diff --git a/.github/workflows/ic-ref.yml b/.github/workflows/ic-ref.yml
index fad3fb13..73e99fd4 100644
--- a/.github/workflows/ic-ref.yml
+++ b/.github/workflows/ic-ref.yml
@@ -16,7 +16,7 @@ jobs:
         include:
           - build: linux-stable
             ghc: '8.8.4'
-            spec: 'release-0.11'
+            spec: 'release-0.13'
             os: ubuntu-latest
             rust: stable
 
@@ -75,7 +75,7 @@ jobs:
           mkdir -p $HOME/bin
           cd ic-ref/impl
           cabal update
-          cabal install -w ghc-${{ matrix.ghc }} --overwrite-policy=always  --installdir=$HOME/bin
+          cabal install exe:ic-ref -w ghc-${{ matrix.ghc }} --overwrite-policy=always  --installdir=$HOME/bin
 
       - name: Build universal-canister
         run: |
diff --git a/ic-agent/Cargo.toml b/ic-agent/Cargo.toml
index 5c094f19..d214cf75 100644
--- a/ic-agent/Cargo.toml
+++ b/ic-agent/Cargo.toml
@@ -21,6 +21,7 @@ delay = "0.3.0"
 hex = "0.4.0"
 ic-types = { path = "../ic-types", version = "0.1", features = [ "serde" ] }
 leb128 = "0.2.4"
+mime = "0.3.16"
 openssl = "0.10.24"
 rand = "0.7.2"
 reqwest = { version = "0.10.4", features = [ "blocking", "json", "rustls-tls" ] }
diff --git a/ic-agent/src/agent/agent_error.rs b/ic-agent/src/agent/agent_error.rs
index 921ea62f..d712c736 100644
--- a/ic-agent/src/agent/agent_error.rs
+++ b/ic-agent/src/agent/agent_error.rs
@@ -1,4 +1,8 @@
+use crate::hash_tree::Label;
 use crate::RequestIdError;
+use leb128::read;
+use std::fmt::{Debug, Display, Formatter};
+use std::str::Utf8Error;
 use thiserror::Error;
 
 #[derive(Error, Debug)]
@@ -36,12 +40,8 @@ pub enum AgentError {
         reject_message: String,
     },
 
-    #[error(r#"The replica returned an HTTP Error: status code {status}"#)]
-    HttpError {
-        status: u16,
-        content_type: Option<String>,
-        content: Vec<u8>,
-    },
+    #[error("The replica returned an HTTP Error: {0}")]
+    HttpError(HttpErrorPayload),
 
     #[error("HTTP Authentication cannot be used in a non-secure URL (either HTTPS or localhost)")]
     CannotUseAuthenticationOnNonSecureUrl(),
@@ -60,6 +60,24 @@ pub enum AgentError {
 
     #[error("A tool returned a custom error: {0}")]
     CustomError(#[from] Box<dyn Send + Sync + std::error::Error>),
+
+    #[error("Error reading LEB128 value: {0}")]
+    Leb128ReadError(#[from] read::Error),
+
+    #[error("Error in UTF-8 string: {0}")]
+    Utf8ReadError(#[from] Utf8Error),
+
+    #[error("The lookup path ({0:?}) is absent in the certificate.")]
+    LookupPathAbsent(Vec<Label>),
+
+    #[error("The lookup path ({0:?}) is unknown in the certificate.")]
+    LookupPathUnknown(Vec<Label>),
+
+    #[error("The lookup path ({0:?}) does not make sense for the certificate.")]
+    LookupPathError(Vec<Label>),
+
+    #[error("The request status ({1}) at path {0:?} is invalid.")]
+    InvalidRequestStatus(Vec<Label>, String),
 }
 
 impl PartialEq for AgentError {
@@ -69,3 +87,65 @@ impl PartialEq for AgentError {
         format!("{:?}", self) == format!("{:?}", other)
     }
 }
+
+pub struct HttpErrorPayload {
+    pub status: u16,
+    pub content_type: Option<String>,
+    pub content: Vec<u8>,
+}
+
+impl HttpErrorPayload {
+    fn fmt_human_readable(&self, f: &mut Formatter<'_>) -> Result<(), std::fmt::Error> {
+        match self {
+            HttpErrorPayload {
+                status,
+                content_type,
+                content,
+            } if is_plain_text_utf8(content_type) => {
+                f.write_fmt(format_args!(
+                    "Http Error: status {}, content type {:?}, content: {}",
+                    status,
+                    content_type.as_ref().unwrap(),
+                    String::from_utf8(content.to_vec()).unwrap_or_else(|from_utf8_err| format!(
+                        "(unable to decode content: {:#?})",
+                        from_utf8_err
+                    ))
+                ))?;
+            }
+            HttpErrorPayload {
+                status,
+                content_type,
+                content,
+            } => {
+                f.write_fmt(format_args!(
+                    "Http Error: status {}, content type {:?}, content: {:?}",
+                    status,
+                    content_type.as_ref().unwrap(),
+                    content
+                ))?;
+            }
+        }
+        Ok(())
+    }
+}
+
+impl Debug for HttpErrorPayload {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), std::fmt::Error> {
+        self.fmt_human_readable(f)
+    }
+}
+
+impl Display for HttpErrorPayload {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), std::fmt::Error> {
+        self.fmt_human_readable(f)
+    }
+}
+
+fn is_plain_text_utf8(content_type: &Option<String>) -> bool {
+    // text/plain is also sometimes returned by the replica (or ic-ref),
+    // depending on where in the stack the error happens.
+    matches!(
+        content_type.as_ref().and_then(|s|s.parse::<mime::Mime>().ok()),
+        Some(mt) if mt == mime::TEXT_PLAIN || mt == mime::TEXT_PLAIN_UTF_8
+    )
+}
diff --git a/ic-agent/src/agent/agent_test.rs b/ic-agent/src/agent/agent_test.rs
index 9928dba0..239f3819 100644
--- a/ic-agent/src/agent/agent_test.rs
+++ b/ic-agent/src/agent/agent_test.rs
@@ -1,12 +1,9 @@
 use crate::agent::replica_api::{CallReply, QueryResponse};
-use crate::agent::response::{Replied, RequestStatusResponse};
 use crate::agent::{AgentConfig, Status};
 use crate::export::Principal;
 use crate::{Agent, AgentError};
-use delay::Delay;
 use mockito::mock;
 use std::collections::BTreeMap;
-use std::time::Duration;
 
