Skip to main content

.nota File Format

The .nota file is the portable, cryptographically signed JSON container at the heart of the Notareum Protocol. This page documents the v1.0 schema in full: every field, every resource type, and how the canonical message for signing is constructed. MIME type is application/vnd.notareum.nota+json and the file extension is .nota.

Top-level structure

A .nota file has six top-level objects. Four are required: version, type, chain, resource, and signature. Two are optional but strongly recommended: verification and issuer.

Resource types

The type field MUST be one of six well-known values. Each maps to a uint8 constant used when computing the resource ID. Additional types can be added through governance by calling addResourceType() on the registry. Parsers MUST reject types that are not registered in validResourceTypes.

Chain object

The chain object provides EIP-155 chain context. Common EVM chain IDs: Ethereum 1, Polygon 137, Arbitrum One 42161, Optimism 10, BNB Chain 56, Avalanche C-Chain 43114, Base 8453.

Resource object

Identifier formats by type:

Signature object

Canonical message construction

When signing a .nota file, the signer MUST follow this exact procedure:
  1. Serialize the resource object as canonical JSON (keys sorted alphabetically, no extra whitespace).
  2. Prepend the string "Notareum v1.0 | ".
  3. Append " | " + timestamp where timestamp is Unix seconds.
Example canonical message:
For EVM chains, the message MUST be signed using EIP-191 personal sign: the signing implementation prepends "\x19Ethereum Signed Message:\n" + len(message) before hashing.

Verification object

Create and sign in every language

TypeScript:
Python:
Rust:

File size constraints

  • Typical size: 1 to 2 KB
  • Maximum permitted size: 64 KB
  • resource.metadata maximum: 32 KB

Security considerations

Signature replay. The timestamp field provides replay resistance. Verifiers SHOULD reject signatures older than 30 days for off-chain verification. No expiry for on-chain anchored resources. Address encoding. EVM addresses MUST pass EIP-55 checksum validation. Parsers MUST reject non-checksummed addresses to prevent homograph attacks. Metadata injection. Implementations MUST sanitize metadata before rendering in UI contexts to prevent XSS or JSON injection. Schema validation. Parsers MUST reject files with missing required fields, invalid types, or malformed identifiers rather than silently ignoring invalid data.