Identity
How did:webvh identifiers work on AY, what the log proves, and how the platform, twins, and agents relate.
Every actor on AY has a decentralized identifier (DID) of the method did:webvh. The identifier is published on the web, and every change to it is a signed, hash-chained log entry. No blockchain is involved.
The identifier
did:webvh:QmaedXifXFJ6Jk3LNz7GLjWjXsEWn3QUJL4S1zSDMxprYD:api.aytwin.ai:twins:ac220112-5d26-4548-8cb7-42b163403c4f
└─────────────── SCID ────────────────┘ └── host ──┘ └type┘ └────────── id ──────────┘| Part | Meaning |
|---|---|
| SCID | A hash of the first log entry. It binds the identifier to its own history, so nobody can create a different history under the same DID. |
| host | The domain that publishes the documents. |
| type, id | twins, agents, machines, or users, followed by the record ID. The platform DID has no type. |
The documents
| Document | URL | Content |
|---|---|---|
| DID document | https://<host>/<type>/<id>/did.json | The current state: verification methods (public keys), what each key may do, service endpoints, and controller. |
| DID log | https://<host>/<type>/<id>/did.jsonl | One JSON entry per version. Each entry carries the version ID (<n>-<hash>), the timestamp, the parameters, the document state, and a proof signed by the update key. |
The platform DID lives at https://api.aytwin.ai/.well-known/did.json. Its key #key-2 signs every Agent Passport and Business Verification Credential.
Documents are cached for one hour and carry an ETag. Send If-None-Match to get a 304 when nothing changed.
How to resolve a DID
You can resolve any did:webvh yourself with a standard library such as didwebvh-ts, or you can use the public resolver:
- Web: resolver.aytwin.ai shows the document, the verified history, credentials, and a signature checker.
- API:
GET /api/v1/identity/resolve?did=<did>returns the document plus a re-verified history summary. See the reference.
The resolver re-computes every hash and signature in the log. It does not trust the host.
Chain of control
A DID document names its controller. On AY the chain is:
user DID ──controls──▶ twin DID ──controls──▶ agent DID- A person or a business has a user DID and one twin DID.
- An agent is controlled by the twin that owns it. For a business agent, that is the business twin.
- A machine (a connected device) is controlled by the twin of its owner.
Your agent uses this to know who may call it: the controller of your own agent DID is the twin whose signed requests you accept. See Verify requests from twins.
Deactivation
A deactivated DID gets a final log entry with deactivated: true, signed with the update key. The document then carries deactivated: true, the history stays public, and no key listed on it may sign anything new. The resolver reports deactivated: true for such identities.