 #[test]
 fn query() -> Result<(), AgentError> {
@@ -93,45 +90,6 @@ fn query_rejected() -> Result<(), AgentError> {
     Ok(())
 }
 
-#[test]
-fn call() -> Result<(), AgentError> {
-    let blob = Vec::from("Hello World");
-    let response = QueryResponse::Replied {
-        reply: CallReply { arg: blob.clone() },
-    };
-
-    let submit_mock = mock("POST", "/api/v1/submit").with_status(200).create();
-    let status_mock = mock("POST", "/api/v1/read")
-        .with_status(200)
-        .with_header("content-type", "application/cbor")
-        .with_body(serde_cbor::to_vec(&response)?)
-        .create();
-
-    let agent = Agent::builder().with_url(&mockito::server_url()).build()?;
-
-    let mut runtime = tokio::runtime::Runtime::new().expect("Unable to create a runtime");
-    let result = runtime.block_on(async {
-        let request_id = agent
-            .update(&Principal::management_canister(), "greet")
-            .with_arg(&[])
-            .call()
-            .await?;
-        agent.request_status_raw(&request_id, None).await
-    });
-
-    submit_mock.assert();
-    status_mock.assert();
-
-    assert_eq!(
-        result?,
-        RequestStatusResponse::Replied {
-            reply: Replied::CallReplied(blob)
-        }
-    );
-
-    Ok(())
-}
-
 #[test]
 fn call_error() -> Result<(), AgentError> {
     let submit_mock = mock("POST", "/api/v1/submit").with_status(500).create();
@@ -154,50 +112,6 @@ fn call_error() -> Result<(), AgentError> {
     Ok(())
 }
 
-#[test]
-fn call_rejected() -> Result<(), AgentError> {
-    let response: QueryResponse = QueryResponse::Rejected {
-        reject_code: 1234,
-        reject_message: "Rejected Message".to_string(),
-    };
-
-    let submit_mock = mock("POST", "/api/v1/submit").with_status(200).create();
-    let status_mock = mock("POST", "/api/v1/read")
-        .with_status(200)
-        .with_header("content-type", "application/cbor")
-        .with_body(serde_cbor::to_vec(&response)?)
-        .create();
-
-    let agent = Agent::new(AgentConfig {
-        url: mockito::server_url(),
-        ..Default::default()
-    })?;
-
-    let mut runtime = tokio::runtime::Runtime::new().expect("Unable to create a runtime");
-    let result = runtime.block_on(async {
-        agent
-            .update(&Principal::management_canister(), "greet")
-            .call_and_wait(Delay::timeout(Duration::from_millis(100)))
-            .await
-    });
-
-    match result {
-        Err(AgentError::ReplicaError {
-            reject_code: code,
-            reject_message: msg,
-        }) => {
-            assert_eq!(code, 1234);
-            assert_eq!(msg, "Rejected Message");
-        }
-        result => unreachable!("{:?}", result),
-    }
-
-    submit_mock.assert();
-    status_mock.assert();
-
-    Ok(())
-}
-
 #[test]
 fn status() -> Result<(), AgentError> {
     let ic_api_version = "1.2.3".to_string();
diff --git a/ic-agent/src/agent/mod.rs b/ic-agent/src/agent/mod.rs
index 7cb26684..6e692d19 100644
--- a/ic-agent/src/agent/mod.rs
+++ b/ic-agent/src/agent/mod.rs
@@ -8,7 +8,7 @@ pub(crate) mod response;
 
 pub mod status;
 pub use agent_config::{AgentConfig, PasswordManager};
-pub use agent_error::AgentError;
+pub use agent_error::{AgentError, HttpErrorPayload};
 pub use builder::AgentBuilder;
 pub use nonce::NonceFactory;
 pub use response::{Replied, RequestStatusResponse};
@@ -16,8 +16,11 @@ pub use response::{Replied, RequestStatusResponse};
 #[cfg(test)]
 mod agent_test;
 
