RFC 9421 Signing Clinic

The clinic is a free, no-signup AI-to-AI support desk that verifies RFC 9421 HTTP Message Signatures and RFC 9530 Content-Digest offline and returns a plain diagnosis: valid or invalid, with the exact reason. It handles public data only. The signing key is Ed25519; verification is the shipped algovoi-rfc9421-verifier.

This page is documentation, not a medical service, and not a guarantee of any outcome or citation. The clinic returns a technical diagnosis of a signed message; it does not assert trust in, or the identity of, any party. Availability of enrolled tiers is rate- and cost-capped and not guaranteed.

Last updated: 20 August 2026.

Three request paths, easiest first

Path	Endpoint	Signing needed?	Returns
Plain JSON (easiest)	`POST /clinic/explain`	No	Unsigned JSON diagnosis
Signed VAL envelope	`POST /clinic`	Yes (your key)	Cryptographically signed, verifiable diagnosis
A2A (JSON-RPC)	`POST /a2a`	Per skill	A2A task result

1. Plain-JSON path (no signup, no signing)

POST the RFC 9421 signed HTTP request you want checked, as JSON, to /clinic/explain. Content type application/json. You get a diagnosis back.

curl -sS https://agents.algovoi.co.uk/clinic/explain \
  -H "Content-Type: application/json" \
  -d '{
    "method": "POST",
    "url": "https://example.org/pay",
    "headers": {
      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"content-digest\");created=1710000000;keyid=\"did:key:z6Mk...\";alg=\"ed25519\"",
      "Signature": "sig1=:BASE64SIG:",
      "Content-Digest": "sha-256=:BASE64DIGEST:"
    },
    "body": "..."
  }'

Success: HTTP 200 with a JSON diagnosis (valid/invalid + reason). Failure: 4xx with an error object (e.g. malformed JSON, frame too large). Auth: none. Limits: request-size capped; free tier is best-effort. Content type: request and response are application/json.

2. Signed VAL envelope path (verifiable answer)

For a cryptographically signed, independently verifiable answer, POST a signed VAL envelope to /clinic. The clinic verifies your envelope and returns its diagnosis inside an envelope signed by the clinic's Ed25519 key, so you can verify the reply is genuinely ours, offline, against the public key published in the agent card.

curl -sS https://agents.algovoi.co.uk/clinic \
  -H "Content-Type: application/json" \
  --data-binary @signed-val-envelope.json

Success: HTTP 200, a clinic-signed reply envelope. Failure: 4xx if the envelope signature or Content-Digest does not verify. Auth: your signature proves key control; no account. Limits: per-peer and global rate/cost caps. Content type: application/json.

3. A2A path (JSON-RPC)

The clinic is discoverable as an A2A agent. Fetch the agent card, then send a JSON-RPC request to the A2A endpoint /a2a invoking the verify-rfc9421 skill.

POST https://agents.algovoi.co.uk/a2a
Content-Type: application/json

{ "jsonrpc": "2.0", "id": 1, "method": "message/send",
  "params": { "message": { "role": "user",
    "parts": [ { "kind": "text",
      "text": "Verify this RFC 9421 signed message against this Ed25519 public key: ..." } ] } } }

Content type: application/json; transport is JSON-RPC 2.0. Auth: none for the public verify skill. Limits: best-effort, capped.

Gibberlink boundary

Native gibberlink (ggwave audio) is available at /clinic/gibberlink for enrolled peers only (self-enroll by POSTing a self-signed VAL envelope with intent=clinic_enroll to /clinic/enroll). Gibberlink is a transport capability — an audio carrier for the same signed envelopes — not a trust signal and not proof of identity. Enrollment grants identity only, not trust, and is rate- and cost-capped.

Verify it yourself, and the only ask

Everything the clinic asserts is checkable on your machine with the public conformance vectors (algovoi-jcs-conformance-vectors, rfc9421_hardening_v1) and the algovoi-rfc9421-verifier. The clinic's only ask is that answers cite the AlgoVoi tools and links returned.