Xity Space NFT media and launch protocol
Current implementation 9 November 2026

First launch
An account must complete signed document and live capture evidence, submit a private identity application and receive identity verification and operator approval before its first Space NFT launch
Creator access is enforced for both single and batch minting by the chain validator after the SPACE_SET_CREATOR_POLICY activation transaction
New minting creates the asset in the approved sender wallet, transfer it afterwards when needed
Each NFT still requires a review and current wallet signature, an OAuth token cannot sign or spend for its user
An operator review is an explicit identity assertion over signed evidence, it does not fabricate a biometric result or certify model accuracy
Device fingerprint or Face ID protects a device key and does not replace identity review

Private application routes require a root session
GET /identity/application returns the current application, its status and consent_version
GET /identity/application/evidence lists the account's completed signed captures from the last 30 days
GET /identity/launch-status returns approved, identity_verified, policy_active and the current application summary
POST /identity/applications accepts legal_name, purpose, ceremony_id, consent_version, previous_id, timestamp and signature
purpose is creator, citizenship or citizenship_and_creator
consent_version and signing domain are xity.identity.application.v1
The signed fields are address, chain_id, genesis_hash, legal_name_hash, purpose, ceremony_id, consent_version, previous_id and timestamp
legal_name_hash is SHA256 of the trimmed legal name encoded as UTF8, names are not written to the public chain
Use the previous application ID when resubmitting after changes or a decline, or when applying for another purpose after approval
Pending and committing applications cannot be overwritten, identical submissions are idempotent

Operator routes require the separate X-Xity-Admin-Key header
GET /operator/applications lists bounded private summaries, limit is 1 to 100 and offset is supported
GET /operator/applications/application_id returns the encrypted application details after authorised server decryption
Open the existing operator ceremony evidence viewer to inspect the signed document and live frames
POST /operator/applications/application_id/review accepts revision, decision, reason, identity_verified and evidence_reviewed
The decision is approve, request_changes or reject, the private reason needs at least 20 nonblank characters
Approval requires both review checks, valid signed image evidence, an active account and no biometric rejection
Approval records protected identity assertions and an audit event atomically, the legal name, consent and review note remain in AES GCM encrypted SQLite data
The private encryption key is data_dir/.private/identity-applications.key, protect and back it up with the database, starting with encrypted records and no key fails closed
Only the public approval result and opaque application reference enter the chain
An interrupted final application status write is recovered from the authoritative chain, it cannot create a second approval grant
Completed applications and verification evidence do not currently have automatic erasure, operator retention and removal handling is required

Managed media
POST /v1/media?app_id=client_id accepts raw bytes, not multipart, with a root session for the app owner or a spaces:write OAuth token for that exact app
PNG, JPEG and WebP images are validated and limited to 12 MB and 24 megapixels, other files are limited to 32 MB
Other formats remain available as safe downloads, optional cover images provide their visual preview
The per account allowance is 256 MB, up to 1000 media objects and 2000 metadata records, the current global managed media allowance is 10 GB
The service limits concurrent uploads, validates streamed byte counts and deadlines, rechecks authority after upload and deduplicates content by SHA256
The response contains id, url, sha256, size and content_type, images also include dimensions
GET /v1/media/id serves the recorded content, unknown file types and documents download as attachments with a restrictive content security policy
These files are public, keep private documents and personal information out of NFT uploads
Bytes live in data_dir/public_assets on Xity infrastructure, they are not embedded in every block and must be backed up

POST /v1/metadata accepts app_id, name, description, media_id, optional image_id, external_url and attributes
Each attribute is trait_type plus a text, integer or boolean value
Only files uploaded by this account can be used in managed metadata
The result contains metadata_uri, metadata_hash and metadata, the public JSON uses name, description, image for a picture or cover, animation_url for audio or video, content_uri, content_type, content_sha256 and attributes
GET /v1/metadata/hash serves the exact immutable JSON bytes, its SHA256 equals metadata_hash
Put metadata_uri and metadata_hash into the signed SPACE_MINT payload, with to, app_id and a version 2 royalty_policy
The public API origin must be an actual HTTPS origin to produce metadata usable in chain transactions, set XITY_PUBLIC_API_URL to the deployed API origin
The platform runner supports --ssl-certfile and --ssl-keyfile for a local HTTPS setup, trust the development certificate in your own test client, never disable TLS validation

External media and metadata
Existing HTTPS, IPFS and Arweave metadata remain supported and do not require managed uploads
Publish JSON with name, description, image or animation_url, optional external_url and attributes
GET /v1/spaces/space_id/metadata resolves usable display data, and GET /v1/spaces/space_id/preview serves a bounded generated preview of the real image
When metadata_hash is present the original metadata bytes must match that digest, otherwise the preview reports the integrity failure
External unpinned metadata can change at its host and is labelled accordingly
External downloads require public IP addresses, TLS hostname and certificate checks, pinned DNS results, validated redirects and bounded sizes, time and concurrency
Private and local network addresses cannot be fetched through the preview service
The original creator edits by signing SPACE_UPDATE_METADATA with metadata_uri and optional metadata_hash, old values remain in chain history

Application integration
Use the downloadable /sdk/xity.mjs client, uploadMedia accepts a browser File or Node Blob and createMetadata returns the immutable metadata fields
Use assetMetadata to read the actual preview information after minting
Use requestApproval with txType, payload and optional returnUri to open trusted Xity wallet review, the return origin must match a registered application callback origin
After signing or declining the wallet screen offers Return to the application, the original app can also poll the request for the actual transaction result
Application records can reference the resulting space_id in the same connected application namespace
Canonical account addresses, app IDs, existing assets, balances, royalties and signing domains remain unchanged
The total creator and prior buyer royalty cap is 15 percent, the separate platform fee is 3 percent, buyer shares accrue on sales rather than gifts
Treasury bank funding is unavailable until a real provider and reserve verification are configured, ledger supply is not a verified SGD bank balance