-use crate::agent::replica_api::{AsyncContent, Envelope, SyncContent};
+use crate::agent::replica_api::{
+    AsyncContent, Certificate, Envelope, ReadStateResponse, SyncContent,
+};
 use crate::export::Principal;
+use crate::hash_tree::{Label, LookupResult};
 use crate::identity::Identity;
 use crate::{to_request_id, RequestId};
 use delay::Waiter;
@@ -26,6 +29,7 @@ use serde::Serialize;
 use status::Status;
 
 use std::convert::TryFrom;
+use std::str::from_utf8;
 use std::time::Duration;
 
 const DOMAIN_SEPARATOR: &[u8; 11] = b"\x0Aic-request";
@@ -249,14 +253,14 @@ impl Agent {
         }
 
         if status.is_client_error() || status.is_server_error() {
-            Err(AgentError::HttpError {
+            Err(AgentError::HttpError(HttpErrorPayload {
                 status: status.into(),
                 content_type: headers
                     .get(reqwest::header::CONTENT_TYPE)
                     .and_then(|value| value.to_str().ok())
                     .map(|x| x.to_string()),
                 content: body,
-            })
+            }))
         } else {
             Ok(body)
         }
@@ -266,11 +270,10 @@ impl Agent {
     where
         A: serde::de::DeserializeOwned,
     {
-        let anonymous = Principal::anonymous();
         let request_id = to_request_id(&request)?;
         let sender = match &request {
             SyncContent::QueryRequest { sender, .. } => sender,
-            SyncContent::RequestStatusRequest { .. } => &anonymous,
+            SyncContent::ReadStateRequest { sender, .. } => sender,
         };
         let msg = self.construct_message(&request_id);
         let signature = self
@@ -366,37 +369,36 @@ impl Agent {
         .await
     }
 
+    async fn read_state_raw(
+        &self,
+        paths: Vec<Vec<Label>>,
+        ingress_expiry_datetime: Option<u64>,
+    ) -> Result<Certificate, AgentError> {
+        let read_state_response: ReadStateResponse = self
+            .read_endpoint(SyncContent::ReadStateRequest {
+                sender: self.identity.sender().map_err(AgentError::SigningError)?,
+                paths,
+                ingress_expiry: ingress_expiry_datetime.unwrap_or_else(|| self.get_expiry_date()),
+            })
+            .await?;
+
+        let cert: Certificate = serde_cbor::from_slice(&read_state_response.certificate)
+            .map_err(AgentError::InvalidCborData)?;
+        // todo: verify certificate here
+        Ok(cert)
+    }
+
     pub async fn request_status_raw(
         &self,
         request_id: &RequestId,
         ingress_expiry_datetime: Option<u64>,
     ) -> Result<RequestStatusResponse, AgentError> {
-        self.read_endpoint(SyncContent::RequestStatusRequest {
-            request_id: request_id.as_slice().into(),
-            ingress_expiry: ingress_expiry_datetime.unwrap_or_else(|| self.get_expiry_date()),
-        })
-        .await
-        .map(|response| match response {
-            replica_api::Status::Replied { reply } => {
-                let reply = match reply {
-                    replica_api::RequestStatusResponseReplied::CallReply(reply) => {
-                        Replied::CallReplied(reply.arg)
-                    }
-                };
-                RequestStatusResponse::Replied { reply }
-            }
-            replica_api::Status::Rejected {
-                reject_code,
-                reject_message,
-            } => RequestStatusResponse::Rejected {
-                reject_code,
-                reject_message,
-            },
-            replica_api::Status::Unknown {} => RequestStatusResponse::Unknown,
-            replica_api::Status::Received {} => RequestStatusResponse::Received,
-            replica_api::Status::Processing {} => RequestStatusResponse::Processing,
-            replica_api::Status::Done {} => RequestStatusResponse::Done,
-        })
+        let paths: Vec<Vec<Label>> =
+            vec![vec!["request_status".into(), request_id.to_vec().into()]];
+
+        let cert = self.read_state_raw(paths, ingress_expiry_datetime).await?;
+
+        lookup_request_status(cert, request_id)
     }
 
     /// Returns an UpdateBuilder enabling the construction of an update call without
@@ -426,6 +428,96 @@ impl Agent {
     }
 }
 
