": "easy2257.com",
  "sub": "cmd3p8w1k0002qz8h9j4r7v5s",
  "jti": "0b4b8f4e-6a7c-4a1e-9f0e-2f1d7c3a5b9e",
  "productionId": "cmd3p8w1k0002qz8h9j4r7v5s",
  "performerCount": 3,
  "documentedAt": "2026-04-24T18:00:00Z",
  "custodian": {
    "name": "<custodian legal entity>",
    "address": "<custodian mailing address>"
  },
  "partnerId": "cmd2n6t0h0001qz8h1c9x4b7m",
  "iat": 1714000000,
  "exp": 1745536000
}

sub and productionId carry the same value. custodian is filled from the Custodian of Records identity published on the Easy2257 records statement, so a certificate and a statement can never disagree. partnerId is null for productions not linked to a partner.

Algorithm: RS256. Issuer: easy2257.com. Lifetime: 1 year from issuance, then rotated by annual re-attestation. A producer reissuing the sealed package after a correction rotates it sooner, so treat the newest production.documented as authoritative rather than the expiry.

Offline verification

Fetch the public JWKS from https://easy2257.com/.well-known/jwks.json and cache it for 24 hours. Verify with the key matching the kid header. Any RS256-capable library works:

import { createRemoteJWKSet, jwtVerify } from 'jose';

const JWKS = createRemoteJWKSet(new URL('https://easy2257.com/.well-known/jwks.json'));
const { payload } = await jwtVerify(certificate, JWKS, { issuer: 'easy2257.com' });

Offline verification proves the signature, the issuer, and the expiry. It cannot see a revocation, which is why the revocation list exists.

Lifecycle

A certificate is CURRENT until one of two different things happens. A revocation means the certified record was pulled (a removal request was actioned): take the content down. A supersession means a newer certificate replaced it, either at the annual re-attestation or when a producer reissued the sealed package after correcting a closed record: swap it in and the content stays up. Sync the Certificate Revocation List daily for revocations, and subscribe to production.takedown_requested and production.certificate_renewed for the real-time signals. Neither a renewal nor a producer reissue is a revocation, and neither appears in the revocation list.

Delivery and retrieval

The certificate arrives in the production.documented webhook payload when documentation completes, and a fresh production.documented arrives again whenever a producer reissues the sealed package after a correction. Store the newest one indexed by productionId. If you miss or lose one, fetch it any time from GET /api/v1/productions/{productionId}/certificates, which lists every certificate for the production with its lifecycle status and the signed JWT.