APON · Avena Property Oracle Network · v1

Trustless property data.
For systems that can't take you at your word.

APON publishes signed envelopes for European residential property data. Each envelope carries a cryptographic signature over a deterministically-hashed payload — any downstream consumer (DeFi RWA platform, smart contract, loan-underwriting system, AI agent) can verify the data was issued by Avena and has not been altered. v1 uses HMAC-SHA256 with on-demand verification; v2 will move to Ed25519 so verification works without round-trip.

Signing HMAC-SHA256-v1·Property feeds /api/v1/oracle/property/<ref>·Index feeds /api/v1/oracle/index/<code>·Verify POST /api/v1/oracle/verify
Envelope structure

Every response is signed.

{
  "feed":           "oracle.property",
  "payload": {
    "ref":                       "AV-MAR-101",
    "town":                      "Marbella",
    "country":                   "ES",
    "asking_price_eur":          2050000,
    "price_per_m2_eur":          7080,
    "market_reference_pm2_eur":  7800,
    "avena_score":               82,
    "yield_gross_pct":           5.8,
    ...
  },
  "payload_hash":   "9f3a..."  // sha256 of canonical_json(payload)
  "signature":      "753b..."  // HMAC-SHA256(payload_hash::nonce::ts)[:32]
  "nonce":          "a91c..."  // random 16-byte hex per request
  "timestamp":      "2026-05-25T14:30:00Z",
  "signing_method": "HMAC-SHA256-v1",
  "issuer":         "avena-terminal-oracle-v1",
  "verify_url":     "https://avenaterminal.com/api/v1/oracle/verify"
}

The payload is canonicalised (sorted keys) before hashing, so any consumer can re-hash deterministically. The signature is HMAC-SHA256 over payload_hash::nonce::timestamp, first 32 hex chars. Nonce prevents replay; timestamp gates staleness (verifier rejects envelopes older than 24h).

Use cases

Built for trustless property data consumption.

DeFi RWA platforms

Property-backed lending protocols (Centrifuge, Goldfinch, Maple, Aave RWA) can consume APON envelopes as their property-valuation oracle for loan underwriting + automatic liquidation triggers.

Smart-contract settlement

Index futures + property-backed stablecoins can reference signed AVENA-CC values for settlement. The off-chain feed is signed, the smart contract verifies, no oracle-attack surface.

Loan underwriting systems

Banks integrating Avena AVM can require signed envelopes for audit trail. The signature is the auditable receipt — origination team can prove what valuation existed at what timestamp.

AI agent inputs

AI agents consuming property data for analysis can verify the data was actually issued by Avena (not synthesised). Particularly important for agents writing on behalf of fund managers.

Cross-system audit

When the same property is referenced by multiple systems, all of them can carry the same signed envelope. Drift is detectable — if two systems show different valuations, the signatures expose which one is stale.

Sovereign monitoring

Central banks subscribing to AVENA-CC for residential property monitoring can ingest signed envelopes — receipt-grade auditability for regulatory data products.

Integration · curl
# 1. Fetch a signed index level
curl https://avenaterminal.com/api/v1/oracle/index/AVENA-CC

# 2. Fetch a signed property valuation
curl https://avenaterminal.com/api/v1/oracle/property/AV-MAR-101

# 3. Verify any envelope (round-trip in v1; in v2, verify locally with public key)
curl -X POST https://avenaterminal.com/api/v1/oracle/verify \
  -H "Content-Type: application/json" \
  -d '<the_full_envelope_json>'

Roadmap v2 — Ed25519 asymmetric signing · public key published · verification without round-trip · smart-contract-native

APON v1 · HMAC-SHA256 · CC BY 4.0 · cite DOI 10.5281/zenodo.19520064 · APIP schema