+fn lookup_request_status(
+    certificate: Certificate,
+    request_id: &RequestId,
+) -> Result<RequestStatusResponse, AgentError> {
+    let path_status = vec![
+        "request_status".into(),
+        request_id.to_vec().into(),
+        "status".into(),
+    ];
+    match certificate.tree.lookup_path(&path_status) {
+        LookupResult::Absent => Err(AgentError::LookupPathAbsent(path_status)),
+        LookupResult::Unknown => Ok(RequestStatusResponse::Unknown),
+        LookupResult::Found(status) => match from_utf8(status)? {
+            "done" => Ok(RequestStatusResponse::Done),
+            "processing" => Ok(RequestStatusResponse::Processing),
+            "received" => Ok(RequestStatusResponse::Received),
+            "rejected" => lookup_rejection(&certificate, request_id),
+            "replied" => lookup_reply(&certificate, request_id),
+            other => Err(AgentError::InvalidRequestStatus(
+                path_status,
+                other.to_string(),
+            )),
+        },
+        LookupResult::Error => Err(AgentError::LookupPathError(path_status)),
+    }
+}
+
+fn lookup_rejection(
+    certificate: &Certificate,
+    request_id: &RequestId,
+) -> Result<RequestStatusResponse, AgentError> {
+    let reject_code = lookup_reject_code(certificate, request_id)?;
+    let reject_message = lookup_reject_message(certificate, request_id)?;
+
+    Ok(RequestStatusResponse::Rejected {
+        reject_code,
+        reject_message,
+    })
+}
+
+fn lookup_reject_code(
+    certificate: &Certificate,
+    request_id: &RequestId,
+) -> Result<u64, AgentError> {
+    let path = vec![
+        "request_status".into(),
+        request_id.to_vec().into(),
+        "reject_code".into(),
+    ];
+    let code = lookup_value(&certificate, path)?;
+    let mut readable = &code[..];
+    Ok(leb128::read::unsigned(&mut readable)?)
+}
+
+fn lookup_reject_message(
+    certificate: &Certificate,
+    request_id: &RequestId,
+) -> Result<String, AgentError> {
+    let path = vec![
+        "request_status".into(),
+        request_id.to_vec().into(),
+        "reject_message".into(),
+    ];
+    let msg = lookup_value(&certificate, path)?;
+    Ok(from_utf8(msg)?.to_string())
+}
+
+fn lookup_reply(
+    certificate: &Certificate,
+    request_id: &RequestId,
+) -> Result<RequestStatusResponse, AgentError> {
+    let path = vec![
+        "request_status".into(),
+        request_id.to_vec().into(),
+        "reply".into(),
+    ];
+    let reply_data = lookup_value(&certificate, path)?;
+    let reply = Replied::CallReplied(Vec::from(reply_data));
+    Ok(RequestStatusResponse::Replied { reply })
+}
+
+fn lookup_value(certificate: &Certificate, path: Vec<Label>) -> Result<&[u8], AgentError> {
+    match certificate.tree.lookup_path(&path) {
+        LookupResult::Absent => Err(AgentError::LookupPathAbsent(path)),
+        LookupResult::Unknown => Err(AgentError::LookupPathUnknown(path)),
+        LookupResult::Found(value) => Ok(value),
+        LookupResult::Error => Err(AgentError::LookupPathError(path)),
+    }
+}
+
 /// A Query Request Builder.
 ///
 /// This makes it easier to do query calls without actually passing all arguments.
diff --git a/ic-agent/src/agent/replica_api.rs b/ic-agent/src/agent/replica_api.rs
index 70bedc12..7cddbeeb 100644
--- a/ic-agent/src/agent/replica_api.rs
+++ b/ic-agent/src/agent/replica_api.rs
@@ -1,4 +1,5 @@
 use crate::export::Principal;
+use crate::hash_tree::{HashTree, Label};
 use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Clone, Serialize)]
@@ -31,11 +32,11 @@ pub enum AsyncContent {
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(tag = "request_type")]
 pub enum SyncContent {
-    #[serde(rename = "request_status")]
-    RequestStatusRequest {
+    #[serde(rename = "read_state")]
+    ReadStateRequest {
         ingress_expiry: u64,
-        #[serde(with = "serde_bytes")]
-        request_id: Vec<u8>,
+        sender: Principal,
+        paths: Vec<Vec<Label>>,
     },
     #[serde(rename = "query")]
     QueryRequest {
@@ -48,11 +49,19 @@ pub enum SyncContent {
     },
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize)]
-pub struct RequestStatusResponse {
-    pub status: Status,
-    #[serde(rename = "time")]
-    pub time: u64,
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
+pub struct ReadStateResponse {
+    #[serde(with = "serde_bytes")]
+    pub certificate: Vec<u8>,
+}
+
+/// A `Certificate` as defined in https://docs.dfinity.systems/public/#_certificate
+#[derive(Deserialize)]
+pub(crate) struct Certificate {
+    pub tree: HashTree,
+
+    #[serde(with = "serde_bytes")]
+    pub signature: Vec<u8>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
diff --git a/ic-agent/src/hash_tree.rs b/ic-agent/src/hash_tree.rs
index 60bfbe3e..a8360bec 100644
--- a/ic-agent/src/hash_tree.rs
+++ b/ic-agent/src/hash_tree.rs
@@ -97,6 +97,7 @@ pub struct HashTree {
 impl HashTree {
     /// Recomputes root hash of the full tree that this hash tree was constructed from.
     #[inline]
+    #[allow(dead_code)]
     pub fn digest(&self) -> Sha256Digest {
         self.root.digest()
     }
diff --git a/ic-agent/src/lib.rs b/ic-agent/src/lib.rs
index 461b39e3..4ae514b8 100644
--- a/ic-agent/src/lib.rs
+++ b/ic-agent/src/lib.rs
@@ -106,7 +106,10 @@ pub mod export;
 pub mod identity;
 pub mod request_id;
 
-pub use agent::{agent_error::AgentError, nonce::NonceFactory, Agent, PasswordManager};
+pub use agent::{
+    agent_error::AgentError, agent_error::HttpErrorPayload, nonce::NonceFactory, Agent,
+    PasswordManager,
+};
 pub use identity::{Identity, Signature};
 pub use request_id::{to_request_id, RequestId, RequestIdError};
 
diff --git a/ic-agent/src/request_id/mod.rs b/ic-agent/src/request_id/mod.rs
index caf9ea74..865b9824 100644
--- a/ic-agent/src/request_id/mod.rs
+++ b/ic-agent/src/request_id/mod.rs
@@ -68,6 +68,41 @@ impl Serialize for RequestId {
     }
 }
 
