Dcc Smart Authentication

generated: '2026-07-27'
method: searched
source: https://github.com/SmartDCCInnovation/dccboxed-signing-tool
docs: https://smartenergycodecompany.co.uk/documents/sec-subsidiary-documents/sec-appendix-ae-dcc-user-interface-code-of-connection/
summary:
  types: []
  api_key_in: []
  oauth2_flows: []
  note: >-
    The one OpenAPI Smart DCC publishes declares NO securitySchemes. That is accurate,
    not a gap in the spec: the DCC Boxed DUIS signing tool is a locally self-hosted
    process bound to localhost:8080 with no authentication layer of its own. The real
    Smart DCC production interface (DUIS) is not an API-key or OAuth surface at all — it
    is a mutually-authenticated private network connection plus message-level PKI, and it
    cannot be obtained self-serve.
schemes: []
surfaces:
- surface: DCC Boxed DUIS signing tool HTTP API
  spec: openapi/dcc-boxed-duis-signing-tool-openapi.yml
  auth: none
  transport: plain HTTP on localhost (default port 8080, configurable with -p)
  note: >-
    No authentication, no TLS by default. The tool is intended to run on the developer's
    own machine or beside a DCC Boxed instance. The Node-RED nodes documentation notes
    that DCC Boxed itself may be placed behind a reverse proxy performing authentication,
    with extra headers and TLS configured on the client side — authentication is therefore
    an operator concern, not a property of the published contract.
- surface: DCC User Interface (DUIS) — the production Smart DCC interface
  spec: null
  auth: message-level XML digital signature with SMKI organisation certificates, over a
    dedicated DCC User Gateway Connection
  key_material: EC prime256v1 private keys in PKCS#8 PEM format, with the matching X.509
    certificate in PEM, issued under SMKI (Smart Metering Key Infrastructure)
  identity: the Originator and Target EUIs in the DUIS header identify the sending Remote
    Party and the target device or ACB
  replay_protection: a strictly incrementing originator counter is carried in the DUIS
    request id; the signing tool overwrites it with System.currentTimeMillis() unless
    --preserveCounter is given
  onboarding: >-
    Not self-serve. Access requires acceding to the Smart Energy Code, ordering a DCC User
    Gateway Connection, obtaining SMKI certificates, and passing SMKI Registration
    Authority and User Entry Process Testing. Governed by SEC Appendix AE, the DCC User
    Interface Code of Connection.
  docs: https://smartenergycodecompany.co.uk/documents/sec-subsidiary-documents/sec-appendix-ae-dcc-user-interface-code-of-connection/
- surface: DCC Boxed test PKI (ZAZ1)
  auth: same SMKI XML digital signature model, using the ZAZ1 self-contained test PKI
  note: >-
    ZAZ1 organisation certificates and their private keys ship with DCC Boxed, with the
    signing tool, and with GFI, and are published in the @smartdcc/dccboxed-keystore JSON
    database. They are test credentials for a test PKI — see sandbox/dcc-smart-sandbox.yml.