# Asn1 der node extract

`asn1-der-node-extract` · version 1.0.0 · Structured formats · free, no key needed

Extract one DER node by a numeric path, with header, content, and child paths.

**Use when you need to: extract one der node by path · der node header and content hex · read the tlv at a numeric path.**

## Decide before calling

Read the [versioned contract](/v1/tools/asn1-der-node-extract/versions/1.0.0) and the supported scope below. Reuse `asn1-der-node-extract@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `asn1-der-node-extract@1.0.0` for extract one der node by path. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- extract one der node by path
- der node header and content hex
- read the tlv at a numeric path
- child paths of a single der node
- slice one asn1 der element
- pull header bytes for a der path
- חילוץ צומת לפי נתיב מספרי

## Not supported

- list every node in the value
- render an escaped tree
- interpret the node as an x509 field

## Behavior

- Input is der_hex plus a path. The path is decimal child indexes separated by dots, starting at "0", with no leading zeros. The byte walk runs before the path is checked, so a broken encoding fails even when the path is too long.
- The result is that one node: offsets and lengths, tag class and tag number, header_hex, content_hex, tlv_hex, and the paths of its immediate children. Sibling nodes are not returned.
- A path longer than 64 characters is limit_exceeded before path syntax. A path that is well formed but absent is invalid_input with details.reason "path_not_found".
- ObjectDescriptor (universal 7) must be primitive. CHARACTER STRING (universal 29) must be constructed, as must EXTERNAL, EMBEDDED PDV, SEQUENCE, and SET. The same DER content rules as the walker apply. No X.509 meaning is assigned to a tag.
- More than 512 decoded bytes, depth above 12, or more than 96 nodes is limit_exceeded. The decoded-byte limit is applied before hex syntax. A JSON result above 32768 UTF-8 bytes is limit_exceeded.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `der_hex` (string, required): min length 4; max length 1024; pattern `^([0-9a-f]{2})+$`
- `path` (string, required): min length 1; max length 64; pattern `^(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))*$`

## Output

- `der_bytes` (integer, required): min 2; max 512
- `path` (string, required): min length 1; max length 64; pattern `^(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))*$`
- `depth` (integer, required): min 0; max 12
- `offset` (integer, required): min 0; max 510
- `header_length` (integer, required): min 2; max 12
- `content_length` (integer, required): min 0; max 510
- `end_offset` (integer, required): min 2; max 512
- `tag_class` (one of "universal", "application", "context", "private", required)
- `tag_number` (integer, required): min 0; max 9007199254740991
- `constructed` (boolean, required)
- `child_count` (integer, required): min 0; max 95
- `header_hex` (string, required): min length 4; max length 24; pattern `^([0-9a-f]{2})+$`
- `content_hex` (string, required): min length 0; max length 1020; pattern `^([0-9a-f]{2})*$`
- `tlv_hex` (string, required): min length 4; max length 1024; pattern `^([0-9a-f]{2})+$`
- `child_paths` (array of string, required): max items 95; each min length 1; each max length 64; each pattern `^(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))*$`

## Limits

- max der bytes: 512
- max depth: 12
- max nodes: 96
- max output bytes: 32768
- max path chars: 64

## Example

Request input:

```json
{
  "der_hex": "0500",
  "path": "0"
}
```

Response:

```json
{
  "result": {
    "der_bytes": 2,
    "path": "0",
    "depth": 0,
    "offset": 0,
    "header_length": 2,
    "content_length": 0,
    "end_offset": 2,
    "tag_class": "universal",
    "tag_number": 5,
    "constructed": false,
    "child_count": 0,
    "header_hex": "0500",
    "content_hex": "",
    "tlv_hex": "0500",
    "child_paths": []
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "asn1-der-node-extract",
  "version": "1.0.0",
  "input": {
    "der_hex": "0500",
    "path": "0"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/asn1-der-node-extract/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"der_hex":"0500","path":"0"}'
```

The machine-readable contract is at [/v1/tools/asn1-der-node-extract/versions/1.0.0](/v1/tools/asn1-der-node-extract/versions/1.0.0).

### CLI

```sh
node cli.mjs run asn1-der-node-extract 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Asn1 der path list](/tools/asn1-der-path-list): List numeric paths, offsets, lengths, and tag class for every node in one DER value.
- [Asn1 der parse](/tools/asn1-der-parse): Parse one ASN.1 DER value into a flat schema-free TLV node list.
- [Asn1 der encode tree](/tools/asn1-der-encode-tree): Encode a schema-free ASN.1 node list as one canonical DER value.
- [Asn1 der primitive decode](/tools/asn1-der-primitive-decode): Decode one universal DER primitive from lowercase hex into typed fields.
- [XML exc c14n subtree](/tools/xml-exc-c14n-subtree): Exclusive XML Canonicalization 1.0 of one selected element and its descendants.
- [Xpath10 paths](/tools/xpath10-paths): List the canonical XPath 1.0 path of each node in a location-path node-set, in document order.