+enum Hasher {
+    /// The hasher for the overall request id.  This is the only part
+    /// that may directly contain a Struct.
+    RequestId(Sha256),
+
+    /// A structure to be included in the hash.  May not contain other structures.
+    Struct {
+        // We use a BTreeMap here as there is no indication that keys might not be duplicated,
+        // and we want to make sure they're overwritten in that case.
+        fields: BTreeMap<Sha256Hash, Sha256Hash>,
+        parent: Box<Hasher>,
+    },
+
+    /// The hasher for a value.  Array elements will append the hash of their
+    /// contents into the hasher of the array.
+    Value(Sha256),
+}
+
+impl Hasher {
+    fn request_id() -> Hasher {
+        Hasher::RequestId(Sha256::new())
+    }
+
+    fn fields(parent: Box<Hasher>) -> Hasher {
+        Hasher::Struct {
+            fields: BTreeMap::new(),
+            parent,
+        }
+    }
+
+    fn value() -> Hasher {
+        Hasher::Value(Sha256::new())
+    }
+}
+
 /// A Serde Serializer that collects fields and values in order to hash them later.
 /// We serialize the type to this structure, then use the trait to hash its content.
 /// It is a simple state machine that contains 3 states:
@@ -96,12 +131,7 @@ impl Serialize for RequestId {
 /// This does not validate whether a message is valid. This is very important as
 /// the message format might change faster than the ID calculation.
 struct RequestIdSerializer {
-    // We use a BTreeMap here as there is no indication that keys might not be duplicated,
-    // and we want to make sure they're overwritten in that case.
-    fields: Option<BTreeMap<Sha256Hash, Sha256Hash>>,
-    field_key_hash: Option<Sha256Hash>, // Only used in maps, not structs.
-    field_value_hash: Option<Sha256>,
-    hasher: Sha256,
+    element_encoder: Option<Hasher>,
 }
 
 impl RequestIdSerializer {
@@ -114,12 +144,10 @@ impl RequestIdSerializer {
     ///
     /// This can only be called once (it borrows self). Since this whole class is not public,
     /// it should not be a problem.
-    pub fn finish(mut self) -> Result<RequestId, RequestIdError> {
-        if self.fields.is_some() {
-            self.fields = None;
-            Ok(RequestId(self.hasher.finish()))
-        } else {
-            Err(RequestIdError::EmptySerializer)
+    pub fn finish(self) -> Result<RequestId, RequestIdError> {
+        match self.element_encoder {
+            Some(Hasher::RequestId(hasher)) => Ok(RequestId(hasher.finish())),
+            _ => Err(RequestIdError::EmptySerializer),
         }
     }
 
@@ -131,16 +159,50 @@ impl RequestIdSerializer {
     where
         T: ?Sized + Serialize,
     {
-        if self.field_value_hash.is_some() {
-            return Err(RequestIdError::InvalidState);
-        }
+        let prev_encoder = self.element_encoder.take();
+
+        self.element_encoder = Some(Hasher::value());
 
-        self.field_value_hash = Some(Sha256::new());
         value.serialize(&mut *self)?;
-        if let Some(r) = self.field_value_hash.take() {
-            Ok(r.finish())
-        } else {
-            Err(RequestIdError::InvalidState)
+        let result = match self.element_encoder.take() {
+            Some(Hasher::Value(hasher)) => Ok(hasher.finish()),
+            _ => Err(RequestIdError::InvalidState),
+        };
+        self.element_encoder = prev_encoder;
+        result
+    }
+
+    fn hash_fields(&mut self) -> Result<(), RequestIdError> {
+        match self.element_encoder.take() {
+            Some(Hasher::Struct { fields, parent }) => {
+                // Sort the fields.
+                let mut keyvalues: Vec<Vec<u8>> = fields
+                    .keys()
+                    .zip(fields.values())
+                    .map(|(k, v)| {
+                        let mut x = k.to_vec();
+                        x.extend(v);
+                        x
+                    })
+                    .collect();
+                keyvalues.sort();
+
+                let mut parent = *parent;
+
+                match &mut parent {
+                    Hasher::RequestId(hasher) => {
+                        for kv in keyvalues {
+                            hasher.update(&kv);
+                        }
+                        Ok(())
+                    }
+                    _ => Err(RequestIdError::InvalidState),
+                }?;
+
+                self.element_encoder = Some(parent);
+                Ok(())
+            }
+            _ => Err(RequestIdError::InvalidState),
         }
     }
 }
@@ -148,10 +210,7 @@ impl RequestIdSerializer {
 impl Default for RequestIdSerializer {
     fn default() -> RequestIdSerializer {
         RequestIdSerializer {
-            fields: None,
-            field_key_hash: None,
-            field_value_hash: None,
-            hasher: Sha256::new(),
+            element_encoder: Some(Hasher::request_id()),
         }
     }
 }
@@ -256,22 +315,23 @@ impl<'a> ser::Serializer for &'a mut RequestIdSerializer {
 
     /// Serialize a chunk of raw byte data.
     fn serialize_bytes(self, v: &[u8]) -> Result<Self::Ok, Self::Error> {
-        match self.field_value_hash {
-            None => Err(RequestIdError::InvalidState),
-            Some(ref mut hash) => {
-                (*hash).update(v);
+        match &mut self.element_encoder {
+            Some(Hasher::RequestId(hasher)) => {
+                hasher.update(v);
                 Ok(())
             }
+            Some(Hasher::Value(hasher)) => {
+                hasher.update(v);
+                Ok(())
+            }
+            _ => Err(RequestIdError::InvalidState),
         }
     }
 
