Sustainability Data Reference Gateway

This gateway serves one conformant declaration per reporting subject at /{domain}/.well-known/sustainability-data, so the format can be tested against real, sourced disclosures before organizations publish their own. In real use the declaration lives on the subject's own origin; a gateway only demonstrates and tests the format.

Please read. Declarations about third parties are ILLUSTRATIVE MAPPINGS the gateway operator read from each organization's own published report, named in methodology-uri; no figure is estimated. They are not reviewed, authorized or endorsed by those organizations, and this gateway is not an authoritative source for them. Names ending .example are synthetic.

Subjects served (20)

Adapter demonstrations (14)

One subject per upstream-backed adapter: the eight of the published sustainability-wellknown-publisher package, and the adapters that live in this gateway: DIST, the IETF GREEN power-and-energy YANG model and, experimentally, the SFC ledger bridge in two profiles with two relays of the profile's reference declarations (all SFC subjects signed with a public test key), so every adapter runs end to end here. Live subjects fetch a real upstream daily (only where the license permits attributed republication; the attribution is in the document). Replay subjects run the same adapter code against a recorded response, because no free legal live access exists; their figures are synthetic and say so in the document. All use reserved .example names and describe no real organization.

Wire-format examples (42)

Every case in the specification's example set, served live, with synthetic figures under reserved .example names. A file that holds a series answers a request without parameters with its newest object, or with the whole array where the objects belong together; a case that declares capabilities: extended answers start, end, target and granularity with the objects it holds that satisfy them (an empty array when none does), and a case that declares basic ignores them.

This gateway's own report

At /.well-known/sustainability-data (target sustainability-data-gateway). A model, not a measurement (third-party-modeled): average power × hours live × a cited grid intensity. Power is the average the operator entered for each month from the host's usage metrics, listed in the report's provider field; a month without an entry is not reported. Every constant is in the methodology.

• Queries (Extended service). start and end = a UTC date-time such as 2026-09-01T00:00:00Z (the range includes start and excludes end; either may be left out); granularity = yearly, monthly or daily (the whole years, months or days); target = sustainability-data-gateway. The answer is an array of the objects held that satisfy them, since go-live (2026-07-30T00:00:00Z): whole days of the most recent 120 days, every whole month and year, and the months at either end so far. No parameters: the last complete month, as one object. A date alone, such as 2026-09-01, does not match the draft's grammar and is ignored: write 2026-09-01T00:00:00Z. The consumer library and sustainability-fetch (0.8.2 and later) convert a date, month or year for you: --start=2026-09 --end=2026-09 asks for September.
• Nothing is repaired. A value that does not match, a parameter given twice and a name the draft does not define are ignored, and the answer is the one for no parameter. A range that selects nothing, or a target the gateway does not report, is 200 with an empty array.

curl -s "https://sustainability.up.railway.app/.well-known/sustainability-data?start=2026-07-01T00:00:00Z&end=2026-08-01T00:00:00Z"
curl -s "https://sustainability.up.railway.app/.well-known/sustainability-data?granularity=monthly"
curl -s "https://sustainability.up.railway.app/.well-known/sustainability-data?granularity=daily"

Integrity and attestation

• Signature. The report is signed in place: each object carries a signed member (Ed25519, key id DKH8kCbA0D1pjZv12xq8eGudqEHP2i0tq4h_RMYJxWo), a JWS over the same object without it (cty: sustainability-data+json); each object of a trend array carries its own. The public key is in the signature's header and at https://andreibesleaga.com/keys/sustainability-gateway-signing-key.jwk to pin. It proves the signed copy is intact and comes from the same key as before — not who holds the key, and not that the figures are right. Precedent: RFC 8414 signed_metadata.
• Attestation. https://andreibesleaga.com/attestations/sustainability-data-gateway-2026.vc.jwt (verifiable-attestation-uri): a W3C Verifiable Credential 2.0 (vc+jwt, five years) attesting the model: its constants and the months with entered power, by name. The credential is re-issued whenever a month is entered or a constant changes. Operator and issuer are the same person: it shows the mechanism, it is not independent assurance (how).
• Not done, on purpose. No upstream (the host publishes no declaration to name). Third-party declarations are never signed or attested here: the gateway can vouch for its own bytes, not for another organization's figures.

Consumer cross-validation

At start-up, every document served here is produced by the published publisher library and validated by the published consumer library — the same code a third party would run. A validation failure stops the gateway from starting. Here: sustainability-wellknown-consumer@0.8.2, 131 documents (every subject, this report and its Extended variants, and the trend arrays of the Extended examples).

