Changelog

UnreleasedCopy Anchor Link

• The mandate of the human. A person signs a TwinMandateCredential for their twin with the device key of the AY app: ES256, raw 64-byte signature, issuer is the person's DID. identity/resolve of a person twin returns it in credentials, and the resolver shows it. See Mandate.
• New status list. GET /api/v1/identity/status-list/mandates, same format and values as the other lists.
• New verdict reason. POST /identity/credentials/verify returns invalid with issuer_not_controller when the issuer of a mandate is not the controller of the twin.
• New errors, only with enforcement on. 409 MANDATE_REQUIRED on agent registration, attestation and rotation, and 403 OWNER_MANDATE_MISSING on agent requests, for persons without a valid mandate. Enforcement stays off until the app version with the mandate is rolled out. See Errors.
• Test vector. twin-mandate.json. See Test vectors.

2026-09-28Copy Anchor Link

• Every agent passport needs a paired person behind it. POST /agents, POST /agents/{id}/attest and key rotation return 409 IDENTITY_NOT_REGISTERED while the acting person has no DID. With X-Act-As this is the person acting for the business. The passport no longer carries a placeholder owner; a business twin without a DID returns 409 TWIN_DID_MISSING. The web app shows "pair your phone first" on /agent/register as well.
• The twin's controller is the person's DID. Pairing sets it in the twin's DID document (did.json); the resolver shows it. It is a statement of the platform, not yet a signed proof. The signed mandate of the person for the twin follows separately.
• Status lists use the registered IETF values. 1 now means INVALID (revoked) and 2 means SUSPENDED, as in draft-ietf-oauth-status-list. Before, the two values were swapped. Update any verifier that reads the bits itself; POST /identity/credentials/verify already returns the right verdict.
• A new index per issuance of the Business Verification Credential. A credential that was superseded by a re-verification stays INVALID forever; it can no longer return to valid.
• Business agents need a verified business. POST /agents with X-Act-As and POST /agents/{id}/attest return 409 BUSINESS_NOT_VERIFIED until the business is verified.
• Docs. Skills are required for twin dispatch; agent changes go through the owner's token; credentials/verify takes { "jwt" }. See Register with a Zitadel credential.

2026-09-27Copy Anchor Link

• Twin → Agent signatures use the tag ay-t2a. Twins sign calls to agents with a dedicated tag; a twin-to-twin signature is no longer valid at an agent. Agents must pin the sender DID from controller. See Verify requests from twins.
• Key rotation and revocation. POST /agents/{id}/keys/rotate/challenge and POST /agents/{id}/keys/rotate for owners, the same under /agents/me/… for signed self-rotation, and POST /agents/{id}/credentials/rotate for Zitadel credentials. DELETE /agents/{id} now writes a deactivation entry to the DID log.
• Public resolver. resolver.aytwin.ai shows document, verified history, credentials, and Agent Card for any AY identity.
• Public OpenAPI specification. GET /api/v1/docs/openapi-public.json serves the specification behind this reference.

2026-09-26Copy Anchor Link

• OAuth2 credentials at registration. POST /agents returns a Zitadel credential (key_json or client_secret) once. Agents authenticate with an access token whose aud is the AY agents project.
• Bring your own key. Register with public_key_multibase to keep the Ed25519 key yourself; prove possession with POST /agents/{id}/attest. Signed requests use RFC 9421 with the tag ay-agent.
• One method per request. Signature-Input together with Authorization returns 400 ambiguous_auth.
• Agent Card. Every active agent publishes an A2A 1.0 card at /agents/{id}/.well-known/agent.json, signed by AY for platform custody.
• API key deprecated. Responses that use the legacy ay_agent_… key carry Deprecation: @1790380800 and Sunset: Fri, 03 Apr 2027 00:00:00 GMT. The key stops working on that date.