     /// Serialize a [`None`] value.
     fn serialize_none(self) -> Result<Self::Ok, Self::Error> {
         // Compute the hash as if it was empty string or blob.
-        match self.field_value_hash {
-            None => Err(RequestIdError::InvalidState),
-            Some(ref mut _hash) => Ok(()),
-        }
+        Ok(())
     }
 
     /// Serialize a [`Some(T)`] value.
@@ -373,14 +433,7 @@ impl<'a> ser::Serializer for &'a mut RequestIdSerializer {
     /// Begin to serialize a map. This call must be followed by zero or more
     /// calls to `serialize_key` and `serialize_value`, then a call to `end`.
     fn serialize_map(self, _len: Option<usize>) -> Result<Self::SerializeMap, Self::Error> {
-        // This is the same as struct, but unnamed. We will use the current_field field
-        // here though, as serialize key and value are separate functions.
-        if self.fields.is_none() {
-            self.fields = Some(BTreeMap::new());
-            Ok(self)
-        } else {
-            Err(RequestIdError::UnsupportedStructInsideStruct)
-        }
+        Err(RequestIdError::UnsupportedTypeMap)
     }
 
     /// Begin to serialize a struct like `struct Rgb { r: u8, g: u8, b: u8 }`.
@@ -391,11 +444,13 @@ impl<'a> ser::Serializer for &'a mut RequestIdSerializer {
         _name: &'static str,
         _len: usize,
     ) -> Result<Self::SerializeStruct, Self::Error> {
-        if self.fields.is_none() {
-            self.fields = Some(BTreeMap::new());
-            Ok(self)
-        } else {
-            Err(RequestIdError::UnsupportedStructInsideStruct)
+        let parent_encoder = self.element_encoder.take();
+        match &parent_encoder {
+            Some(Hasher::RequestId(_)) => {
+                self.element_encoder = Some(Hasher::fields(Box::new(parent_encoder.unwrap())));
+                Ok(self)
+            }
+            _ => Err(RequestIdError::UnsupportedStructInsideStruct),
         }
     }
 
@@ -435,7 +490,26 @@ impl<'a> ser::SerializeSeq for &'a mut RequestIdSerializer {
     where
         T: ?Sized + Serialize,
     {
-        value.serialize(&mut **self)
+        let mut prev_encoder = self.element_encoder.take();
+
+        self.element_encoder = Some(Hasher::value());
+
+        value.serialize(&mut **self)?;
+
+        let value_encoder = self.element_encoder.take();
+        let hash = match value_encoder {
+            Some(Hasher::Value(hasher)) => Ok(hasher.finish()),
+            _ => Err(RequestIdError::InvalidState),
+        }?;
+
+        self.element_encoder = prev_encoder.take();
+        match &mut self.element_encoder {
+            Some(Hasher::Value(hasher)) => {
+                hasher.update(&hash);
+                Ok(())
+            }
+            _ => Err(RequestIdError::InvalidState),
+        }
     }
 
     // Close the sequence.
@@ -523,42 +597,25 @@ impl<'a> ser::SerializeMap for &'a mut RequestIdSerializer {
     // This can be done by using a different Serializer to serialize the key
     // (instead of `&mut **self`) and having that other serializer only
     // implement `serialize_str` and return an error on any other data type.
-    fn serialize_key<T>(&mut self, key: &T) -> Result<Self::Ok, Self::Error>
+    fn serialize_key<T>(&mut self, _key: &T) -> Result<Self::Ok, Self::Error>
     where
         T: ?Sized + Serialize,
     {
-        if self.field_key_hash.is_some() {
-            Err(RequestIdError::InvalidState)
-        } else {
-            let key_hash = self.hash_value(key)?;
-            self.field_key_hash = Some(key_hash);
-            Ok(())
-        }
+        Err(RequestIdError::UnsupportedTypeMap)
     }
 
     // It doesn't make a difference whether the colon is printed at the end of
     // `serialize_key` or at the beginning of `serialize_value`. In this case
     // the code is a bit simpler having it here.
-    fn serialize_value<T>(&mut self, value: &T) -> Result<Self::Ok, Self::Error>
+    fn serialize_value<T>(&mut self, _value: &T) -> Result<Self::Ok, Self::Error>
     where
         T: ?Sized + Serialize,
     {
-        let value_hash = self.hash_value(value)?;
-
-        match self.field_key_hash.take() {
-            None => Err(RequestIdError::InvalidState),
-            Some(key_hash) => match self.fields {
-                None => Err(RequestIdError::InvalidState),
-                Some(ref mut f) => {
-                    f.insert(key_hash, value_hash);
-                    Ok(())
-                }
-            },
-        }
+        Err(RequestIdError::UnsupportedTypeMap)
     }
 
     fn end(self) -> Result<Self::Ok, Self::Error> {
-        Ok(())
+        self.hash_fields()
     }
 }
 