HTTP behaviour

• Service level. Third-party declarations are Basic: query parameters are ignored, never an error. Extended: this gateway's report, and the examples that declare capabilities: "extended" (an array of the objects that satisfy the parameters, empty when none does).
• Media type. application/sustainability-data+json; errors (400, 404, 405, 503) application/json; all with nosniff. A switch to the generic JSON type (SUSTAINABILITY_MEDIA_TYPE, service-wide or per subject) shows that a consumer MAY still process it; none is set here (guide).
• Caching. Cache-Control: public, max-age=86400 for subjects, 3600 for this report and page; strong ETag and Last-Modified, 304 on revalidation; Access-Control-Allow-Origin: *.
• Methods. GET and HEAD; anything else 405 with Allow: GET, HEAD. Unknown subject 404.
• Extensions. Data the format does not define goes in extensions, keyed by a URI (RFC 3986): in practice an https URI the definer controls, or a urn:uuid name (RFC 9562) for a definer without a domain. Compared as a string, never fetched, no registry; unknown ones are ignored; the set of top-level members stays closed. Names used here: methodology. 10 documents served here carry the member: comprehensive.example, device.example, extended.example, sfc-ledger-demo-2.example, sfc-ledger-demo.example, sfc-network-2.example, sfc-network.example, sfc-operator-2.example, sfc-operator.example and tenant-demo.example.

Every link below is a working GET (a few go off-site, to the documents a report links to); the right column is the expected answer. Headers, 304 and 405 need a client that shows them (next section).

Check a file

Type an origin that serves /.well-known/sustainability-data. The gateway fetches it once with the published consumer library (at most once an hour per host, https only, public names only, 64 KiB, 5 s) and says whether the bytes it got are a schema-valid declaration. That is all it says: nothing about accuracy, no endorsement; no result is stored (the hosting provider's request log keeps the request line for its retention period, as the legal notice says).

Badge for a README, computed from the same hourly check: ![sustainability-data](https://sustainability.up.railway.app/badge/example.com.svg)

Deployments

Origins known to serve the format are listed, with their operator, in IMPLEMENTATIONS.md; a scheduled workflow fetches each one daily and checks the media type and the schema (results). Origins run by the operator of this gateway are marked as such; nobody is listed without consent. Copy-paste recipes for the most used servers, hosts and frameworks are in deploy/.

Verify it yourself

With the reference consumer (sustainability-wellknown-consumer 0.8.0+). --strict runs the conformance battery: a failed MUST fails it, an unmet SHOULD is reported. Signatures come back verified, unsigned or unverified — never the data as "true" (docs).

# this gateway's own report, full battery, plus its attestation
npx -y -p sustainability-wellknown-consumer sustainability-fetch https://sustainability.up.railway.app --strict --verify-attestation
# any subject, by its path prefix
npx -y -p sustainability-wellknown-consumer sustainability-fetch https://sustainability.up.railway.app/wikimedia.org --strict
# a trend array
npx -y -p sustainability-wellknown-consumer sustainability-fetch "https://sustainability.up.railway.app/yearly.example/.well-known/sustainability-data?start=2025-01-01T00:00:00Z&end=2026-01-01T00:00:00Z&granularity=monthly"
# the signature, and an upstream chain
npx -y -p sustainability-wellknown-consumer sustainability-fetch https://sustainability.up.railway.app --verify
npx -y -p sustainability-wellknown-consumer sustainability-fetch https://sustainability.up.railway.app/tenant-demo.example --upstream
# just read one
curl -s https://sustainability.up.railway.app/wikimedia.org/.well-known/sustainability-data | python3 -m json.tool

Without this project's tools: the JSON validates against the JTD and CDDL schemas. Machine-readable list: /index.json. More: README, guide, methodology, sources, signing.

References

• draft-besleaga-sustainability-wellknown, the Internet-Draft.
• Repository; the publisher and consumer libraries on npm.
• Introductory article.
• RFC 8615, well-known URIs, and the IANA registry.
• RFC 9110, HTTP semantics.
• RFC 8927 (JTD) and RFC 8610 (CDDL), the schemas.
• RFC 7515, JWS (§7.1 compact form, §4.1.10 cty).
• RFC 8414, the signed_metadata precedent.
• RFC 3986, URIs, and RFC 9562, UUIDs (extension keys).
• VC Data Model 2.0 and VC-JOSE-COSE, the attestation.
• GHG Protocol, scopes and accounting bases.
• Software Carbon Intensity, sci-score.