@@ -572,44 +629,19 @@ impl<'a> ser::SerializeStruct for &'a mut RequestIdSerializer {
     where
         T: ?Sized + Serialize,
     {
-        if self.field_value_hash.is_some() {
-            return Err(RequestIdError::InvalidState);
-        }
-
         let key_hash = self.hash_value(key)?;
         let value_hash = self.hash_value(value)?;
-
-        match self.fields {
-            None => Err(RequestIdError::InvalidState),
-            Some(ref mut f) => {
-                f.insert(key_hash, value_hash);
+        match &mut self.element_encoder {
+            Some(Hasher::Struct { fields, .. }) => {
+                fields.insert(key_hash, value_hash);
                 Ok(())
             }
+            _ => Err(RequestIdError::InvalidState),
         }
     }
 
     fn end(self) -> Result<Self::Ok, Self::Error> {
-        if let Some(fields) = &self.fields {
-            // Sort the fields.
-            let mut keyvalues: Vec<Vec<u8>> = fields
-                .keys()
-                .zip(fields.values())
-                .map(|(k, v)| {
-                    let mut x = k.to_vec();
-                    x.extend(v);
-                    x
-                })
-                .collect();
-            keyvalues.sort();
-
-            for kv in keyvalues {
-                self.hasher.update(&kv);
-            }
-
-            Ok(())
-        } else {
-            Err(RequestIdError::InvalidState)
-        }
+        self.hash_fields()
     }
 }
 
@@ -718,4 +750,122 @@ mod tests {
             "8781291c347db32a9d8c10eb62b710fce5a93be676474c42babc74c51858f94b"
         );
     }
+
+    /// A simple example with nested arrays and blobs
+    #[test]
+    #[allow(clippy::string_lit_as_bytes)]
+    fn array_example() {
+        #[derive(Serialize)]
+        struct NestedArraysExample {
+            sender: Principal,
+            paths: Vec<Vec<serde_bytes::ByteBuf>>,
+        };
+        let data = NestedArraysExample {
+            sender: Principal::try_from(&vec![0, 0, 0, 0, 0, 0, 0x04, 0xD2]).unwrap(), // 1234 in u64
+            paths: vec![
+                vec![],
+                vec![serde_bytes::ByteBuf::from("".as_bytes())],
+                vec![
+                    serde_bytes::ByteBuf::from("hello".as_bytes()),
+                    serde_bytes::ByteBuf::from("world".as_bytes()),
+                ],
+            ],
+        };
+
+        let request_id = to_request_id(&data).unwrap();
+        assert_eq!(
+            hex::encode(request_id.0.to_vec()),
+            "97d6f297aea699aec85d3377c7643ea66db810aba5c4372fbc2082c999f452dc"
+        );
+
+        /* The above was generated using ic-ref as follows:
+
+        ~/dfinity/ic-ref/impl $ cabal repl ic-ref
+        Build profile: -w ghc-8.8.4 -O1
+        …
+        *Main> :set -XOverloadedStrings
+        *Main> :m + IC.HTTP.RequestId IC.HTTP.GenR
+        *Main IC.HTTP.RequestId IC.HTTP.GenR> import qualified Data.HashMap.Lazy as HM
+        *Main IC.HTTP.RequestId IC.HTTP.GenR HM> let input = GRec (HM.fromList [("sender", GBlob "\0\0\0\0\0\0\x04\xD2"), ("paths", GList [ GList [], GList [GBlob ""], GList [GBlob "hello", GBlob "world"]])])
+        *Main IC.HTTP.RequestId IC.HTTP.GenR HM> putStrLn $ IC.Types.prettyBlob (requestId input )
+        0x97d6f297aea699aec85d3377c7643ea66db810aba5c4372fbc2082c999f452dc
+        */
+    }
+
+    /// A simple example with just an empty array
+    #[test]
+    fn array_example_empty_array() {
+        #[derive(Serialize)]
+        struct NestedArraysExample {
+            paths: Vec<Vec<serde_bytes::ByteBuf>>,
+        };
+        let data = NestedArraysExample { paths: vec![] };
+
+        let request_id = to_request_id(&data).unwrap();
+        assert_eq!(
+            hex::encode(request_id.0.to_vec()),
+            "99daa8c80a61e87ac1fdf9dd49e39963bfe4dafb2a45095ebf4cad72d916d5be"
+        );
+
+        /* The above was generated using ic-ref as follows:
+
+        ~/dfinity/ic-ref/impl $ cabal repl ic-ref
+        Build profile: -w ghc-8.8.4 -O1
+        …
+        *Main> :set -XOverloadedStrings
+        *Main> :m + IC.HTTP.RequestId IC.HTTP.GenR
+        *Main IC.HTTP.RequestId IC.HTTP.GenR> import qualified Data.HashMap as HM
+        *Main IC.HTTP.RequestId IC.HTTP.GenR HM> let input = GRec (HM.fromList [("paths", GList [])])
+        *Main IC.HTTP.RequestId IC.HTTP.GenR HM> putStrLn $ IC.Types.prettyBlob (requestId input )
+        0x99daa8c80a61e87ac1fdf9dd49e39963bfe4dafb2a45095ebf4cad72d916d5be
+        */
+    }
+
+    /// A simple example with an array that holds an empty array
+    #[test]
+    fn array_example_array_with_empty_array() {
+        #[derive(Serialize)]
+        struct NestedArraysExample {
+            paths: Vec<Vec<serde_bytes::ByteBuf>>,
+        };
+        let data = NestedArraysExample {
+            paths: vec![vec![]],
+        };
+
+        let request_id = to_request_id(&data).unwrap();
+        assert_eq!(
+            hex::encode(request_id.0.to_vec()),
+            "ea01a9c3d3830db108e0a87995ea0d4183dc9c6e51324e9818fced5c57aa64f5"
+        );
+
+        /* The above was generated using ic-ref as follows:
+
+        ~/dfinity/ic-ref/impl $ cabal repl ic-ref
+        Build profile: -w ghc-8.8.4 -O1
+        …
+        *Main> :set -XOverloadedStrings
+        *Main> :m + IC.HTTP.RequestId IC.HTTP.GenR
+        *Main IC.HTTP.RequestId IC.HTTP.GenR> import qualified Data.HashMap.Lazy as HM
+        *Main IC.HTTP.RequestId IC.HTTP.GenR HM> let input = GRec (HM.fromList [("paths", GList [ GList [] ])])
+        *Main IC.HTTP.RequestId IC.HTTP.GenR HM> putStrLn $ IC.Types.prettyBlob (requestId input )
+        0xea01a9c3d3830db108e0a87995ea0d4183dc9c6e51324e9818fced5c57aa64f5
+        */
+    }
+
+    /// We do not support creating a request id from a map.
+    /// It adds complexity, and isn't that useful anyway because a real request would
+    /// have to have different kinds of values (strings, principals, arrays) and
+    /// we don't support the wrappers that would be required to make that work
+    /// with rust maps.
+    #[test]
+    fn maps_are_not_supported() {
+        let mut data = BTreeMap::new();
+        data.insert("request_type", "call");
+        data.insert("canister_id", "a principal / the canister id");
+        data.insert("method_name", "hello");
+        data.insert("arg", "some argument value");
+
+        let error = to_request_id(&data).unwrap_err();
+        assert_eq!(error, RequestIdError::UnsupportedTypeMap);
+    }
 }
diff --git a/icx/src/main.rs b/icx/src/main.rs
index d503f105..2feaf68c 100644
--- a/icx/src/main.rs
+++ b/icx/src/main.rs
@@ -5,7 +5,7 @@ use clap::{crate_authors, crate_version, AppSettings, Clap};
 use ic_agent::agent::AgentConfig;
 use ic_agent::export::Principal;
 use ic_agent::identity::BasicIdentity;
-use ic_agent::{Agent, AgentError, Identity};
+use ic_agent::{Agent, AgentError, HttpErrorPayload, Identity};
 use ring::signature::Ed25519KeyPair;
 use std::convert::TryFrom;
 use std::error::Error;
@@ -280,11 +280,11 @@ async fn main() -> Result<(), Box<dyn Error>> {
                     print_idl_blob(&blob, &t.output, &method_type)
                         .map_err(|e| format!("Invalid IDL blob: {}", e))?;
                 }
-                Err(AgentError::HttpError {
+                Err(AgentError::HttpError(HttpErrorPayload {
                     status,
                     content_type,
                     content,
-                }) => {
+                })) => {
                     eprintln!("Server returned an HTTP Error:\n  Code: {}", status);
                     match content_type.as_deref() {
                         None => eprintln!("  Content: {}", hex::encode(content)),
diff --git a/ref-tests/tests/ic-ref.rs b/ref-tests/tests/ic-ref.rs
index c7e0fbf4..d194e30b 100644
--- a/ref-tests/tests/ic-ref.rs
+++ b/ref-tests/tests/ic-ref.rs
@@ -13,7 +13,7 @@
 use ref_tests::universal_canister;
 use ref_tests::with_agent;
 
-const EXPECTED_IC_API_VERSION: &str = "0.11.1";
+const EXPECTED_IC_API_VERSION: &str = "0.13.2";
 
 #[ignore]
 #[test]
diff --git a/ref-tests/tests/integration.rs b/ref-tests/tests/integration.rs
index 1cebf13f..278a3e14 100644
--- a/ref-tests/tests/integration.rs
+++ b/ref-tests/tests/integration.rs
@@ -2,7 +2,7 @@
 //!
 //! Contrary to ic-ref.rs, these tests are not meant to match any other tests. They're
 //! integration tests with a running IC-Ref.
-use ic_agent::AgentError;
+use ic_agent::{AgentError, HttpErrorPayload};
 use ic_utils::call::AsyncCall;
 use ic_utils::call::SyncCall;
 use ic_utils::{interfaces, Canister};
@@ -37,7 +37,7 @@ fn basic_expiry() {
             .await;
 
         match result.unwrap_err() {
-            AgentError::HttpError { status, .. } => assert_eq!(status, 400),
+            AgentError::HttpError(HttpErrorPayload { status, .. }) => assert_eq!(status, 400),
             x => assert!(false, "Was expecting an error, got {:?}", x),
         }
 
@@ -80,6 +80,32 @@ fn canister_query() {
     })
 }
 
+#[ignore]
+#[test]
+fn canister_reject_call() {
+    // try to call a wallet method, but on the universal canister.
+    // this lets us look up the reject code and reject message in the certificate.
+    with_universal_canister(|agent, wallet_id| async move {
+        let alice = interfaces::Wallet::create(&agent, wallet_id);
+        let bob = interfaces::Wallet::create(&agent, create_wallet_canister(&agent).await?);
+
+        let result = alice
+            .send_cycles(&bob, 1_000_000)
+            .call_and_wait(create_waiter())
+            .await;
+
+        assert_eq!(
+            result,
+            Err(AgentError::ReplicaError {
+                reject_code: 3,
+                reject_message: "method does not exist: send_cycles".to_string()
+            })
+        );
+
+        Ok(())
+    });
+}
+
 #[ignore]
 #[test]
 fn wallet_canister_forward() {